Edit tour

Windows Analysis Report
PQwHxAiBGt.exe

Overview

General Information

Sample name:	PQwHxAiBGt.exe renamed because original name is a hash value
Original sample name:	61151df093ebef01768789ead98ed2ed73ef951162414101b25a9db8129491a3.exe
Analysis ID:	1571370
MD5:	2f0b358d17ffaf3d1f36eb992003fc68
SHA1:	e65fa958100ec8bf4773946c2cd9fa8cd9c5b6d7
SHA256:	61151df093ebef01768789ead98ed2ed73ef951162414101b25a9db8129491a3
Tags:	C2-at-pastebin-yd1QnTjKexeuser-JAMESWT_MHT
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

.NET source code references suspicious native API functions

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to detect sleep reduction / modifications

Drops PE files with a suspicious file extension

Injects a PE file into a foreign processes

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes many files with high entropy

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to get notified if a device is plugged in / out

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a global mouse hook

Installs a raw input device (often for capturing keystrokes)

May check if the current machine is a sandbox (GetTickCount - Sleep)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious desktop.ini Action

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

PQwHxAiBGt.exe (PID: 8024 cmdline: "C:\Users\user\Desktop\PQwHxAiBGt.exe" MD5: 2F0B358D17FFAF3D1F36EB992003FC68)

setup.exe (PID: 8152 cmdline: "C:\Users\user\AppData\Local\Temp\setup.exe" MD5: 9DEF78C3562D533C530706BA4A2D1277)

setup.tmp (PID: 7288 cmdline: "C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp" /SL5="$104AA,1145856,1145856,C:\Users\user\AppData\Local\Temp\setup.exe" MD5: DD78675858275301D48256D22D52CA74)

RobertsonDeclined.exe (PID: 8160 cmdline: "C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe" MD5: 9E17536C65B31B33BE6F5840E3945407)

cmd.exe (PID: 7424 cmdline: "C:\Windows\System32\cmd.exe" /c copy Me Me.cmd & Me.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7608 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6156 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6704 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6212 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1672 cmdline: cmd /c md 422648 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 6440 cmdline: cmd /c copy /b ..\Total + ..\Jones + ..\Handed + ..\Norwegian + ..\Beef + ..\Cu + ..\Biology + ..\Busy + ..\Bahamas + ..\Invoice + ..\Practices + ..\Atm + ..\Particularly + ..\Ongoing + ..\Lane + ..\False + ..\Huge B MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Ai.com (PID: 1184 cmdline: Ai.com B MD5: 62D09F076E6E0240548C2F837536A46A)

RegAsm.exe (PID: 724 cmdline: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 8108 cmdline: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe MD5: 0D5DF43AF2916F47D00C1573797C1A13)

svchost.exe (PID: 8060 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

choice.exe (PID: 7416 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Malware Configuration

Threatname: Rhadamanthys

{"C2 url": "https://154.216.17.46:3673/d3b272a7b40f3260049/pfcws03c.cmivs"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000012.00000003.1704529751.0000000005200000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000012.00000003.1705181582.0000000005420000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000012.00000003.1702400594.00000000029F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000011.00000002.1707925431.0000000004E60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000012.00000002.1713875821.0000000002EC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 8108	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: svchost.exe PID: 8060	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
18.3.svchost.exe.5420000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
18.3.svchost.exe.5420000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
18.3.svchost.exe.5200000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Sigma Signatures

System Summary

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, ParentCommandLine: Ai.com B, ParentImage: C:\Users\user\AppData\Local\Temp\422648\Ai.com, ParentProcessId: 1184, ParentProcessName: Ai.com, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, ProcessId: 724, ProcessName: RegAsm.exe

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, ParentCommandLine: Ai.com B, ParentImage: C:\Users\user\AppData\Local\Temp\422648\Ai.com, ParentProcessId: 1184, ParentProcessName: Ai.com, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, ProcessId: 724, ProcessName: RegAsm.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Me Me.cmd & Me.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Me Me.cmd & Me.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe", ParentImage: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe, ParentProcessId: 8160, ParentProcessName: RobertsonDeclined.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Me Me.cmd & Me.cmd, ProcessId: 7424, ProcessName: cmd.exe

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Desktop\PQwHxAiBGt.exe, ProcessId: 8024, TargetFilename: C:\Users\user\AppData\Local\Temp\desktop.ini

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, ParentImage: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, ParentProcessId: 8108, ParentProcessName: RegAsm.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 8060, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, ParentImage: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe, ParentProcessId: 8108, ParentProcessName: RegAsm.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 8060, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Me Me.cmd & Me.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7424, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 6212, ProcessName: findstr.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000011.00000002.1704039560.00000000027A1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://154.216.17.46:3673/d3b272a7b40f3260049/pfcws03c.cmivs"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

ReversingLabs: Detection: 70%

Multi AV Scanner detection for submitted file

Source: PQwHxAiBGt.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: PQwHxAiBGt.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: PQwHxAiBGt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wkernel32.pdb source: svchost.exe, 00000012.00000003.1704338403.0000000004F40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1704249905.0000000004E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: svchost.exe, 00000012.00000003.1704529751.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1705181582.0000000005420000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: svchost.exe, 00000012.00000003.1703439346.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1703648304.00000000053F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000010.00000000.1644614167.00000000000C2000.00000002.00000001.01000000.00000010.sdmp, RegAsm.exe.13.dr
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000012.00000003.1704088858.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1703907796.0000000004E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: svchost.exe, 00000012.00000003.1703439346.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1703648304.00000000053F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, 00000012.00000003.1704088858.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1703907796.0000000004E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000010.00000000.1644614167.00000000000C2000.00000002.00000001.01000000.00000010.sdmp, RegAsm.exe.13.dr
Source:	Binary string: wkernel32.pdbUGP source: svchost.exe, 00000012.00000003.1704338403.0000000004F40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1704249905.0000000004E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: svchost.exe, 00000012.00000003.1704529751.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1705181582.0000000005420000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: Setup.pdb source: PQwHxAiBGt.exe

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_00247720 SystemParametersInfoW,SystemParametersInfoW,SystemParametersInfoW,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleW,CreateWindowExW,ShowWindow,RegisterDeviceNotificationW,PeekMessageW,TranslateMessage,DispatchMessageW,TranslateMessage,DispatchMessageW,PeekMessageW,

4_2_00247720

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_004062D5 FindFirstFileW,FindClose,	3_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_00402E18 FindFirstFileW,	3_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001ED280 VirtualQuery,GetModuleFileNameW,wcsrchr,wcscpy,FindFirstFileW,wcscpy,LoadLibraryW,GetProcAddress,wcsrchr,_wcslwr,strcpy,FindNextFileW,	4_2_001ED280

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\422648\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\422648	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then push ebp	4_2_002D60D0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then mov eax, 0035E790h	4_2_002D60D0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001C831D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001C8316
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001C8644
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001F2951
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_00280FF0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001F2FF9
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001C8FF0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001C9116
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 0Ch	4_2_00327970
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then mov eax, ecx	4_2_00301B10
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001C7FD6
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001C7FCF
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4x nop then sub esp, 1Ch	4_2_001C7FC8

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://154.216.17.46:3673/d3b272a7b40f3260049/pfcws03c.cmivs

Source: Joe Sandbox View	IP Address: 104.26.8.44 104.26.8.44
Source: Joe Sandbox View	IP Address: 185.166.143.50 185.166.143.50

Source: unknown

DNS query: name: ipapi.co

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: ipapi.co
Source: global traffic	DNS traffic detected: DNS query: edMKDlxnNIzWufljfi.edMKDlxnNIzWufljfi

Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: RobertsonDeclined.exe, 00000003.00000000.1325882952.0000000000408000.00000002.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmp, PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Ai.com, 0000000D.00000000.1389988787.00000000006C5000.00000002.00000001.01000000.0000000F.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: svchost.exe, 00000012.00000002.1713419509.000000000083C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://154.216.17.46:3673/d3b272a7b40f3260049/pfcws03c.cmivs
Source: svchost.exe, 00000012.00000002.1713419509.000000000083C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://154.216.17.46:3673/d3b272a7b40f3260049/pfcws03c.cmivsx
Source: PQwHxAiBGt.exe	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=&parse_mode=Markdown
Source: PQwHxAiBGt.exe	String found in binary or memory: https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof
Source: setup.tmp.2.dr	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: PQwHxAiBGt.exe	String found in binary or memory: https://ipapi.co/json/country_codecountry_name
Source: PQwHxAiBGt.exe, setup.exe.0.dr	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Ai.com.5.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

Code function: 3_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

3_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_00242600 MultiByteToWideChar,MultiByteToWideChar,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,GlobalFree,

4_2_00242600

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_00242640 OpenClipboard,GetClipboardData,GlobalLock,free,GlobalUnlock,CloseClipboard,CloseClipboard,CloseClipboard,

4_2_00242640

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

Code function: 3_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

3_2_004044A5

Source: setup.exe, 00000002.00000003.1329055318.000000007FCED000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_3e8f93a6-e

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\dinput8.dll

Jump to behavior

Source: setup.exe, 00000002.00000003.1327544227.00000000025C0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_89770716-1

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_0024AFA0 GetPropW,DefWindowProcW,ShowWindow,GetRawInputData,free,calloc,MonitorFromWindow,GetMonitorInfoW,TrackMouseEvent,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,SetCursor,DragQueryFileW,DragQueryFileW,calloc,DragQueryPoint,DragQueryFileW,calloc,DragQueryFileW,free,free,free,DragFinish,SetCapture,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,ReleaseCapture,GetMessageTime,PeekMessageW,SetWindowPos,GetMonitorInfoW,SetWindowPos,GetClientRect,ClientToScreen,ClientToScreen,ClientToScreen,ClipCursor,GetClientRect,ClientToScreen,ClipCursor,SetCursor,SetThreadExecutionState,AdjustWindowRectEx,LoadCursorW,SetCursor,SystemParametersInfoW,SystemParametersInfoW,SystemParametersInfoW,SetThreadExecutionState,SystemParametersInfoW,AdjustWindowRectEx,

4_2_0024AFA0

Source: Yara match	File source: 18.3.svchost.exe.5420000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.svchost.exe.5420000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.svchost.exe.5200000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000003.1704529751.0000000005200000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1705181582.0000000005420000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 8060, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	File created: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe entropy: 7.99316440556	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Ongoing entropy: 7.99693237585	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Atm entropy: 7.99734017055	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Jones entropy: 7.99695583409	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Busy entropy: 7.99772506994	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Norwegian entropy: 7.99689152681	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Biology entropy: 7.99804795371	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Invoice entropy: 7.9974280948	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Bahamas entropy: 7.99748235643	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Huge entropy: 7.99377944152	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Particularly entropy: 7.99798135853	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Total entropy: 7.99705806378	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Lane entropy: 7.99819170635	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Cu entropy: 7.99809135944	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Beef entropy: 7.99702030843	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\False entropy: 7.99823283601	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Practices entropy: 7.99791717913	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Handed entropy: 7.99676527336	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\422648\B entropy: 7.99986688075	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_00212520: DeviceIoControl,WideCharToMultiByte,

4_2_00212520

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	3_2_00403883
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00209A07 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	4_2_00209A07
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00209A41 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	4_2_00209A41

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Windows\ImplicationsKo			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Windows\PctUpset			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_0040497C	3_2_0040497C
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_00406ED2	3_2_00406ED2
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_004074BB	3_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0024AFA0	4_2_0024AFA0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001FC161	4_2_001FC161
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0020C3D0	4_2_0020C3D0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00252360	4_2_00252360
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00284340	4_2_00284340
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0020C3D0	4_2_0020C3D0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00280430	4_2_00280430
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0020C3D0	4_2_0020C3D0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0020C3D0	4_2_0020C3D0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0020C3D0	4_2_0020C3D0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0027A4F0	4_2_0027A4F0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001FA530	4_2_001FA530
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001FC556	4_2_001FC556
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001DA5D0	4_2_001DA5D0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001FC5F4	4_2_001FC5F4
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0020A612	4_2_0020A612
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F8690	4_2_001F8690
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F2710	4_2_001F2710
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F27B9	4_2_001F27B9
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0027CA50	4_2_0027CA50
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0021CADC	4_2_0021CADC
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00226B01	4_2_00226B01
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00260B00	4_2_00260B00
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0025EB70	4_2_0025EB70
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00250B80	4_2_00250B80
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001FCC11	4_2_001FCC11
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00242D10	4_2_00242D10
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00222DC0	4_2_00222DC0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00262E50	4_2_00262E50
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001E8E80	4_2_001E8E80
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00238FE7	4_2_00238FE7
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00209058	4_2_00209058
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001FD100	4_2_001FD100
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F9150	4_2_001F9150
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0021B236	4_2_0021B236
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0023720D	4_2_0023720D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001C32C0	4_2_001C32C0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0022F31B	4_2_0022F31B
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002193C2	4_2_002193C2
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00209530	4_2_00209530
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001DD540	4_2_001DD540
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002555D0	4_2_002555D0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0027B670	4_2_0027B670
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0021964C	4_2_0021964C
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0025B7E0	4_2_0025B7E0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0020DC30	4_2_0020DC30
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00255D70	4_2_00255D70
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00235E6C	4_2_00235E6C
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001E7F50	4_2_001E7F50
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F9FCC	4_2_001F9FCC
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Code function: 17_2_0544A1C0	17_2_0544A1C0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\422648\Ai.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: String function: 004062A3 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: String function: 0027F1F0 appears 186 times
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: String function: 0023F1D0 appears 184 times
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: String function: 002470E0 appears 67 times
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: String function: 00300FC0 appears 69 times

Source: PQwHxAiBGt.exe

Binary or memory string: OriginalFileName vs PQwHxAiBGt.exe

Source: PQwHxAiBGt.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@33/28@3/2

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_002470E0 GetLastError,FormatMessageW,WideCharToMultiByte,

4_2_002470E0

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001ED6B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleW,GetProcAddress,	4_2_001ED6B0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00209A07 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	4_2_00209A07
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00209A41 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	4_2_00209A41

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

3_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

Code function: 3_2_004024FB CoCreateInstance,

3_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_001C1AA0 GetModuleHandleW,FindResourceW,LoadResource,LockResource,SizeofResource,

4_2_001C1AA0

Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1824:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Mutant created: \Sessions\1\BaseNamedObjects\DARKSiDERSCUSTOM ORDER MAID 3D2 The Extreme Sadist Queen Who Arouses The Hearts Of Masochists
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-6819bdd2-0035-7461a9-207e610965a6}

Source: C:\Users\user\Desktop\PQwHxAiBGt.exe

File created: C:\Users\user\AppData\Local\Temp\setup.exe

Jump to behavior

Source: PQwHxAiBGt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PQwHxAiBGt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PQwHxAiBGt.exe

ReversingLabs: Detection: 52%

Source: PQwHxAiBGt.exe

String found in binary or memory: /LOADINF="filename"

Source: unknown	Process created: C:\Users\user\Desktop\PQwHxAiBGt.exe "C:\Users\user\Desktop\PQwHxAiBGt.exe"
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Process created: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe "C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe"
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp "C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp" /SL5="$104AA,1145856,1145856,C:\Users\user\AppData\Local\Temp\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Me Me.cmd & Me.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 422648
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Total + ..\Jones + ..\Handed + ..\Norwegian + ..\Beef + ..\Cu + ..\Biology + ..\Busy + ..\Bahamas + ..\Invoice + ..\Practices + ..\Atm + ..\Particularly + ..\Ongoing + ..\Lane + ..\False + ..\Huge B
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\422648\Ai.com Ai.com B
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Process created: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Process created: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Process created: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe "C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp "C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp" /SL5="$104AA,1145856,1145856,C:\Users\user\AppData\Local\Temp\setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Me Me.cmd & Me.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 422648	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Total + ..\Jones + ..\Handed + ..\Norwegian + ..\Beef + ..\Cu + ..\Biology + ..\Busy + ..\Bahamas + ..\Invoice + ..\Practices + ..\Atm + ..\Particularly + ..\Ongoing + ..\Lane + ..\False + ..\Huge B	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\422648\Ai.com Ai.com B	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Process created: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Process created: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: xinput1_4.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: opengl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: glu32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: networkexplorer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\findstr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: PQwHxAiBGt.exe

Static file information: File size 5276672 > 1048576

Source: PQwHxAiBGt.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x40f200

Source: PQwHxAiBGt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PQwHxAiBGt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PQwHxAiBGt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PQwHxAiBGt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PQwHxAiBGt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PQwHxAiBGt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PQwHxAiBGt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: PQwHxAiBGt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wkernel32.pdb source: svchost.exe, 00000012.00000003.1704338403.0000000004F40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1704249905.0000000004E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: svchost.exe, 00000012.00000003.1704529751.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1705181582.0000000005420000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: svchost.exe, 00000012.00000003.1703439346.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1703648304.00000000053F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000010.00000000.1644614167.00000000000C2000.00000002.00000001.01000000.00000010.sdmp, RegAsm.exe.13.dr
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000012.00000003.1704088858.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1703907796.0000000004E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: svchost.exe, 00000012.00000003.1703439346.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1703648304.00000000053F0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, 00000012.00000003.1704088858.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1703907796.0000000004E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000010.00000000.1644614167.00000000000C2000.00000002.00000001.01000000.00000010.sdmp, RegAsm.exe.13.dr
Source:	Binary string: wkernel32.pdbUGP source: svchost.exe, 00000012.00000003.1704338403.0000000004F40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1704249905.0000000004E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: svchost.exe, 00000012.00000003.1704529751.0000000005200000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000003.1705181582.0000000005420000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: Setup.pdb source: PQwHxAiBGt.exe

Source: PQwHxAiBGt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PQwHxAiBGt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PQwHxAiBGt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PQwHxAiBGt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PQwHxAiBGt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

Code function: 3_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

3_2_004062FC

Source: setup.tmp.2.dr	Static PE information: real checksum: 0x26b7e9 should be: 0x302cd2
Source: setup.exe.0.dr	Static PE information: real checksum: 0xcd87d should be: 0x20c3f1
Source: PQwHxAiBGt.exe	Static PE information: real checksum: 0x0 should be: 0x517911
Source: RobertsonDeclined.exe.0.dr	Static PE information: real checksum: 0x1af179 should be: 0x1b03c5

Source: setup.exe.0.dr	Static PE information: section name: .didata
Source: setup.tmp.2.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0024AFA0 push edx; mov dword ptr [esp], eax	4_2_0024C94A
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F2079 push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F209E push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F2097 push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F208B push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F20B3 push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F20AC push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F20A5 push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001C831D push eax; mov dword ptr [esp], esi	4_2_0032EDDD
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001C8316 push eax; mov dword ptr [esp], esi	4_2_0032EDDD
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0023C379 push eax; retn 0023h	4_2_0023C386
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0023C38B pushad ; retn 0023h	4_2_0023C3A2
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00332534 push edx; mov dword ptr [esp], edi	4_2_0033272B
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002FE660 push eax; mov dword ptr [esp], esi	4_2_00331185
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001C8644 push eax; mov dword ptr [esp], esi	4_2_0032EDDD
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002E0860 push edx; mov dword ptr [esp], ebx	4_2_002E0A75
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002E0860 push eax; mov dword ptr [esp], ebx	4_2_002E0A98
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F0BAB push eax; mov dword ptr [esp], ebx	4_2_0032F9AE
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F0BAB push eax; mov dword ptr [esp], ebx	4_2_0032F9C4
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F0BAB push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F117D push eax; mov dword ptr [esp], ebx	4_2_0032F9C4
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F117D push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0020548E push eax; mov dword ptr [esp], ebx	4_2_0033000A
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_00205495 push eax; mov dword ptr [esp], ebx	4_2_0033000A
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002E1570 push eax; mov dword ptr [esp], ebx	4_2_002E1840
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002E1570 push edx; mov dword ptr [esp], ebx	4_2_002E185F
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F1A20 push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F1A20 push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001F1A20 push eax; mov dword ptr [esp], ebx	4_2_0032FA6D
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002E1AE0 push eax; mov dword ptr [esp], ebx	4_2_002E1DB0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002E1AE0 push edx; mov dword ptr [esp], ebx	4_2_002E1DCF

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\422648\Ai.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	File created: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Jump to dropped file
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	File created: C:\Users\user\AppData\Local\Temp\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	File created: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	File created: C:\Users\user\AppData\Local\Temp\Motion	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

File created: C:\Users\user\AppData\Local\Temp\Motion

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002468C0 IsIconic,IsWindowVisible,IsZoomed,GetCursorPos,WindowFromPoint,GetClientRect,ClientToScreen,ClientToScreen,ClientToScreen,PtInRect,		4_2_002468C0
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_002468C0 IsIconic,IsWindowVisible,IsZoomed,GetCursorPos,WindowFromPoint,GetClientRect,ClientToScreen,ClientToScreen,ClientToScreen,PtInRect,		4_2_002468C0

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

4_2_00247720

Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 8108, type: MEMORYSTR

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe

Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0023AF7B		4_2_0023AF7B
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_0023720D		4_2_0023720D

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	API/Special instruction interceptor: Address: 7FF8418CD044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FF8418CD044

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EVERYWHERE.EXEFIDDLER.EXEIDA.EXEIDA64.EXEIMMU
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGMON.EXE
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXEAUTORUNSC.EXERESOURCEHACKER.EXEFILEMON.EXEREGMON.EXEWINDANR.EXET
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MP.EXEX64DBG.EXEX32DBG.EXEOLLYDBG.EXEPROCESSHA
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TORUNS.EXEDUMPCAP.EXEDE4
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDANR.EXE
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Memory allocated: B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Memory allocated: 2460000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

API coverage: 2.7 %

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_0023720D

4_2_0023720D

Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe TID: 8052

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_004062D5 FindFirstFileW,FindClose,	3_2_004062D5
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_00402E18 FindFirstFileW,	3_2_00402E18
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Code function: 3_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001ED280 VirtualQuery,GetModuleFileNameW,wcsrchr,wcscpy,FindFirstFileW,wcscpy,LoadLibraryW,GetProcAddress,wcsrchr,_wcslwr,strcpy,FindNextFileW,	4_2_001ED280

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_001EEB60 GetSystemInfo,

4_2_001EEB60

Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\422648\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\422648	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: PQwHxAiBGt.exe, 00000000.00000003.1467116576.0000000002D91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jJIvmCI7<
Source: setup.tmp, 00000004.00000003.1348573605.0000000001566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\>
Source: setup.tmp, 00000004.00000003.1348573605.0000000001566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: PQwHxAiBGt.exe, 00000000.00000002.1469785835.00000000012F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllP
Source: setup.tmp, 00000004.00000003.1348573605.0000000001566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`
Source: svchost.exe, 00000012.00000003.1705181582.0000000005420000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: setup.tmp, 00000004.00000003.1348573605.0000000001566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: RegAsm.exe, 00000011.00000002.1703186711.0000000000AE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMCIDevSymbol
Source: setup.tmp, 00000004.00000003.1348573605.0000000001566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\-6
Source: svchost.exe, 00000012.00000003.1705181582.0000000005420000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: setup.tmp, 00000004.00000003.1348573605.0000000001566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}j
Source: setup.tmp, 00000004.00000002.1464638517.0000000001566000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

Code function: 3_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

3_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Code function: 17_2_04CF1277 mov eax, dword ptr fs:[00000030h]		17_2_04CF1277
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_3_00860283 mov eax, dword ptr fs:[00000030h]		18_3_00860283

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001C11B3 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,_cexit,exit,		4_2_001C11B3
Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	Code function: 4_2_001C1170 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_initterm,GetStartupInfoA,_initterm,		4_2_001C1170

Source: C:\Users\user\Desktop\PQwHxAiBGt.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 17.2.RegAsm.exe.2a9626c.2.raw.unpack, Flutter.cs	Reference to suspicious API methods: VirtualAlloc(IntPtr.Zero, new IntPtr(65536), MEM_COMMIT, 4u)
Source: 17.2.RegAsm.exe.2a9626c.2.raw.unpack, Flutter.cs	Reference to suspicious API methods: Marshal.WriteIntPtr(new IntPtr(intPtr.ToInt64() + num), GetProcAddress(moduleHandle, array[i]))
Source: 17.2.RegAsm.exe.2a9626c.2.raw.unpack, Flutter.cs	Reference to suspicious API methods: VirtualProtect(intPtr, 65536u, 64u, out var _)

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com

Memory written: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe base: 700000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Memory written: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe base: 700000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Memory written: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe base: 429000			Jump to behavior

Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Process created: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe "C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Me Me.cmd & Me.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 422648	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Total + ..\Jones + ..\Handed + ..\Norwegian + ..\Beef + ..\Cu + ..\Biology + ..\Busy + ..\Bahamas + ..\Invoice + ..\Practices + ..\Atm + ..\Particularly + ..\Ongoing + ..\Lane + ..\False + ..\Huge B	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\422648\Ai.com Ai.com B	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Process created: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\Ai.com	Process created: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"	Jump to behavior

Source: RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028A2000.00000004.00000020.00020000.00000000.sdmp, Ai.com, 0000000D.00000000.1389897007.00000000006B3000.00000002.00000001.01000000.0000000F.sdmp, Motion.3.dr, Ai.com.5.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Code function: 4_2_00210FA3 cpuid

4_2_00210FA3

Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\setup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\Desktop\BJZFPPWAPT.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\Desktop\BNAGMGSPLO.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\Desktop\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\Desktop\DUUDTUBZFW.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\Desktop\Excel.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\Desktop\PWCCAWLGRE.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\Desktop\SUAVTZKNFL.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PQwHxAiBGt.exe	Queries volume information: C:\Users\user\Desktop\SUAVTZKNFL.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PQwHxAiBGt.exe

Code function: 0_2_005FCD05 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_005FCD05

Source: C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

Code function: 3_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

3_2_00406805

Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OllyDbg.exe
Source: svchost.exe, 00000012.00000002.1713732166.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: regmon.exe

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000012.00000003.1702400594.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1707925431.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1713875821.0000000002EC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000012.00000003.1702400594.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1707925431.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1713875821.0000000002EC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	51 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	51 Input Capture	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	212 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	146 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	121 Masquerading	LSA Secrets	531 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PQwHxAiBGt.exe	53%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\422648\Ai.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Motion	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe	71%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\setup.exe	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://154.216.17.46:3673/d3b272a7b40f3260049/pfcws03c.cmivsx	0%	Avira URL Cloud	safe
https://154.216.17.46:3673/d3b272a7b40f3260049/pfcws03c.cmivs	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bitbucket.org	185.166.143.50	true	false	high
ipapi.co	104.26.8.44	true	false	high
edMKDlxnNIzWufljfi.edMKDlxnNIzWufljfi	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://154.216.17.46:3673/d3b272a7b40f3260049/pfcws03c.cmivs	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://154.216.17.46:3673/d3b272a7b40f3260049/pfcws03c.cmivsx	svchost.exe, 00000012.00000002.1713419509.000000000083C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gcc.gnu.org/bugs/):	setup.tmp.2.dr	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	PQwHxAiBGt.exe, setup.exe.0.dr	false		high
http://www.autoitscript.com/autoit3/X	RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Ai.com, 0000000D.00000000.1389988787.00000000006C5000.00000002.00000001.01000000.0000000F.sdmp, Motion.3.dr, Ai.com.5.dr	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=&parse_mode=Markdown	PQwHxAiBGt.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	RobertsonDeclined.exe, 00000003.00000000.1325882952.0000000000408000.00000002.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmp, PQwHxAiBGt.exe, RobertsonDeclined.exe.0.dr	false		high
https://www.autoitscript.com/autoit3/	RobertsonDeclined.exe, 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmp, RobertsonDeclined.exe, 00000003.00000003.1329900146.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, Motion.3.dr, Ai.com.5.dr	false		high
https://ipapi.co/json/country_codecountry_name	PQwHxAiBGt.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.8.44	ipapi.co	United States		13335	CLOUDFLARENETUS	false
185.166.143.50	bitbucket.org	Germany		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571370
Start date and time:	2024-12-09 10:33:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PQwHxAiBGt.exe renamed because original name is a hash value
Original Sample Name:	61151df093ebef01768789ead98ed2ed73ef951162414101b25a9db8129491a3.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@33/28@3/2
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target svchost.exe, PID 8060 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: PQwHxAiBGt.exe

Simulations

Behavior and APIs

Time	Type	Description
04:34:16	API Interceptor	1x Sleep call for process: RobertsonDeclined.exe modified
04:34:21	API Interceptor	1x Sleep call for process: Ai.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.8.44	https://buiseenet-fbsp247.getresponsewebsite.com/	Get hash	malicious	Unknown	Browse
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse
	https://3r9e6kkr.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.google.ca%2Furl%3Fq=30NUMBER%26rct=77772474802481024856%26sa=t%26url=amp%2Fs%2Festudioit.cl%2Fstarl%2F%2523Y2FybGEuYWxkZW1pcjFAbWxjaW5zdXJhbmNlLmNvbS5hdQ==/1/0100019346ba248e-096005ca-8ea9-493d-b2f5-e0c34fd69fc0-000000/JH6rhkavYmTGSs9Zspd-vAN7bi8=401	Get hash	malicious	Unknown	Browse
	http://wwwfucai13.cc	Get hash	malicious	Unknown	Browse
	https://app.scalenut.com/creator/991c897c-dcc2-43e6-ba55-339c0f6812c2/kj8jd9r9do	Get hash	malicious	Unknown	Browse
	https://www.google.ca/url?q=30NUMBER&rct=77151727248916238810&sa=t&url=amp/s/estudioit.cl/starl/%23YW5nZWxhLmhvZGdzb25AMnNmZy5jb20=	Get hash	malicious	Unknown	Browse
	bPRQRIfbbq.exe	Get hash	malicious	Unknown	Browse
	AD6dpKQm7n.exe	Get hash	malicious	Unknown	Browse
	NfFibKKmiz.exe	Get hash	malicious	Unknown	Browse
	63w24wNW0d.exe	Get hash	malicious	Unknown	Browse
185.166.143.50	jW3NEKvxH1.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	yG53aU3gGm.exe	Get hash	malicious	Unknown	Browse
	yG53aU3gGm.exe	Get hash	malicious	Unknown	Browse
	lnvoice-1620804301.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse
	ft.exe	Get hash	malicious	LummaC Stealer	Browse
	invoice-1664809283.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse
	https://getgreenshot.org	Get hash	malicious	Unknown	Browse
	qqig1mHX8U.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse
	3o2WdGwcLF.vbs	Get hash	malicious	Unknown	Browse
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipapi.co	https://www.google.ca/url?q=1120091333775300779273902563687390256368&rct=11200913337753007792&sa=t&url=amp/s/elanpro.net/horeca/dispenc#YnJ1bml0YS5kdW5jYW5AcGFydG5lcnNtZ3UuY29t	Get hash	malicious	HTMLPhisher	Browse	104.26.9.44
	https://buiseenet-fbsp247.getresponsewebsite.com/	Get hash	malicious	Unknown	Browse	104.26.8.44
	Employee_Bonus_Notlce.pdf	Get hash	malicious	Unknown	Browse	172.67.69.226
	https://application-workspace.com/red-bull/id-38772	Get hash	malicious	Unknown	Browse	104.26.9.44
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse	104.26.8.44
	https://application-submit.com/form/redbull	Get hash	malicious	Unknown	Browse	104.26.9.44
	https://avidgroup.famislnc.com/fvcvfxfec/cc6d843dfd/?1f9da=amtsZW1wQGNhcmlzbHMuY29t	Get hash	malicious	Unknown	Browse	172.67.69.226
	https://www.google.co.ls/amp/s/2mzptv.s3.us-east-1.amazonaws.com/qr.html	Get hash	malicious	Unknown	Browse	172.67.69.226
	https://3r9e6kkr.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.google.ca%2Furl%3Fq=30NUMBER%26rct=77772474802481024856%26sa=t%26url=amp%2Fs%2Festudioit.cl%2Fstarl%2F%2523Y2FybGEuYWxkZW1pcjFAbWxjaW5zdXJhbmNlLmNvbS5hdQ==/1/0100019346ba248e-096005ca-8ea9-493d-b2f5-e0c34fd69fc0-000000/JH6rhkavYmTGSs9Zspd-vAN7bi8=401	Get hash	malicious	Unknown	Browse	104.26.8.44
	BOA-everbridge.com-$29,890.html	Get hash	malicious	Unknown	Browse	104.21.94.136
bitbucket.org	YWFMFVCSun.bat	Get hash	malicious	AsyncRAT, DcRat	Browse	185.166.143.48
	jW3NEKvxH1.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.166.143.50
	yG53aU3gGm.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	yG53aU3gGm.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	lnvoice-1620804301.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.48
	lnvoice-1620804301.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.50
	ft.exe	Get hash	malicious	LummaC Stealer	Browse	185.166.143.50
	https://bitbucket.org/ziphose/obmen/downloads/Doc.7z	Get hash	malicious	RMSRemoteAdmin	Browse	185.166.143.49
	invoice-6483728493.pdf .js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.49
	invoice-1664809283.pdf (1).js	Get hash	malicious	RHADAMANTHYS	Browse	185.166.143.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	1mr7lpFIVI.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	http://www.sbh.co.uk/	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	104.21.58.83
	http://www.pixelpromo.ru/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://oR.smelsgycz.ru/OP4lIHE/#Dinfo@test.uk.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	DRAFT COPY BL, CI & PL.exe	Get hash	malicious	FormBook	Browse	172.67.220.36
	Play.VN-_E_CQDM.html	Get hash	malicious	Unknown	Browse	172.67.192.56
	jKDBppzWTb.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	MN1qo2qaJmEvXDP.exe	Get hash	malicious	FormBook	Browse	104.21.38.113
	enyi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
AMAZON-02US	Payment Advice - Advice RefA2dGOv46MCnu -USD Priority payment.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	MN1qo2qaJmEvXDP.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	RFQ _ Virtue 054451000085.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	cllmxIZWcQ.lnk	Get hash	malicious	Unknown	Browse	3.5.167.250
	qhjKN40R2Q.lnk	Get hash	malicious	Unknown	Browse	52.95.134.150
	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	jew.arm5.elf	Get hash	malicious	Mirai	Browse	54.171.230.55

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\422648\Ai.com	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	6duXSAApsY.exe	Get hash	malicious	Unknown	Browse
	6duXSAApsY.exe	Get hash	malicious	Unknown	Browse
	mod01_pdf.lnk	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	SmokeLoader	Browse
	mQC9xlWFZV.exe	Get hash	malicious	PureLog Stealer	Browse
	mQC9xlWFZV.exe	Get hash	malicious	PureLog Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\422648\Ai.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SeT_up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: 6duXSAApsY.exe, Detection: malicious, Browse Filename: 6duXSAApsY.exe, Detection: malicious, Browse Filename: mod01_pdf.lnk, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: mQC9xlWFZV.exe, Detection: malicious, Browse Filename: mQC9xlWFZV.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\422648\B

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	1256112
Entropy (8bit):	7.999866880745113
Encrypted:	true
SSDEEP:	24576:L+ZKjU9SM7/TEQPeSHBXGXHe2Rv1pn4BV3dcmGoJMvNBJzinlvZRqMZr1w:64js74F4XG33Lpn4BVNcmGgMvzJzilxo
MD5:	6E8B07409FF18B0CB1B0E38184765FA6
SHA1:	12D3C676AFAA0ABDE5E5510F3A6FE553B83F7830
SHA-256:	7073F5D927CEE5753FFBB48022CF8C133DAAB9F29E07915AB9E85D472C691E66
SHA-512:	19ADD7C2574441331360EBE613097C0CF01B1A5869E8AC9F8E9B2C7B6C0F6BC973BDDA0D7F899A7130499B8D75E9547C22B4956B80109DB636527F5B3749EAC5
Malicious:	true
Preview:	.).5v..bz.U....:..!..#`.-`...s..OO.!.niw0...o.N]..%e.?....H....i.M..m....r.\|..n1R.....5Y.fS/."........[..%=.:&z..g6\A..=....6z...u...AzO..w.....PT..L.#...c.Td@-^V.....&..K..j.l...%..\|.R.O..h...It.s..`i.0?q.;WC..9~.dk..]...GS...S.........<_H....[..o..........\|.`n....^...y....`.N..m..^?..&......f.B...B_G .o.._...\yr}...48...I...w....+..=........o($.Ihv....OU..../%.MN..a8~....`:...LD.6....K.......!.@..0.[...X.{..P........r.e..G.V&..E.KM......O.?..(:..N1uB.x.V.....r.s.....K...\.G....\h....,...l...%...Ar..%\|.:.......N....?.....FR..<....=...E...V.:.6.....11....T.6.b.+.:..c.j...SF...D.(Q..j..2<.$...o9...{HW@o....`R....y.3...-b...q....HYC..R..T...;.....K`......t..&.85.3g..H..P'.~...LL.eq..3.1.6..).i.....k..T....C~s.f...:.4..V...'s....$..HF...\|.:..e(......Y..F...BEJ.\|O..X.....q...R.e`......8.....:d..<.(<..f3N." ..I.L.K....MV.&.}....<.(..7..)..d.7..W.D1..2.c2@D.$...$.5#<ZtG.[.5...-.%.Sk.:A..N...b........6$.qSP...!5.=b....}..V;....1.5.. si..i.8/..Y... !R..

C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\422648\Ai.com
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65440
Entropy (8bit):	6.049806962480652
Encrypted:	false
SSDEEP:	768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5:	0D5DF43AF2916F47D00C1573797C1A13
SHA1:	230AB5559E806574D26B4C20847C368ED55483B0
SHA-256:	C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
SHA-512:	F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Users\user\AppData\Local\Temp\7576.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.8073549220576046
Encrypted:	false
SSDEEP:	3:aN7cn:aNY
MD5:	480FBABCD4B0BD39E9BA1730DB952A16
SHA1:	92977CA114F7E1D754983E9BE1525B89D0618AE9
SHA-256:	4BD687B386ABC2DE0CE99EB0B0A31C1124CCCD34468F53F9283D374958A54F1A
SHA-512:	C20FAF3823F290A65511E059481EC8BFC8722E3DBB68361B1CDD5256BA95DDA0BA9525551647F55394ACC64423B3557ABE1A326124CDF9209F76399B6A5B4C6D
Malicious:	false
Preview:	; Empty

C:\Users\user\AppData\Local\Temp\Atm

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.997340170550634
Encrypted:	true
SSDEEP:	1536:3li+eG35jdpQfcn9hOnBTtNWf2tEsc7dvbzcZyGD8aY0:5e6QfcnHmBBNWf2ttEfURgn0
MD5:	71E46F1884C14150D1EA7C967DC18066
SHA1:	5E1B83A4C2B04BF709471F77954641E39B3ED8DA
SHA-256:	EF7D2B9FC43DA0F93650C7C059358268B9559B2088A9F13C44D85909B1139D98
SHA-512:	0B3C318A8296DAA87EE78EAB8F3EA57C32543B03C50D903C876918D777FF069AFED1DACC92B2798795463D53F092B94BF81A3979C6E0547DF6B699B7DC541636
Malicious:	true
Preview:	.!.R.f....%...{.a.(..O.&P.R.x..y...Q...&;X...~.uk...%.&..,;......i.{aC.......s.R.u....8?.s./(..6....M[..W...D.C%r.z.<.2.n....#@.....w..z.q\[{.`..?...i..Qq...q.I...].x..A...@D.<..$..h.><..iw.?..={@P.b_.H...\|.z..6Pu.....&..SxE..I..'........}i..&..9P.;A..i..mUH^.R..h".of_..!..\|....Yaf.Zr.BQ.,...J.X1....>.u............@.@..{.:..............V.n....$l...d....m....L.)..v].ik_ZV.d].9.x.&.s..ET..F...;n:..bx.,.a<...5.....$.B.... .g.....\|.[.......<.m.Z..y-SE.....\.......X.1...T..P...^...!.....g.2H...u..U.../.P.g...Y..9....~..r.'..V.....qnG.........}.j..>..xG.w...je.<.u....HR..1....+MZ3.7s..Nu...;..\|@Y2[z..n...P.(qR.Srz.Li...]..q.H..@j-..h....Dv.T/.`..(..A...5h.-...(52TW}..4/.t.xK....r....I&z..l.......j......<....{.)....R........B8....}...Y..9.9j..T....y. .b.., ..`.C.{..};....$.]..*.?.g..)N./..`;7.$f.U.(.......K.....6.....0@....Z...t1.3...b...v.I..c..5.3.?...:v6f.c.1...........Z.'..b...vB ..B...'.&..7..m.1.}..~......FB....>J..T..>1..b.-2.k...4!.."....

C:\Users\user\AppData\Local\Temp\Bahamas

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	7.997482356427176
Encrypted:	true
SSDEEP:	1536:p8eDfL5ppEpLIT2uL8kdF1vDLKDwxCdnuoCZHrfnVVHIWBFEPC68+dFBY1:Oe3pEpLICm8y1rLKskC1rfVZISDw1Y1
MD5:	9809A18917BA24EE92FE727A06676B34
SHA1:	AED4386177ACDFDBB9AFA569627565F0254CEB16
SHA-256:	FF4EED0E6BFC902CA6F90D6695B07CAD02E74F185330DA7A130839621F373B37
SHA-512:	CB06482A68BAAEA02FA7BAD87906B7DF4394182A111A1E6EBDB663EDBDFCCD1F8B24CD14E05DD40FE14966EBF31387603AEC1C75BFA22E66D6CB8130699C4704
Malicious:	true
Preview:	dE.....$\..N.W...J..<./....0....0.<Tc.....g..q[NkB..Z.]..c.E.$..@......Ij.f..c..V...l.0....#..tMN.+P..q.H-_.~.m.l}[./S.....}......(..p.}..`xl4..=Yez....=~.k.%.)1.....YE..V..H...5..e....W.5.^.zy...@.V.K...0.d..P...3..KC.].....4...}6:......%$.,.....4..mr..G..}........7.x............S.....Weg00M..=...i.....(.S...8.E.:/(.1%...l.....(..U..y:...'U....\|..u..e.W.V~.w..FW4..../.?...<+]h....d.u/{G..!/S.8....."'Y..^=..r.j8..Mg.........I.-.)...4.......W..p7...a...rkT..Rm:..Vg.7.D.Y.......GY.\|...].Q.L.w.M.9N.bM......&.r.9kx...$..U......j..vz$.B<mt.3..N...\|....?.3.....d1\.y..2...[....q.x.>..!v.S..jx!.............tu.BN7.I.(..o....3j~..L...V.{.:_...t#.........k..J.'...uG...R..'.0.c...k.....j...;P.~a.....IK.[&.....[y]Y.....x}...3.if9..o..a.`......J..\|Mm}....q.+.............".+K..MI..Uf.x...#on....F..%j!>..0PR..?...Q..a.;N1u.Q.a.X....,........!.....8.v...p+%+..2XR.k.5....{.....N..b..%...$q..T.E....\W.^.<.*P.i...)...12r.!....$b.,..y.%{.......[#....Jd..}

C:\Users\user\AppData\Local\Temp\Beef

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.997020308434422
Encrypted:	true
SSDEEP:	1536:x8he7KWJARYbkcUsIQ0GhRPkeyO/oy0BXlf7s69AqoS+:x8hehJ/vWcR8x2R05lFAqoS+
MD5:	FCE6C8685C46C53D577525264EF2E6B7
SHA1:	6C956238AAB3CF294F6924608634E6C01F9D81D3
SHA-256:	E6A46CC210C6B1FC18C4F946F788C72352DAA89ECD52609B2237403E582F3D0F
SHA-512:	4F271B303FAA19BBA5E83E01486E6C439BC425DD8103B93537CE443F94EAE6A7BBB85107B1D034ED6C9845D3FEB09AF9389046EFAF78A37AAEF19E14AD0FF90B
Malicious:	true
Preview:	yY/O..!J.5..`.9\....g0$-,...........O..L...G..8w..D._..`.\.x.eF......j...M7s.....`"..xm.O.....!.......e.$.B..X..IF....<._6.T.8.W...\.t..{U.}.D.w........y.C..I5:...o..."+.S..q......i.IZ..U.....4....Q.b+..M.e.no..q...h..C.....<..,... Z...v.X.&..S^.f.ig}.EA.>..........Q.V..m......h.4...+.aJE.....:(....t.?R...<........x?f..o.......7..Y.:..~..y\|.m..a.....1.:._.p.q..#.Pl../...x`C.Ev<~.....9.Q....'b{0.Z3Bj.]..%%..._1{..9......@....k._$\|.....H.m.Gv[.8G.:..........X0.yM.yjP...w.G .V3z".#.3.r.....X.`..7y3.H/...vJ..6.I\..m.O.........c......q...PVg...k]$.v.(..s,\|..w.8.t7.uV.1b.].........V..3..([..Pw........N.S3...7.....U<...p.6v.......+.tM.2`.D2.)LQ..p...8...{.=h..7JD..2.b.........m.k..]..2e.`....Z....6.....]+`i..~.\6Y...J#.5P6.....].r.b^R.O.Eo...4....YH.w.....Ed6..)g.-........C.'..2..G.e...)^...a...F[..@...\|kQB...t...9.y....#.[....@.......i...D.F.......h..'"..e..../.kQ.(..H.}_.R...j....\.'o.d.q......wO..>m.D.........Q..e.....3...............

C:\Users\user\AppData\Local\Temp\Biology

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.998047953707022
Encrypted:	true
SSDEEP:	1536:7tQt3ofhRHEeoLScRGX0Uvu8I3DQmzYks15PUVqgbwCH/kBJwKeiC+S2/s:GKfXH1oLScG0DJ3DQmMksrPQO0/kbg+4
MD5:	BB84892D12C4454B33438D9C6E72D232
SHA1:	F23AAEABF65EFF2CEC9078536C4994F83D23CA47
SHA-256:	44190D0F113FB40CD22C7BDE6F7CFEB61274513FDA3B2B6F26820A14E0706D21
SHA-512:	763A2425249377E4919CB8868C41B0AF2BFBF9F9E8CE854704E42F5A152387CF66B64D279DB0A9C3F6FF82295EB5C7912397F6B7F501482E57CD73C52CFA23F2
Malicious:	true
Preview:	.&'"Q"D.c..p.%J.+...R.7.<...5.....pN.....u??....(6/_M2.'..e....+>...V..w`...dK.......?...*v<.c3n\|R...y.Y....+R..$....=...:j. zb....Mf:..20.;..w..'s.+.P..sx........:.._..=..b.d.3...F.3..vq.k.I.."......_....3......Xm..Jt"....J....l."...;9.r..X.W...Q.<.pY.9/.Q..\\....3..Q........ .H.^.P...."....w."w.`....q;..._..4.z7...........1.h..uf[.....B......\|........x..-.=...&.w.d..0.sZ.c..8..+bXlI.w.9...Y.r..U.>..xUSp4n.....P.R.....:....#....u.....&i.F.._..3A...U....W../.l!..}....7.9e..i.J....5PB.e..H...{:..)....=. ..:..^..W...QE.#k.QI.x....I.L...7.x.n.u.-.....'.Z..g..k.`VDb.@..>.....&.n...fe..K.n8. :...X!T4s.......B-..E(.E.p.a.R...?..S!iR.1.j.X..U..K..^.~...i.M..S...^h.~.T..[..}f.mj.........M.R.......$+4.z7.......[IYd..sP.......U.mB:.?..T.)....J....O.....D..........Q.r.....<d..@..i.'+$.R...n..ZB...[.......\|./.f.N.7..U"..[.G...2S..!....+/V]G.1..F....E8........h.....0...M.`.<&...S.k.K....w..'P.....l[.6B.+..k1....W.n.>.5.[.?z...\.y.X..../

C:\Users\user\AppData\Local\Temp\Busy

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.997725069941207
Encrypted:	true
SSDEEP:	1536:76nMjVhZ1wpZjh3alow11/RCnzL2ILp+rLuTkIBBQxHiNB0VF:unMRb6ZjqD1xSzSILU+geBSHiY
MD5:	31388E6762254555030F6581ADC744D0
SHA1:	D3D119E6FB5715338425B3A2D9CCA54ED1F55829
SHA-256:	83D3DC305650F2CCC5733DD71B1B360F521DFA2C63B66703116BC5634AFEE463
SHA-512:	B1A21C817E58E3E50FC68F5DDF04678541E28E7A6137280C1D8B4926B388496132825C53A6FF842124CE4A6BEC48E72F5540CF79740C6449639EB3F9084FDB05
Malicious:	true
Preview:	.N.<.o.q.....+...R.Ma.!.o%S.g..3....@.5.'..T...3U.m#....'...1^..ZR...+Up......S.S..(%ET...t...Xgn..Xr..6.V:.4..?C.I...\|`2w.xp......),(W..8...4.n.dF....e.>c..\..7....(4v..Nq...^#jf...fe.)...Vs6D..7.+.........G.p.C..i.....t..[f.I...Z..H..K..b.o.s..+./..aw..M.V.Q......n)..^.8.:.....l...)?..S.~9.qO....~.}..~ar.L0.N.h.s........x6S.y.\|F6!...!....s....B&)..\...W..:....Y#..Ix.dR..m.P.........[~x....Q...6..j....t....mD.).V...dJBFu.K/.d.O).3Ad{..D.....=u..1sC.AX.2..aA...p]....S........<41. .v.....YL!6........V3"o.".1.O.+.]...[ui.$........2..juo.A%...o.....D....tg....8..-h[.(.fG7].?.....l..N..r.}...Y.dZl..0..c..tD.v....F...@R.'A.=..i...n...g:..-..m!....b!.}......+......2$.....}...%.k......l.Bw...../..P......M....7.......b..0>.Y..pX../..Ql.G.~.,.&..Qi..6v.=...(....Iy..J/iz.>.q..Y.....T..U.X:.).qC..6./....~<?n......j[@.._:`..E"'...._....]N?..asT.X..N.r..^-.~J}..\.b.?.l1....N.......f2g.d.. ...$2]..6@.(..C.5J;....9..$.cV...1r.k....Qj...y.........>=.

C:\Users\user\AppData\Local\Temp\Cu

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	7.998091359440897
Encrypted:	true
SSDEEP:	1536:mTRwSehVOH+zKiuJDxQZHlnt3ZbyeG9cBNcVT3l0voeUvqVYmjMa:m1QfOee7QZHDZGpwo7l2oJvDmjMa
MD5:	97B20FC351EE73AF5412D2CCC98C5B6E
SHA1:	CA13078B5891903759549595406BEE0AA6616CAC
SHA-256:	C506F0541A4089D7E698269D819857EE788AC92E6FAC28ED25D207B642B81A0C
SHA-512:	6AA4265A17881BDCBB384C35E82A097B457D0FD45B3544CB021CB3786B09DE7B8FBBC85AC33D5261AA6A1CD3BFB8E2C58C4BEEC8A400BA4F138E558A3A59504D
Malicious:	true
Preview:	a...c.....i......QD..y_v.pO..7t....Z-pt.T...u...sd..K5....B.s..L.H..C..c...3'..JF5...T.a........\|........2.r#....G.P........RZ.G...U....a..4]Bia...]..P...9...../..c..U...t.6n...?.%g...<.LA.S...E.csk..3...F]r.....Ycq.M.@&O:...H..Z....MT,i............b.VQ..../.....S..I..y(C...&e...H..l......._..B9 .G5y.D....u.%.O..R.P.2..\|...s......c{..T........pG...-..Q2u_...9..O..U:rS.F~\|..y.....m....J......;=.H?.!.;...1Aw...f#~....w.6../+<4......u(..xz.^..O.h.[.....w..h.U)..;..M.F"K..r.....?..#&.@...(N@..d.d...x./K7.Q.B...}.j}..*.8.....9.......LE.X......B.K..K`..w?[}.(..K.9.........%..<1..,I8'Y).e....j.,.pw.......iK..v..C...-.]Er$...nL.=0...^.r.....>.6.....-I....>....B.......=..O..e...PvS.s..RK'.H+.O%..AX...=.P\|.!.=w..H...7...B<.P.%..t...CkJ..w......7O@eh.{W.M.4"h.....M.....A....!E.G./.Av.d..C.p.}...q\|....4.M.`.....Z.H..qPIw....e........D...@....Q.......).g.+.. ..]I].z/......{...J5S...O.~.>..-...}^.+e....'...8b.c.3......J.E.c....4.4}9P6.%....I..1.t.[m..0..

C:\Users\user\AppData\Local\Temp\False

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.998232836008428
Encrypted:	true
SSDEEP:	1536:8aAcKJGGOuKrovwGTudGZrBfVzZyOA18eJnIzQBcOU9cHMp2H38jyMuL:8aA3JLkrQudGZ3ZkZIUBUCHMp2X8jyV
MD5:	EDB65C718E78F719CE2FCB4E0F690EFB
SHA1:	16F32E827BDC9473A71569CDE188DD308490D8C8
SHA-256:	5C198C20AFDE1871D500ACE7032A2B028C63DED8B7331F9AA6AD8EEA17CF3B5C
SHA-512:	0B9351F1A0B35367A7CEB270784B0654C98FF15C85C31380ADCECB504848152EB75699FE4B1CE6F12FA8A2496B5453BE4476DD161E05A332D4B5A82B25CC71D3
Malicious:	true
Preview:	..:Nki..m......\..n.._...#5E......`W./...y...&....56~..O..l..~K/Ff.t.....o<.#5.I>U[P. _..k6....+...#.7=.....olrdl.~8.6 ......]k.)3!...S..%.(..IU...Z..Q....".B......3...B:....f.\5.uMU.U.&9....f..mq....^T %~G......t@.....;a........[.}K.f.....v.v...........,.B.}./.n-..".?\O3.._Z..r".!.Q..e!... ....G:2...\Vc...~ CfO... F.F....I..."..A..y......J+..X[..O.b..S..p....ez..[...Z{:....=.....[.6$..mYx...A.G..F........V../.P.].\O.g./...x...@~..&._...mwp..:\|.K..<.Fb.I.I..#....`...!....GGo5f..!....?t.2../...(...F. .....H..q.Q.H".GH.>...:...j.l/.....}I....._........B..>2...fm.R.`jG.Dn..Fk.mWL.....~.G .q..F,H....a..UQ..F...A.D...xa7v.c..q..M-I.3..k/...!.^.K.L<..+R.)?....`....&....y3....G.....Y+tU.@.T...4...~Tq..6..h..9.....B..G..M.wD..q.V........!.+"gL.n.....=.~.f{N.z....[...\|.............3.%.+.)...Cb.?...47%.X..I...Z.._.<.....!.6.k).>.Pk.).".7n.~.......ni:%....IA{/.6..M..K...[.5t#.^%.i.A;A.LY..RYnW#.1l.....?..............si...A..5..O?...,Q#..{.n...N..(.

C:\Users\user\AppData\Local\Temp\Handed

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	7.996765273361241
Encrypted:	true
SSDEEP:	1536:KGBxHK69Tyd1boZ1Bt57pW6i/upRk3uaI/t:KaxHK6MkbBeuRl
MD5:	A67945C9242D09BBE114AAF14A9A6D64
SHA1:	AB0689E9B2BE88BDF5F09ABFC7D1898142504D31
SHA-256:	054CD0E93F857CC3733202A7979D704F900FD5139086C553BD0237568A6BD9F7
SHA-512:	412443780F91C2C2BC2B08E422F80DF041A86EA2ABFD641296229CE447B40CDB058F706C0CC30B424502C311D7FE958DB0834CB65B2814B4D3AC727A81E5BFA0
Malicious:	true
Preview:	K.+.....qi..U.....H..cO!o5U..O`.....E.6.K...+...H.Cb5^.&.....B.?.T.b.#.u. B=.%..c.....c$..g.U&S'...;$......?:.E..Ym..7.....,6..g..L\..^.f?7..}..%L.......F^...0...{b...)..m9...^..v<C..A.r..k.\q....,AQ.+......8.x...a..SZ.Y..9...((.9....O62....$.;~j$y..G..Z,k..z.g..H..].}.Q.y...vvU..}..$..k.k...U..e.b.B...!.amg...41J..x00....K..8k.u.".<p.-4f...S..9._k............i..`._.....8..3....z...p.........[SI....fZ(M.E59.....].U.$=...Px\|R.z.Q.H..<.ad_'w.T...[...M..R.V................p...v..%...I.P....}hXy........m.z[....E.+.#.'....].{#p.O........l.c..O.V`7TRLR......Z..~.[...9.......eT]{......2z.t....3...u.=..d[..........&..Wh.>...<h.MFy..X$I.z..o~XUq..,$...H~... c`H.-..XD..^.....(w.4mFP~....7...Q.....fo...Md.N..n..8.Yt..']..n..[....p.g..y.E}'..:..gtm..j...H.s..1s.......0.]..VOh....+2..0......#UgBT......9.T...kj......r........c$...:[g.BP.........=.&V......2.%5/b..(.....H%..j. ...j.l...>.8...........g...I.]....... [..\.N..L5p...X(q....7....

C:\Users\user\AppData\Local\Temp\Huge

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	30384
Entropy (8bit):	7.993779441518898
Encrypted:	true
SSDEEP:	768:tKplLpllliw0VeXkn52+1fRlXKxcbB3VyTIr/u1Mi4Nk4:tKTpJgnPf6xct0KuGXR
MD5:	281765F4F2B2961F2D51BDAF401AE04B
SHA1:	ABA89180D291B370EB5E93099D8AE3AB92103E42
SHA-256:	A25174713BE450A1E0BBC908CF8BE5DF1EDDB2BCAA5E7C6B039FA85CB2CCED8C
SHA-512:	EE0D2D7BCB1E0B9642986CE324601D22958927657A3A81F5F0D9C21FE5E8015C6DB7A2B17787BE2F1DE161E9B78135AA5D5209D2E3D9F4C5A76A7480A6A30CFE
Malicious:	true
Preview:	..D.G.......1.....oHW.6~.....T^...`...v../.....#.....p.....e.UP.....?....t....=.3..4...e.....+L?m.....,..+.Q..R..!...V...q...vG....a...U/.....!.......wr....}..JXf.j..p(.U.`..yQ..H...uR;.....(%...S...m......S[.......:?x:...S...zw.$....H...! .3.....FF....x.........~...G;i.......~..x..X~..\.#...P..#.G.6..G&..p^....O....o.~...'n;q.V...{u..../.'.mo....$.F`....n.....5....-I....X.6...%...........Pw..-+..,...6....3O._.ujI.M.#.5OB+2..+..c..T....D...5.jV...:.....>....O...._.7.>....h.\..D..<.p(...n.Hn..!.R..S....\|@l.O@~/...r.R.H.H...kl..XAv.+.L`# ....../..(z..!.8.'..z..,........J..tm2..A..NB....G.X^,z.T..^~b#w...$...I.........W.F...0...Oa. t..$......b o..\.."s.h...%."5.tN...M.?..<.....vH..h.^c....'......0_..#...._Zz.;.5SK...0N.l..I.c..=....o...N.....R.........9..rn75.s....%......M...n..9.r..PK...J.xi!H.3%.14=./....o..'...x0.sVl....I:=....4.2.....J..6.$..V5.P..d.....#...jW.A.~.s...\|..lh....S.g./.8!~b.!..RP.!.....q.%N.......h,L...

C:\Users\user\AppData\Local\Temp\Invoice

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	7.997428094801003
Encrypted:	true
SSDEEP:	1536:ngaMBPCNLH2D+a5jw66Zf/FD/Eq2HwwZKFbtis5LZQIK954prpxhf6wq:nAGH2If97x2zUrLSS5pxq
MD5:	EE5B0EA84393A623E11B932BCB0F5952
SHA1:	2CDBEDBF550A5F2B0B00DD1F82772E101550EA12
SHA-256:	93481448E25DDD32556336E670C1C08BB93ADDDE3AC9BA95754F0C40ADF251EE
SHA-512:	924C7EE839E68C173C1C1E42C6744E218E75EEA694862C9BA9313B7C16C2FA72D68C7F06D09FF083BE61FFFF163114B6585DFC6868C87B21E2F1A8D56A683F3A
Malicious:	true
Preview:	"Y]m'C.}.....z.....x....<5...s{...7...CG5...X..u..;....../}....:;..7..K....oT....S.....%>_..](.V.^.k.k>?T:}..X.>#..Q.O...1T;..j......lJ=W8..:.B..l.........F......d ^FKY.....x{;).3...CC6...k\|L.?...Hnt+..u$.\5..=\|....~L...sUC...b.S.SPk8...G.);Ozg'...Y )8X..@.....5=E.I(.r.TTq..nzF.a)'VG.@C..0..-.A#..>....&.:...-H...:......RVgu.6...X.........op.L3.17...U2.8..V..>..Wy.R...X.)d.p..Lw.g.}../7...8.....q%..$>G........qvW.m..].....r.O.....,QCt..k.AA.U5.r...,..K`.........pscQ.\J......=.d..Cl.+..o..^........P.W...".9...;.}...G.>l...>.b..uR.../...B"......\|..g.....?3.."..v\.(c..I."5n[....p...X.+.i._........].}..........G.N4...F...A........l..I.P.qaN^.\|ZYV....C{..ms..o...OOQ...S.#{....:g.f.$...$...&fV.W...{.,+$...{.`.f.t..p5W...{..J.4g..<F.vZ...k.. .F..}.3..Wr...NV_..[.).D.jXk..5.3.G.S.AI}+3.u...\|;......t..n.......)..$5{ .^&...D.mP..9.`.d....?Uu.DT..*S.Nk.~4.N..3./&c.?s.....n,..?..7Y.8.7.\.}..W...kk....V .....Y`...K....W.......k...."xd....:!..3

C:\Users\user\AppData\Local\Temp\Jones

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.996955834088863
Encrypted:	true
SSDEEP:	1536:gZ8hvQy2rgN7C4MV0nxU1cI2EPD6YEWYgvwnF+5:W8t0gN7juImWIJ2FiG+5
MD5:	165F9357850CD07C17CEE9A2BE519B69
SHA1:	C5D9E877F03E613E6D998A77DE928B03F05B0854
SHA-256:	5B6F891AAE449A6F4E1814C5E82281BE3C5F5876A6BD0A82A98AF9164B7125E5
SHA-512:	974EC2FA68FB449415459CA014CF3915E8DBE452A4EC94BF506586035ED5F3C5D41DA98FD2A7C9F59D88F8C8BBD751AB6947FF48FC64538A8C60CB98E06AE274
Malicious:	true
Preview:	\|.uER...b.....Tl.....in.Q1...\|.L.M..8.U.`{b.N+.P... ........C.>.:?4GJ.N.)q.A..'.W..l.k.....$..G.@\.GB.).....{.B....HX..B..\,...u..k.n.../u.\|.n.L~.Q.....vz....sJs.61.......N..Y.q... .....+z~]........K..B....p{...............k.._;Ke_..=C..,..S.L. >....Vl..?.......P..TA.g,t.:)....p..fF.I.@l..W.\|%..[....^d...j..v..........!.g....].z..]....(x/...0Wn.......8.9t.#-.,...Z~.A..x... .U..o.wp ..vi...r.&...a.n..Wr....@...!.kL....og..I..1.bq.W.ej.9..{.;.W..O{.....\!.Q.+.?o.)tMS..A..V..}. S....W......"...7y..F...pj.A....._,3..D2..;..?...;._..C.@.........D.b...IZ..^...Ys(.k.v.Z..$=~"".^n.\|..(.i...]..w.............X.]C.q.....r.\c......@..../.w.vP......kU7...Jcp..O=s.kX...n.,k...7c...K.....1..B.1.E.....U/(...8...x....r.....{.Z.M"...z.`.z....uD.s........}}UV...H.H2G.C.N!9.RGU....a..>!..W.Wb....y=.....'...%..$8..3.bL.5.n...JS.^.7.]..#g.&.!Z...6n^\|oZ.r..6s... ..D.+.$.@.\]e.....o...-.}~.S.<...6........../....T.....qG.E.*.n....Q..<..p.....a.>..n.

C:\Users\user\AppData\Local\Temp\Lane

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	100352
Entropy (8bit):	7.998191706352116
Encrypted:	true
SSDEEP:	1536:1YAdAfoZKeVtyLmqyCHW67StLCfuO9oKouokyFEPGYwEYZu9ukZl23DBRl0:KAyfoxtDqTH4ZCf5LpoyYZu9zlW7m
MD5:	56F46FE661AFC27893A1DAE49C072A8D
SHA1:	DD4943722397F224A4DC829D95F65A32B992183C
SHA-256:	E06C3B85DF7467060EFB7688E9CACE3E50DE00B61D696423D9A4C15D43A90611
SHA-512:	2807A6DF558509871EB0F471221238F610EB9FF54C6B01CE6B14ED900C107AD0E0AD37814B8479C3B1F4160F342C17497FC40B9A772CE052DCF236AC4E1B3E17
Malicious:	true
Preview:	...v?f.o.@2n...x.=uih/.}..K\|.V..KM;.'4v;k.u3b.Al.CB>/....TYo...Jr.W.K.!@S..J..^.....$...i...K....b."..B.v....F..#..l.a..RM..e;^i...=T.q.ox# ...".9p..A..S.'.%e.2`.Es.u.].(..1..5.:/..K=F......\|f../!.....$F........H...5..\|)uv......a.#Q..s.M..^..p../..nN.8h........k.H...)L.q...y<f...-.$G...T....Y...7..W..Z..$.h...b_7Z.{5.c..]]n.....nG..o39'2.$e...UbXe.m.....;..wuZ.\R.l...q(8u..."..........(.B.&!J.........M..~.M%....W.....O..~...h...H...@".....m`j...4....eF.x}.\~_../....4....0.>.2.....@Xn..........0d...gE)....$..P............i._...Y.........7..sp.......n.....3.WKD^..f.....P.p......6..f~na.f.......[.~1/..PR.9r..._.]..!&..4ntK..1...... R.>....)..g9.ap?.E..w^..0.........Q.b.E.i..u..%.S....m........\|....U1zW.d...t.Z.h.B.)...(..#..TY,...'M)`Y.8;.8VXM...F..x.:....;k.k.S.pI....C}P..R..:..8v..8.......2.......z...).......k....o....D.L.&.w.R..K^..G......)T..G]..D}.x...?.&.Ai..Q(.WJ.M..?L.n..wi..X-5....T.^.>..;...W.P.h&~....&..!.....-x....bJM=E1

C:\Users\user\AppData\Local\Temp\Me

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	ASCII text, with very long lines (1406), with CRLF line terminators
Category:	dropped
Size (bytes):	19403
Entropy (8bit):	5.092419745919344
Encrypted:	false
SSDEEP:	384:RTMLb3hFYHPKmvaPvLONT17+zdzCZhDbkDwHG:RTML+YONT1qpeZpkt
MD5:	EE68F5CBBB21E9957FDAD10000C8D81E
SHA1:	0D08D10C15D2134B2C741BBBB612DB3AEADC7C4A
SHA-256:	D325ADFB96D434D3DD5B5489D921B39C91EBECB85EB1F1C662D4C3C53D402208
SHA-512:	02C5C3DF2734979D6B058E213A005540D907B41357BD3F9F1ECE63885905AAC31BCBCE085D7EF1E03AEECDF862E7A1A277A5B34180B2C071A54C363E47B277E4
Malicious:	false
Preview:	Set Orgasm=C..ekHandheld-Urban-..mWHRBrown-Casinos-..NDnTPrison-Epa-..raaZMagical-She-Evidence-..btrFeeding-Spray-Syria-Produces-Diary-..Set Television=0..AqpProminent-Mechanism-Hispanic-..rgZeWyoming-General-Sc-Epic-Kentucky-Function-..giMArtistic-Shift-Thirty-Victory-Cinema-..zLtZen-Radios-Subdivision-Corporate-Dog-Banking-Proposals-Papers-Integration-..mRHispanic-Pizza-Unlimited-Mx-Revision-Co-Put-Fiction-..hJjPerson-Investigate-Myanmar-Media-Trademarks-Drops-Viking-Notices-Yahoo-..Set Sustainable=J..aHxInnovations-Fossil-Emerging-Participated-His-Cheat-..fDEIVoices-Mai-Kenny-..WFFgOnline-Innovations-Joyce-..hwyLRequire-Pl-Team-Dash-Rays-Appears-..ZKQCondos-Plymouth-Fairy-Config-Cotton-Bookstore-Creature-Earth-Morgan-..NwySoviet-Tomato-Side-..Set Sufficiently=c..kWEnable-Spirits-Commission-Operational-Dream-Config-Juice-Approach-..NPContribution-Ieee-..RScEmma-Season-Ballet-Conducting-Testimony-Robertson-Held-Cut-..TKwFChris-..yqDamages-Migration-Reputation-Drinking-Printers-Appreci

C:\Users\user\AppData\Local\Temp\Me.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1406), with CRLF line terminators
Category:	dropped
Size (bytes):	19403
Entropy (8bit):	5.092419745919344
Encrypted:	false
SSDEEP:	384:RTMLb3hFYHPKmvaPvLONT17+zdzCZhDbkDwHG:RTML+YONT1qpeZpkt
MD5:	EE68F5CBBB21E9957FDAD10000C8D81E
SHA1:	0D08D10C15D2134B2C741BBBB612DB3AEADC7C4A
SHA-256:	D325ADFB96D434D3DD5B5489D921B39C91EBECB85EB1F1C662D4C3C53D402208
SHA-512:	02C5C3DF2734979D6B058E213A005540D907B41357BD3F9F1ECE63885905AAC31BCBCE085D7EF1E03AEECDF862E7A1A277A5B34180B2C071A54C363E47B277E4
Malicious:	false
Preview:	Set Orgasm=C..ekHandheld-Urban-..mWHRBrown-Casinos-..NDnTPrison-Epa-..raaZMagical-She-Evidence-..btrFeeding-Spray-Syria-Produces-Diary-..Set Television=0..AqpProminent-Mechanism-Hispanic-..rgZeWyoming-General-Sc-Epic-Kentucky-Function-..giMArtistic-Shift-Thirty-Victory-Cinema-..zLtZen-Radios-Subdivision-Corporate-Dog-Banking-Proposals-Papers-Integration-..mRHispanic-Pizza-Unlimited-Mx-Revision-Co-Put-Fiction-..hJjPerson-Investigate-Myanmar-Media-Trademarks-Drops-Viking-Notices-Yahoo-..Set Sustainable=J..aHxInnovations-Fossil-Emerging-Participated-His-Cheat-..fDEIVoices-Mai-Kenny-..WFFgOnline-Innovations-Joyce-..hwyLRequire-Pl-Team-Dash-Rays-Appears-..ZKQCondos-Plymouth-Fairy-Config-Cotton-Bookstore-Creature-Earth-Morgan-..NwySoviet-Tomato-Side-..Set Sufficiently=c..kWEnable-Spirits-Commission-Operational-Dream-Config-Juice-Approach-..NPContribution-Ieee-..RScEmma-Season-Ballet-Conducting-Testimony-Robertson-Held-Cut-..TKwFChris-..yqDamages-Migration-Reputation-Drinking-Printers-Appreci

C:\Users\user\AppData\Local\Temp\Motion

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Norwegian

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	7.99689152680788
Encrypted:	true
SSDEEP:	1536:Et/mTGibcoViIseRuDAjW6iLAxjh/coXdARkntiYslL1wTv1:aLTIrbtCA5yoJntiYkwTv1
MD5:	1CF4671CD0018A3EABDC8E0948DA8994
SHA1:	84E45FB877D3128C015234761DAB8FB350668FCA
SHA-256:	0E062BC6DCFC6CFBD254025F843F4EF6E136F7A5605C586332D42502D1B9EDA6
SHA-512:	1D831A0F1D883002BCF35849B6D53A1A987A2672B9CE01276BA48D8B5AF74E7052D8BD902F5782374B34095D8E50245BD691DB3E8354CA65AFEAD08AD919E54E
Malicious:	true
Preview:	b.a......ZE.....d%.VP.P..S9O=n...k.R=..$?@....v.vf.......Y.W. ..u.>}...Z.....r.....R..].Y.........s......b....#3..eL.8c.M..UO.....%....,.I/..ehaC..O.\P..c... &....y....4.`'..Y@...<.S.}.G...Jw........J^. ..V..0..A.RM.CE.)J.iYo#..+..R.W..Y.z~....9.#..Xf..3.".q.})4\|..L#E.;..p6..M..a..NTr....r..x...bY......[...A......j^ ........Et./9.o.~.....T...R.dl.._..b..{.......VD<._#.4x.L..o..GX.l..I<.L.&...\|..\|.O.0...`.. .....8..@o..>.....$q.3.....Q..j.c..[.(.....kl.&-..=Y.I....!9.]X...VY".._bT.u.J..VyK.~u?E*7....!D....@.f...-Y........P..2]..F.S...).w.%`^h2l..4....?J&i.\.9Z7.\rh...v...Q.....e6..6..z.%.(.^.......F.~.o.\|.B\|.....Z";<T..c...x....'L......X.`...........G.....4...v.B..C" ..9......I..<..........m<...........`...R}.1\.......9....+k...&..e.(.0-w.....nRmU0.I#.}.5x....!.!Y.z.9.........^"s.....LI.(...+r..DU.%..^.2..q.<...0...........+.-s>Fs...n..XJ...wp..@oNeLy..p{S/S.\dk...An...f=...N....G..y4.\.B.iE....E.N._.....I....x.@..z.....T.i..&ZV..o}N..u.?.{3

C:\Users\user\AppData\Local\Temp\Ongoing

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	7.99693237584807
Encrypted:	true
SSDEEP:	1536:avIbd7M1sbtJjNrFQBsifWvsVcyjk3KR36nPZu5sDGkk0:mIbd7JBXrFQBcxyY3A3qu5sJk0
MD5:	5DF2524F3875CE07512AE0E09BD6882B
SHA1:	BEDB7C2A6BEBB8942CB3C2B5DAEE7D0618B1245D
SHA-256:	F546A20836F69ED063FCFD61F7144AA99ECB9F9419F1BB8F783CFAF2A9E44A6C
SHA-512:	A931A321BB2511A34723300C3860293228C4F4D92B343907E05B2AF7425F8C063D289F674C94612A60B848EF197C65341840F0B72361D4ABFAC18D3D34E3956A
Malicious:	true
Preview:	.;A.Z...m...8.T.M.Y...<...}.gD4n.`......pf.q.....A.HB.UM.P......&.I...z@..].{bX.b..9.KH.....3.....t..t........e.\y...Br..gM^YaQ....`BP.bC.sa.Kpl..k..R..~.u.J(....W..vm/Y....r...p gS...B-:..W...,2&...Z.x..-.c...#.j..M.a..7.=..~......x.e..R.a.AS..,..y1..%#~..O<.q..@+rV.Gj.Q..,...L.v.....%...@u..*.E.y.d...>......j..#R...w..?Yo.7vL;!9G.'......=..._..L....R...j...@..s@...4.A.]..\|/.K..0.V..P_.q.......YM.c.c..h.G.zy.1..`.;....mE..\..D.l{3..\|...DO.G.6=~......;....h...D..l...0E.Q..#FQ...n....o}l..gD.c.&.....L.E.q.E.U._.....N.e.bh\|..[b.~q..$D....2....2.y...`.x...C.....B.i'..{....?.u,.S?....m.L:.`+a...x\.$....bE.w..E.e..&..+.6{..E.u. ..u.%...f..T.Z~.ac).M.N..Xp....!i......]..\|=...l.[.Q....OI......x...3......c.B..'..R0.-h.D.+...94.y.?...@...Rn.y.X....BT..,.".]......K..9[M.O....2AgZ.e.....Ue.W..qE.Kd....m.!...y...BR.j.eu.Ss..:e..<..mi...e..>..4.UW..t........./......B...G..J.$.+...}.s.^.B{..u.\.R.[..9/.qa>5..'...g..F...9......Sq.j..y...&.#......

C:\Users\user\AppData\Local\Temp\Particularly

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	7.99798135852855
Encrypted:	true
SSDEEP:	1536:IRkCwJhiNhdZ/pyr0os2ic0c1qSlMTn9MRCVZcgHd8acONt6kEaSa6A38jpNTbvz:IRlwJhAdZRnvc0ccSlMTn9MRCVZLHdZg
MD5:	AE21039DF4668DEFCC1613245DD2A0BA
SHA1:	E47E06D4E08DC7F582CD57DECA7F621E7C154890
SHA-256:	7F6A83B3A2A4F860CE8974E390DF851C8D371562DEA3DA4703B614A6EC8F55D4
SHA-512:	61BAFB1E9EA0F840A3558AD765B2EE4DC10FF0D41C894682781302B86F57758DF9BFF5AAF93C624B0B075B748336ABA30AEBBA3BF893154791D2BF6D97CE8813
Malicious:	true
Preview:	.........BK.3..$1O..t..j.T....HAz..Zf\|..z.....`..?4u[id^..pD.2.'Y....B.J........U.7qp=.Ah....?Z.s.=?....y.\|..1.:..0.....c...jB...y..J\i<.F.+..........=.[k.o...B...}..I.U.?+.yQS .. -pxT-.......<.....#?.....LP&..e.>...W...K@...Unk......D.gx......i..`....K".]\|<..8X.>0...%VE....>..I..\|[.....@...]V.G)...'....aq..{[2^vp...s..'.qJ..W..D............q2..@.W... ..a..;Q.[...y..b.w0,r...n%..z..7bI..Y..r.R..)..o......\|.q4m_z4.4......'.N...;/.c9..ssU.V.K.:6.b..A4......2..alRz...Rp.g.KY.c>.N........4SKs.......'kq\..o....u)...\...f.....^~/..>.#..Z.....t@.J.g..&.#Z...L{...@.5..Rc7.K...T...PA..w:...N.:P.7q.....e....fL..(y......}k..[........)4i..L.Z.....V.e..U6/.u&.Z.Og..b...{.\.A...(.... ..{....D..s...\|8..j.QN....I.v.O.!2U..YZI....t......s....B#.Z:...Tx..S.._fL..D.....bN..H(.<{/!.j.y...M...x~...ejC....}.........G.L.T.......+.U..2A* .........".&.A.{..6......m....+sh..6.........Y........+ ...l....'i..'.kM9..=ZT.Q.J......xQ....7itf......}.\F.k.Nf.....PC

C:\Users\user\AppData\Local\Temp\Practices

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.9979171791276595
Encrypted:	true
SSDEEP:	1536:NEIUXqdh9pCqIAMiiKXwVVvp9u5mLOZUClCuIG3jmyNGbENIBDCjzUd0wG6qix:NZU6WqIAMihXkVS5lZUCkuZVAYNoCjz+
MD5:	84B1FC50C592D410A85F7285835920FC
SHA1:	840F948D9824508F48515A7931EC8FE0A1F7F0F0
SHA-256:	B40D393A690DD7706C5793D255BD7EE625E8BFE785EF6ADA2AF7266F6D23CF6F
SHA-512:	36087A0862E20AFAB4734AA61F2EF0AF6B6C047BC2A660F34A353AEC6C3CCE8B67D7B57F116D5E40A4D171B8A44F3F97D885C6028D7977A2E610C146620CC18E
Malicious:	true
Preview:	Z.b>b......&...".Ws.............[.........8.G3v60...~...U.p.9P.7Jh......)...).!.>._.X#v..S/.N....F."g.........F..g...&.c8.DOm..%...c...m.Ut..Y...8,.B#........... CK....vW...jA..n8B.(W5z..j..ywmZ.....1..7.m..uO.&K..wR...................G.C.`..R..L...!..?Oe.\|...E.J..P....gX'.G..~.T....2r..6.N).y.]..t..j!....Uw.l..VS..R.-l.z\.c..E...F4.....^a..v..&]...v./.? .....v..Il..<...Q.s.......(.L....\|.i...J.$C...E+.K8.R...}...O.a.y./...e..-.v...V.s.L..Q....N<.G.K...Y...."...........(nQ.0".n...S.HG..eC`...[HWw...q..2...e.[..y..KAL.......)..`/...0\|Q......9.%...4...0.h.x.,V9....'....I$.!P.S..L\|3.i.UWI.Z...jr..a_....m.\|.jH../.6!..,.{Q.T..Aa.......W8..[.\\|.W..a........1..e. .. ..B...x*].........T.,....7pH.0.........O.P..(._.Ua..KW2..E5.J..]...<.)."4...._Q7..........8$..m.,}s....u..l..cH..,.T..4Up.n...k:..s......i.;v..}....v&w..z......,g.(...D.Eg..+...m_U%.,.n.R..+.;9+.eS.-0f(.G0kG.5..T9Z..LMb&..3.#...K(..#.....L.QCUZj>S..kC...!g..Ak......H.....

C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe

Download File

Process:	C:\Users\user\Desktop\PQwHxAiBGt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1768792
Entropy (8bit):	7.993164405555776
Encrypted:	true
SSDEEP:	24576:OfdnQ3ksSfu03GwiL4Nv7x9RiDew+d3hjqDWg4CC8girDW5F91anxjE+AXg5hUza:33wR3GgNv7bRpw+LuZC89y9ME+4l4FL
MD5:	9E17536C65B31B33BE6F5840E3945407
SHA1:	7E4DECDE1408BB9ACE598FB80F5F7A577F261208
SHA-256:	C633D62F8EB5EB1D570236C4F7B263DA91AAC702781D39D455C2553F83ED0149
SHA-512:	5F9DBCCF2344E281DE025C410046B9EC7CF690253292754275D9C49B9BC86ACE605127313EAC6CE55289BBD3BCFC886F21ACDC522D21B64F22BBB4CB905E8268
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8............@.................................y.....@.................................4........@...+......................d....................................................................................text....m.......n.................. ..`.rdata..b*.......,...r..............@..@.data....~..........................@....ndata.......0...........................rsrc....+...@...,..................@..@.reloc..2....p......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Total

Download File

Process:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
File Type:	data
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	7.9970580637829585
Encrypted:	true
SSDEEP:	1536:x2xsBWwwMCep7wJLUp686KCRFCSx48pbWTsovp:8sB5nwRm6xKvSx4cWTN
MD5:	43C5FEA776CA6EA890DF49366F9471B2
SHA1:	244B83BC389AE798F70765F774ED01FD09E68344
SHA-256:	628427F1013D8F05DC10074B5288FD4E7DDED6985406952AE3CAD2693C6E3EF5
SHA-512:	F1AA393534C4EB46BAAABBD2DF503FA1F9C20588AA4F039432C5D58A8CD0CCB34663F17FBF001CEB845B1A65DE2FB6D2C9805A47BCB9E967027474748CC74069
Malicious:	true
Preview:	.).5v..bz.U....:..!..#`.-`...s..OO.!.niw0...o.N]..%e.?....H....i.M..m....r.\|..n1R.....5Y.fS/."........[..%=.:&z..g6\A..=....6z...u...AzO..w.....PT..L.#...c.Td@-^V.....&..K..j.l...%..\|.R.O..h...It.s..`i.0?q.;WC..9~.dk..]...GS...S.........<_H....[..o..........\|.`n....^...y....`.N..m..^?..&......f.B...B_G .o.._...\yr}...48...I...w....+..=........o($.Ihv....OU..../%.MN..a8~....`:...LD.6....K.......!.@..0.[...X.{..P........r.e..G.V&..E.KM......O.?..(:..N1uB.x.V.....r.s.....K...\.G....\h....,...l...%...Ar..%\|.:.......N....?.....FR..<....=...E...V.:.6.....11....T.6.b.+.:..c.j...SF...D.(Q..j..2<.$...o9...{HW@o....`R....y.3...-b...q....HYC..R..T...;.....K`......t..&.85.3g..H..P'.~...LL.eq..3.1.6..).i.....k..T....C~s.f...:.4..V...'s....$..HF...\|.:..e(......Y..F...BEJ.\|O..X.....q...R.e`......8.....:d..<.(<..f3N." ..I.L.K....MV.&.}....<.(..7..)..d.7..W.D1..2.c2@D.$...$.5#<ZtG.[.5...-.%.Sk.:A..N...b........6$.qSP...!5.=b....}..V;....1.5.. si..i.8/..Y... !R..

C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3102720
Entropy (8bit):	6.376255476158853
Encrypted:	false
SSDEEP:	49152:uxKQUpqBdzGssUvdmPBlZCT8ZazLNAyZZ8/:IKgPvAlZCTmadTZZ8/
MD5:	DD78675858275301D48256D22D52CA74
SHA1:	CA7116D71C2C2AEBFA0E7CDA037B234AB077569C
SHA-256:	7DC0387B2E8A0971FF41B1F55DF2E8EBFE4D8BB29F22C87FBE193E45E614AC67
SHA-512:	C76F2D8BB831B1F9106D41BB7C9FCE4741428C872174367381A852CEEA7799B568FE054FBE8CB9B44596FB77E6719443C11DAA1168841E1EDB9B81EF00C5B219
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....`...............$.....T/...................@...........................3......&...@... .............................. )..1....)..-....................2.............................0........................')..............................text... ...........................`.P`.data...$A.......B..................@.`..rdata..............................@.`@.eh_fram`x.......z..................@.0@.bss....d....P%.......................`..idata...1... )..2....%.............@.0..CRT....8....`)......L%.............@.0..tls.........p)......N%.............@.0..rsrc....-....)......P%.............@.0..reloc........2......~..............@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\setup.exe

Download File

Process:	C:\Users\user\Desktop\PQwHxAiBGt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2120260
Entropy (8bit):	7.236328750029754
Encrypted:	false
SSDEEP:	24576:J4nXubIQGyxbPV0db26AIyZZ64KpWjfGyWOXBcSrxxCFrM0rZbi0ktFV9pDif9g:Jqe3f6XyZZPxjDu3wsZbiDtT9sFg
MD5:	9DEF78C3562D533C530706BA4A2D1277
SHA1:	0087B79339174145D4756D5CD5804149F1FDF416
SHA-256:	A508CCE5CA80306883756B03E7EF0DC3C7915774FE0F2F5C8FD4F5BED73533D0
SHA-512:	FD8DDA7B344F706AF7A7F1C2AB209C452D6A27181B57FAACFF81B88E0D54EA29ACB319C85B70F1D455B8CCA63DC4BC0B4CEAFA3C8A446FD4E78E1AFFA57ABDE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...n.._.................P...(.......^.......p....@..........................P......}.....@......@...................@....... ..6....p.......................................................`......................."..D....0.......................text....6.......8.................. ..`.itext.......P.......<.............. ..`.data....7...p...8...T..............@....bss.....m...............................idata..6.... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.482082978340432
TrID:	Win32 Executable (generic) a (10002005/4) 99.55% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PQwHxAiBGt.exe
File size:	5'276'672 bytes
MD5:	2f0b358d17ffaf3d1f36eb992003fc68
SHA1:	e65fa958100ec8bf4773946c2cd9fa8cd9c5b6d7
SHA256:	61151df093ebef01768789ead98ed2ed73ef951162414101b25a9db8129491a3
SHA512:	52e4238bef4581aca69c362ef2b8e9d8ec59d6d5d9ae7b6250ead043b88da1df7fc85e7dddbcd37b4d19ebe8409fc2337200e8de470655415492c3996a22b128
SSDEEP:	98304:/mTAr1SiCZZZqwspiDsFM3wR3Zt7bjZuu9+CkrK2:/AAr0ZZZqwebMe78u9+Ck
TLSH:	E036D04AF2815179D85A37F01037A7228A366D085319CFAB83F07915EFB7693DD3A60E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..t...'...'...'..d'...'.j.&...'.j.&...'.j.&...'.j.&...'...'...'.m.&...'...'...'.m.'...'.m.&...'Rich...'........PE..L....ABg...

File Icon


Icon Hash:	c6f44b89b4534b07

Static PE Info

General

Entrypoint:	0x4ec946
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67424110 [Sat Nov 23 20:54:40 2024 UTC]
TLS Callbacks:	0x48cb70
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	45791cb8011f54a050d2b23ecfdb3e25

Entrypoint Preview

Instruction
call 00007F12FCAE899Ch
jmp 00007F12FCAE8409h
push ebx
push esi
mov eax, dword ptr [esp+18h]
or eax, eax
jne 00007F12FCAE85AAh
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+0Ch]
div ecx
mov edx, ebx
jmp 00007F12FCAE85D3h
mov ecx, eax
mov ebx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007F12FCAE8586h
div ebx
mov esi, eax
mul dword ptr [esp+18h]
mov ecx, eax
mov eax, dword ptr [esp+14h]
mul esi
add edx, ecx
jc 00007F12FCAE85A0h
cmp edx, dword ptr [esp+10h]
jnbe 00007F12FCAE859Ah
jc 00007F12FCAE8599h
cmp eax, dword ptr [esp+0Ch]
jbe 00007F12FCAE8593h
dec esi
xor edx, edx
mov eax, esi
pop esi
pop ebx
retn 0010h
int3
int3
int3
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+04h]
sub ecx, eax
sbb eax, eax
not eax
and ecx, eax
mov eax, esp
and eax, FFFFF000h
cmp ecx, eax
jc 00007F12FCAE859Ch
mov eax, ecx
pop ecx
xchg eax, esp
mov eax, dword ptr [eax]
mov dword ptr [esp], eax
ret
sub eax, 00001000h
test dword ptr [eax], eax
jmp 00007F12FCAE857Bh
int3
int3
int3
int3
int3
push ebx
mov eax, dword ptr [esp+14h]
or eax, eax
jne 00007F12FCAE85AAh
mov ecx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
xor edx, edx
div ecx
mov eax, dword ptr [esp+08h]
div ecx
mov eax, edx

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x50127c	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x504000	0x1348	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x506000	0x5efc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x500d58	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x500dc0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x500c98	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf3000	0x268	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf178c	0xf1800	eda1bc8b0fa74964196fd3305d6369a8	False	0.5134595788043478	data	6.349602427102444	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf3000	0x40f1b2	0x40f200	b9d2bf95673d6c4f4c639ba7943255b1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x503000	0x598	0x200	8e868bf42833315384ca18ea2e1d9613	False	0.19140625	data	1.1470739081280514	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x504000	0x1348	0x1400	0ccc6e0c8d42692a75266b30d26a16dd	False	0.462109375	data	4.756605131387613	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x506000	0x5efc	0x6000	8483a6f3b96d36a3101a9234b398cb02	False	0.7706705729166666	data	6.687792745680121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x504288	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4800656660412758
RT_GROUP_ICON	0x505330	0x14	data	English	United States	1.1
RT_VERSION	0x5040f0	0x194	OpenPGP Secret Key	English	United States	0.5371287128712872

Imports

DLL	Import
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressSingle, WakeByAddressAll
bcryptprimitives.dll	ProcessPrng
kernel32.dll	UnhandledExceptionFilter, IsDebuggerPresent, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetTempPathW, SetHandleInformation, GetEnvironmentVariableW, FormatMessageW, GetCurrentProcessId, GetProcAddress, SetUnhandledExceptionFilter, GetModuleHandleA, WriteConsoleW, MultiByteToWideChar, WaitForSingleObject, IsProcessorFeaturePresent, GetEnvironmentStringsW, FreeEnvironmentStringsW, CompareStringOrdinal, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, GetCurrentProcess, DuplicateHandle, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, DeleteProcThreadAttributeList, CreateNamedPipeW, CreateThread, SleepEx, ReadFileEx, SetFileInformationByHandle, GetModuleHandleW, WaitForMultipleObjects, GetOverlappedResult, GetExitCodeProcess, ReadFile, CancelIo, HeapAlloc, GetProcessHeap, GetConsoleMode, GetStdHandle, CreateFileW, GetSystemInfo, HeapReAlloc, GetCurrentThread, CreateWaitableTimerExW, SetWaitableTimer, Sleep, SetThreadStackGuarantee, GetFileInformationByHandleEx, AddVectoredExceptionHandler, GetComputerNameExW, GetTimeZoneInformationForYear, GetSystemTimePreciseAsFileTime, SetFileAttributesW, CopyFileExW, CreateSymbolicLinkW, DeleteFileW, FindClose, FindNextFileW, FindFirstFileW, GetCurrentDirectoryW, SetLastError, GetFileInformationByHandle, CloseHandle, SwitchToThread, QueryPerformanceFrequency, QueryPerformanceCounter, GetLastError, HeapFree, CreateEventW, GetFullPathNameW, WriteFileEx, GetModuleFileNameW, TerminateProcess
bcrypt.dll	BCryptGenRandom
advapi32.dll	SystemFunction036, GetUserNameW
ntdll.dll	RtlNtStatusToDosError, NtReadFile, NtWriteFile
ws2_32.dll	listen, bind, connect, getpeername, getsockname, WSASend, send, WSARecv, select, setsockopt, WSADuplicateSocketW, getsockopt, closesocket, WSASocketW, freeaddrinfo, WSACleanup, WSAStartup, WSAGetLastError, getaddrinfo, accept, ioctlsocket, recv
VCRUNTIME140.dll	memcmp, _except_handler4_common, __current_exception_context, __current_exception, memcpy, memmove, memset
api-ms-win-crt-runtime-l1-1-0.dll	_initterm_e, exit, __p___argv, _initialize_narrow_environment, _cexit, _exit, _configure_narrow_argv, _register_thread_local_exe_atexit_callback, _initterm, _set_app_type, _initialize_onexit_table, _register_onexit_function, _crt_atexit, _controlfp_s, terminate, _get_initial_narrow_environment, _c_exit, _seh_filter_exe, __p___argc
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 10:34:11.114010096 CET	49704	443	192.168.2.10	185.166.143.50
Dec 9, 2024 10:34:11.114042044 CET	443	49704	185.166.143.50	192.168.2.10
Dec 9, 2024 10:34:11.114113092 CET	49704	443	192.168.2.10	185.166.143.50
Dec 9, 2024 10:34:11.115187883 CET	49704	443	192.168.2.10	185.166.143.50
Dec 9, 2024 10:34:11.115200996 CET	443	49704	185.166.143.50	192.168.2.10
Dec 9, 2024 10:34:12.504581928 CET	443	49704	185.166.143.50	192.168.2.10
Dec 9, 2024 10:34:12.539263010 CET	49704	443	192.168.2.10	185.166.143.50
Dec 9, 2024 10:34:12.539273977 CET	443	49704	185.166.143.50	192.168.2.10
Dec 9, 2024 10:34:12.540837049 CET	443	49704	185.166.143.50	192.168.2.10
Dec 9, 2024 10:34:12.540899992 CET	49704	443	192.168.2.10	185.166.143.50
Dec 9, 2024 10:34:12.548413992 CET	49704	443	192.168.2.10	185.166.143.50
Dec 9, 2024 10:34:12.548455000 CET	49704	443	192.168.2.10	185.166.143.50
Dec 9, 2024 10:34:12.548640013 CET	443	49704	185.166.143.50	192.168.2.10
Dec 9, 2024 10:34:12.548713923 CET	49704	443	192.168.2.10	185.166.143.50
Dec 9, 2024 10:34:12.780576944 CET	49706	443	192.168.2.10	104.26.8.44
Dec 9, 2024 10:34:12.780630112 CET	443	49706	104.26.8.44	192.168.2.10
Dec 9, 2024 10:34:12.780688047 CET	49706	443	192.168.2.10	104.26.8.44
Dec 9, 2024 10:34:12.780936956 CET	49706	443	192.168.2.10	104.26.8.44
Dec 9, 2024 10:34:12.780949116 CET	443	49706	104.26.8.44	192.168.2.10
Dec 9, 2024 10:34:14.310580015 CET	443	49706	104.26.8.44	192.168.2.10
Dec 9, 2024 10:34:14.311081886 CET	49706	443	192.168.2.10	104.26.8.44
Dec 9, 2024 10:34:14.311115980 CET	443	49706	104.26.8.44	192.168.2.10
Dec 9, 2024 10:34:14.312319994 CET	443	49706	104.26.8.44	192.168.2.10
Dec 9, 2024 10:34:14.312387943 CET	49706	443	192.168.2.10	104.26.8.44
Dec 9, 2024 10:34:14.313183069 CET	49706	443	192.168.2.10	104.26.8.44
Dec 9, 2024 10:34:14.313220978 CET	49706	443	192.168.2.10	104.26.8.44
Dec 9, 2024 10:34:14.313354969 CET	443	49706	104.26.8.44	192.168.2.10
Dec 9, 2024 10:34:14.313410997 CET	49706	443	192.168.2.10	104.26.8.44

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 10:34:10.973004103 CET	60974	53	192.168.2.10	1.1.1.1
Dec 9, 2024 10:34:11.110903025 CET	53	60974	1.1.1.1	192.168.2.10
Dec 9, 2024 10:34:12.557459116 CET	61436	53	192.168.2.10	1.1.1.1
Dec 9, 2024 10:34:12.710225105 CET	53	61436	1.1.1.1	192.168.2.10
Dec 9, 2024 10:34:21.655725956 CET	51370	53	192.168.2.10	1.1.1.1
Dec 9, 2024 10:34:21.892956972 CET	53	51370	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 10:34:10.973004103 CET	192.168.2.10	1.1.1.1	0xe1ad	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:34:12.557459116 CET	192.168.2.10	1.1.1.1	0x6612	Standard query (0)	ipapi.co	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:34:21.655725956 CET	192.168.2.10	1.1.1.1	0x7eee	Standard query (0)	edMKDlxnNIzWufljfi.edMKDlxnNIzWufljfi	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 10:34:11.110903025 CET	1.1.1.1	192.168.2.10	0xe1ad	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:34:11.110903025 CET	1.1.1.1	192.168.2.10	0xe1ad	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:34:11.110903025 CET	1.1.1.1	192.168.2.10	0xe1ad	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:34:12.710225105 CET	1.1.1.1	192.168.2.10	0x6612	No error (0)	ipapi.co		104.26.8.44	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:34:12.710225105 CET	1.1.1.1	192.168.2.10	0x6612	No error (0)	ipapi.co		172.67.69.226	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:34:12.710225105 CET	1.1.1.1	192.168.2.10	0x6612	No error (0)	ipapi.co		104.26.9.44	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:34:21.892956972 CET	1.1.1.1	192.168.2.10	0x7eee	Name error (3)	edMKDlxnNIzWufljfi.edMKDlxnNIzWufljfi	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:34:09
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\PQwHxAiBGt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PQwHxAiBGt.exe"
Imagebase:	0x510000
File size:	5'276'672 bytes
MD5 hash:	2F0B358D17FFAF3D1F36EB992003FC68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:34:13
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\setup.exe"
Imagebase:	0x400000
File size:	2'120'260 bytes
MD5 hash:	9DEF78C3562D533C530706BA4A2D1277
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:34:13
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RobertsonDeclined.exe"
Imagebase:	0x400000
File size:	1'768'792 bytes
MD5 hash:	9E17536C65B31B33BE6F5840E3945407
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:34:14
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-TN43S.tmp\setup.tmp" /SL5="$104AA,1145856,1145856,C:\Users\user\AppData\Local\Temp\setup.exe"
Imagebase:	0x1c0000
File size:	3'102'720 bytes
MD5 hash:	DD78675858275301D48256D22D52CA74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:34:16
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Me Me.cmd & Me.cmd
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:34:16
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:34:18
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x8c0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:34:18
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xe80000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:34:19
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x8c0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:34:19
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xe80000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:34:19
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 422648
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:34:19
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Total + ..\Jones + ..\Handed + ..\Norwegian + ..\Beef + ..\Cu + ..\Biology + ..\Busy + ..\Bahamas + ..\Invoice + ..\Practices + ..\Atm + ..\Particularly + ..\Ongoing + ..\Lane + ..\False + ..\Huge B
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:34:20
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\422648\Ai.com
Wow64 process (32bit):	true
Commandline:	Ai.com B
Imagebase:	0x5f0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:34:20
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x380000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:34:45
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe
Imagebase:	0xc0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:34:45
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe
Imagebase:	0x2c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000011.00000002.1707925431.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:34:51
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x890000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000012.00000003.1704529751.0000000005200000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000012.00000003.1705181582.0000000005420000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000012.00000003.1702400594.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000012.00000002.1713875821.0000000002EC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10%
Total number of Nodes:	10
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 005ABA90 Relevance: 4.5, APIs: 3, Instructions: 33
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadStackGuarantee.KERNEL32 ref: 005ABAA2
HeapFree.KERNEL32(00000000), ref: 005ABACC
HeapFree.KERNEL32(00000000,?), ref: 005ABADB

Memory Dump Source

Source File: 00000000.00000002.1468934917.0000000000511000.00000020.00000001.01000000.00000003.sdmp, Offset: 00510000, based on PE: true

Associated: 00000000.00000002.1468914842.0000000000510000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469017951.0000000000603000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469017951.0000000000718000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469368223.0000000000A13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1469387904.0000000000A14000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_510000_PQwHxAiBGt.jbxd

Similarity

API ID: FreeHeap$GuaranteeStackThread
String ID:
API String ID: 707462487-0
Opcode ID: 7b82281ac1a79cf28381bb92c362d92504cacb4e743a793c5c7cdb080937c135
Instruction ID: d97e77270fba91906d1a530987a83c7a16b3897d1c6c8aedc20cede0a55f3af3
Opcode Fuzzy Hash: 7b82281ac1a79cf28381bb92c362d92504cacb4e743a793c5c7cdb080937c135
Instruction Fuzzy Hash: 31F0B476100200ABDB209F44DC4CF4BBFA9FF4D712F188028F50597251D375A914CBB5

Analysis Process: RobertsonDeclined.exePID: 8160, Parent PID: 8024COMMON

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.4%
Total number of Nodes:	1474
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNEL32(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNEL32(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

@rD, xrefs: 004053D7
New install of "%s" to "%s", xrefs: 00405182
{, xrefs: 00405352

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNEL32(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNEL32(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNEL32(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

\Temp, xrefs: 00403A1B
NSIS Error, xrefs: 004038E2
SeShutdownPrivilege, xrefs: 00403C16
NCRC, xrefs: 0040397C
~nsu.tmp, xrefs: 00403AF7
Error launching installer, xrefs: 00403A7D
_?=, xrefs: 00403A64
1C, xrefs: 00403B56
/D=, xrefs: 004039A6

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNEL32(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherEnableMenuUser$DestroyEnabledLongSystemTextlstrlen
String ID: @rD
API String ID: 3906175533-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNEL32(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNEL32(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNEL32(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNEL32(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

CreateDirectory: "%s" (%d), xrefs: 004017BF
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Rename: %s, xrefs: 004018F8
SetFileAttributes failed., xrefs: 004017A1
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Rename on reboot: %s, xrefs: 00401943
Sleep(%d), xrefs: 0040169D
BringToFront, xrefs: 004016BD
detailprint: %s, xrefs: 00401679
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Rename failed: %s, xrefs: 0040194B
Call: %d, xrefs: 0040165A
Jump: %d, xrefs: 00401602
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
SetFileAttributes: "%s":%08X, xrefs: 0040177B
CreateDirectory: "%s" created, xrefs: 00401849
Aborting: "%s", xrefs: 0040161D

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNEL32(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNEL32(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

@rD, xrefs: 00405965
.DEFAULT\Control Panel\International, xrefs: 00405999
B%F, xrefs: 00405A1F
RichEd32, xrefs: 00405BA8
@%F, xrefs: 004059F6
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
_Nb, xrefs: 00405AD1
RichEd20, xrefs: 00405B9D
RichEdit, xrefs: 00405BC4
.exe, xrefs: 00405A3D
RichEdit20A, xrefs: 00405BB6, 00405BBB

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,ReplicationWorry,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,ReplicationWorry,ReplicationWorry,00000000,00000000,ReplicationWorry,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error, user retry, xrefs: 00401B40
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user abort, xrefs: 00401B53
ReplicationWorry, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error creating "%s", xrefs: 00401AF0
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user cancel, xrefs: 00401B93
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$ReplicationWorry
API String ID: 4286501637-419934467
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNEL32(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Inst, xrefs: 0040366C
soft, xrefs: 00403675
Error launching installer, xrefs: 004035D7
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNEL32(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

P1B, xrefs: 004033A9
X1C, xrefs: 004033ED
X1C, xrefs: 0040343C
... %d%%, xrefs: 0040349E

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNEL32(00710060), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
ReplicationWorry, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$ReplicationWorry
API String ID: 1459762280-4287379284
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNEL32(00710060), ref: 00402387

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
ReplicationWorry, xrefs: 00402770
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$ReplicationWorry$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-1750368859
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNEL32(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNEL32(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNEL32(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

, xrefs: 00404F39
N, xrefs: 00404C06
M, xrefs: 00404B43
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
82D, xrefs: 004046DB
A, xrefs: 00404636
@%F, xrefs: 00404674

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: ae95d19a650443c120af7248ec578161461b31874b4e5badf60a47e74a1ad680
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: ae95d19a650443c120af7248ec578161461b31874b4e5badf60a47e74a1ad680
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

GetTTFNameString, xrefs: 00406F07
name, xrefs: 00406FBF
%s: failed opening file "%s", xrefs: 00406F0C

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
Delete: DeleteFile("%s"), xrefs: 00406DBC
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
\*.*, xrefs: 00406D03
Delete: DeleteFile failed("%s"), xrefs: 00406DFD

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C
@%F, xrefs: 00406A53

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

GetModuleBaseNameW, xrefs: 00406494
Module32NextW, xrefs: 004065DE
Unknown, xrefs: 004064FC
Process32NextW, xrefs: 004065C8
PSAPI.DLL, xrefs: 00406464
Kernel32.DLL, xrefs: 0040659B
Module32FirstW, xrefs: 004065D3
CreateToolhelp32Snapshot, xrefs: 004065B5
EnumProcessModules, xrefs: 0040648A
EnumProcesses, xrefs: 00406482
Process32FirstW, xrefs: 004065BD

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNEL32(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

[Rename], xrefs: 00406BC8, 00406BD7
NUL, xrefs: 00406A9E
F, xrefs: 00406AE8
%s=%s, xrefs: 00406B43

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 004028D3 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 100registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023), ref: 004028FD

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Strings

WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 851f9ae02ebf16e617d7dc7c261c2c3ae114e343f87d589352c7bd3343235263
Instruction ID: 4333191c585e2ccbf31537ec3fe99400e108362b2ae8da956978e4ec321c2a22
Opcode Fuzzy Hash: 851f9ae02ebf16e617d7dc7c261c2c3ae114e343f87d589352c7bd3343235263
Instruction Fuzzy Hash: 59319AB2E00208BFDF22AF91CE4699EBF76EB04714F10407BF505701A1D6794B60AB99

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 004040D3 Relevance: 13.6, APIs: 9, Instructions: 100windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,?,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,?,04010000), ref: 004041CB
lstrlenW.KERNEL32(?,?,04010000,?,?,?,00000000), ref: 004041D6
SendMessageW.USER32(00000000,00000435,?,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,?,?), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 00404004

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSend$ByteCharMultiWide$AllocButtonCheckColorGlobalItemlstrlen
String ID:
API String ID: 3308522672-0
Opcode ID: c2e5bf2fee51a3b87e923a3f0ec37a23181173616caa330dd2575270d9358daf
Instruction ID: f43bbde6d36b0f8d2302eacd2e434541dff8fa1ace2a4d459b82edc74fb6029a
Opcode Fuzzy Hash: c2e5bf2fee51a3b87e923a3f0ec37a23181173616caa330dd2575270d9358daf
Instruction Fuzzy Hash: B431B2B1900109BFDB009F64DD85E6E3BA9FB44709F00803AFA05FB2E1D7789A51DB59

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0000DC00,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNEL32(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000003.00000002.1351996044.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1351975024.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352015228.0000000000408000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000040B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.000000000041F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352037422.0000000000461000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1352125885.00000000004F4000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RobertsonDeclined.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: setup.tmpPID: 7288, Parent PID: 8152COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.9%
Total number of Nodes:	810
Total number of Limit Nodes:	39

Executed Functions

Function 0024AFA0 Relevance: 118.8, APIs: 63, Strings: 4, Instructions: 1504COMMON

Download Yara Rule

APIs

GetPropW.USER32 ref: 0024AFC3
DefWindowProcW.USER32 ref: 0024B0DF
ShowWindow.USER32 ref: 0024B13E
free.MSVCRT ref: 0024B2C3
calloc.MSVCRT ref: 0024B2D7
MonitorFromWindow.USER32 ref: 0024B5C3
GetMonitorInfoW.USER32 ref: 0024B5F0
SetCursor.USER32 ref: 0024BABD

Strings

(, xrefs: 0024C576
,, xrefs: 0024C3D5
Win32: Failed to retrieve raw input data, xrefs: 0024C9BB
GLFW, xrefs: 0024AFB8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Window$Monitor$CursorFromInfoProcPropShowcallocfree
String ID: ($,$GLFW$Win32: Failed to retrieve raw input data
API String ID: 3569294516-1653677416
Opcode ID: 372fc3d9c29e7137b94276bee81265dc1b84b009ebc4c0ebcdca0e76273b3b27
Instruction ID: 3203eee5046fb8403d886ca6ff1c1cb2e20ab2726a333e5d9b3481b9f7cdfeeb
Opcode Fuzzy Hash: 372fc3d9c29e7137b94276bee81265dc1b84b009ebc4c0ebcdca0e76273b3b27
Instruction Fuzzy Hash: 1AE235706287418FD769EF29C58872EBBE0BF84305F11892EE8D987251D7B5D898CF42

Function 00247720 Relevance: 115.9, APIs: 32, Strings: 34, Instructions: 407
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoW.USER32 ref: 0024774C
SystemParametersInfoW.USER32 ref: 00247770
LoadLibraryA.KERNEL32 ref: 00247782
GetProcAddress.KERNEL32 ref: 002477A5
LoadLibraryA.KERNEL32 ref: 002477B6
GetProcAddress.KERNEL32 ref: 002477D3
GetProcAddress.KERNEL32 ref: 002477ED
GetProcAddress.KERNEL32 ref: 00247807
GetProcAddress.KERNEL32 ref: 00247821
GetProcAddress.KERNEL32 ref: 0024783B
GetProcAddress.KERNEL32 ref: 00247855
LoadLibraryA.KERNEL32 ref: 00247866
GetProcAddress.KERNEL32 ref: 0024787F
LoadLibraryA.KERNEL32 ref: 002478D1
GetProcAddress.KERNEL32 ref: 002478EA
GetProcAddress.KERNEL32 ref: 00247904
LoadLibraryA.KERNEL32 ref: 00247915
GetProcAddress.KERNEL32 ref: 0024792E
GetProcAddress.KERNEL32 ref: 00247948
GetProcAddress.KERNEL32 ref: 00247962
LoadLibraryA.KERNEL32 ref: 00247973
GetProcAddress.KERNEL32 ref: 0024798C
GetProcAddress.KERNEL32 ref: 002479A6
LoadLibraryA.KERNEL32 ref: 002479B7
GetProcAddress.KERNEL32 ref: 002479D0
GetModuleHandleW.KERNEL32 ref: 00247D65
CreateWindowExW.USER32 ref: 00247DC9
ShowWindow.USER32 ref: 00247DEA
RegisterDeviceNotificationW.USER32 ref: 00247E54
PeekMessageW.USER32 ref: 00247EB4

Strings

xinput1_3.dll, xrefs: 00247891
GetDpiForMonitor, xrefs: 0024799B
SetProcessDPIAware, xrefs: 002477C8
Win32: Failed to create helper window, xrefs: 00247EDB
GLFW message window, xrefs: 00247DB2
xinput9_1_0.dll, xrefs: 0024789D
timeGetTime, xrefs: 00247794
ntdll.dll, xrefs: 002479B0
xinput1_4.dll, xrefs: 00247889, 002478AD
Win32: Failed to load user32.dll, xrefs: 00247D3E
dinput8.dll, xrefs: 0024785F
DwmIsCompositionEnabled, xrefs: 00247923
GetDpiForWindow, xrefs: 00247830
EnableNonClientDpiScaling, xrefs: 002477FC
XInputGetCapabilities, xrefs: 002478DF
user32.dll, xrefs: 002477AF
DwmFlush, xrefs: 0024793D
XInputGetState, xrefs: 002478F9
GLFW30, xrefs: 00247DBA
DwmEnableBlurBehindWindow, xrefs: 00247957
AdjustWindowRectExForDpi, xrefs: 0024784A
0, xrefs: 00247E40
, xrefs: 00247E1B
RtlVerifyVersionInfo, xrefs: 002479C5
xinput1_2.dll, xrefs: 002478A5
shcore.dll, xrefs: 0024796C
DirectInput8Create, xrefs: 00247874
dwmapi.dll, xrefs: 0024790E
SetProcessDpiAwareness, xrefs: 00247981
Win32: Failed to load winmm.dll, xrefs: 00247D1E
ChangeWindowMessageFilterEx, xrefs: 002477E2
SetProcessDpiAwarenessContext, xrefs: 00247816
xinput1_1.dll, xrefs: 002478B2
winmm.dll, xrefs: 0024777B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad$InfoParametersSystemWindow$CreateDeviceHandleMessageModuleNotificationPeekRegisterShow
String ID: $0$AdjustWindowRectExForDpi$ChangeWindowMessageFilterEx$DirectInput8Create$DwmEnableBlurBehindWindow$DwmFlush$DwmIsCompositionEnabled$EnableNonClientDpiScaling$GLFW message window$GLFW30$GetDpiForMonitor$GetDpiForWindow$RtlVerifyVersionInfo$SetProcessDPIAware$SetProcessDpiAwareness$SetProcessDpiAwarenessContext$Win32: Failed to create helper window$Win32: Failed to load user32.dll$Win32: Failed to load winmm.dll$XInputGetCapabilities$XInputGetState$dinput8.dll$dwmapi.dll$ntdll.dll$shcore.dll$timeGetTime$user32.dll$winmm.dll$xinput1_1.dll$xinput1_2.dll$xinput1_3.dll$xinput1_4.dll$xinput9_1_0.dll
API String ID: 1697840400-299747978
Opcode ID: 69cb3f7d93d747dc99edea104badf857c3898db54688417a061fabe7e2b0d3c2
Instruction ID: 98308910dacc17a99d6587ecc6fd40a47c43350ecdc6ae5568db39cdba42b63c
Opcode Fuzzy Hash: 69cb3f7d93d747dc99edea104badf857c3898db54688417a061fabe7e2b0d3c2
Instruction Fuzzy Hash: 1B1218B85293008FD704AF68E94831A7BF0FB46309F41893DE5988B361E7B5845DCF9A

Function 001ED280 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 118
filelibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 001ED2B5
GetModuleFileNameW.KERNEL32 ref: 001ED2ED
wcsrchr.MSVCRT ref: 001ED301
wcscpy.MSVCRT ref: 001ED316
FindFirstFileW.KERNEL32 ref: 001ED326
wcscpy.MSVCRT ref: 001ED353
LoadLibraryW.KERNEL32 ref: 001ED35B
GetProcAddress.KERNEL32 ref: 001ED371
wcsrchr.MSVCRT ref: 001ED3AC
_wcslwr.MSVCRT ref: 001ED3BA

Part of subcall function 0032DDA0: malloc.MSVCRT ref: 0032DDB5

strcpy.MSVCRT ref: 001ED3F7

Part of subcall function 001F12C0: malloc.MSVCRT ref: 001F12E5
Part of subcall function 001F12C0: malloc.MSVCRT ref: 001F12FB
Part of subcall function 001F12C0: exit.MSVCRT ref: 001F1339

FindNextFileW.KERNEL32 ref: 001ED444

Strings

cls-*.dll, xrefs: 001ED306
ClsMain, xrefs: 001ED366
\, xrefs: 001ED2F6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Filemalloc$Findwcscpywcsrchr$AddressFirstLibraryLoadModuleNameNextProcQueryVirtual_wcslwrexitstrcpy
String ID: ClsMain$\$cls-*.dll
API String ID: 591050770-1343641317
Opcode ID: 2d79153335678c41f6c733d44caf82ffaa8b1100db2b745e41b0abc427fd3b46
Instruction ID: 397cacfb185fef84c5c49dd08083b8789e4a8f08d494e542aeeedb32f0eb32ff
Opcode Fuzzy Hash: 2d79153335678c41f6c733d44caf82ffaa8b1100db2b745e41b0abc427fd3b46
Instruction Fuzzy Hash: AD51E5B0508B009FC301EF68E58966EBBF0BF85705F41892EE4C88B351EB749949DF96

Function 001C11B3 Relevance: 15.1, APIs: 10, Instructions: 143
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 001C1248
__p__acmdln.MSVCRT ref: 001C1271
malloc.MSVCRT ref: 001C12FB
strlen.MSVCRT ref: 001C132B
malloc.MSVCRT ref: 001C1336
memcpy.MSVCRT ref: 001C134C
_amsg_exit.MSVCRT ref: 001C13F2
_initterm.MSVCRT ref: 001C1414
_initterm.MSVCRT ref: 001C1489

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterUnhandled__p__acmdln_amsg_exitmemcpystrlen
String ID:
API String ID: 760028103-0
Opcode ID: bddf76bc13a3bc2046d613869e5a3c53c40c2156a9ede4f9e04586e8521779c5
Instruction ID: b620399b2eb1e4dc515bb17b4576f2ba1e95ec30f867a3f92ff6e8b02599917c
Opcode Fuzzy Hash: bddf76bc13a3bc2046d613869e5a3c53c40c2156a9ede4f9e04586e8521779c5
Instruction Fuzzy Hash: 7B5149B4A04301DFDB10EFA4E985B9EBBE0BF5A305F11842DD9889B212E734D955CF86

Function 001C1170 Relevance: 13.6, APIs: 9, Instructions: 128COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 001C1443

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: InfoStartup
String ID:
API String ID: 2571198056-0
Opcode ID: efb79b3df0522b5f892ada757222440a4c2624e32499d837deeb72f49df38ed4
Instruction ID: f1139b11eca607ca601b9a4f8a053c387017546c209e2af8a5e3045768da0277
Opcode Fuzzy Hash: efb79b3df0522b5f892ada757222440a4c2624e32499d837deeb72f49df38ed4
Instruction Fuzzy Hash: 5A518AB5A04300DFD710EFA8D981B9ABBE0BB9A705F61842DE9849B313D734D944CF86

Function 00250410 Relevance: 73.9, APIs: 11, Strings: 31, Instructions: 417
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0025042F
GetProcAddress.KERNEL32 ref: 00250456
GetProcAddress.KERNEL32 ref: 00250470
GetProcAddress.KERNEL32 ref: 0025048A
GetProcAddress.KERNEL32 ref: 002504A4
GetProcAddress.KERNEL32 ref: 002504BE
GetProcAddress.KERNEL32 ref: 002504D8
GetProcAddress.KERNEL32 ref: 002504F2
GetDC.USER32 ref: 00250504
ChoosePixelFormat.GDI32 ref: 0025053F
SetPixelFormat.GDI32 ref: 00250553

Strings

wglGetCurrentDC, xrefs: 00250499
wglSwapIntervalEXT, xrefs: 002505E1
WGL_ARB_create_context, xrefs: 002506F6
WGL: Failed to create dummy context, xrefs: 00250B29
WGL: Failed to load opengl32.dll, xrefs: 00250920
wglGetPixelFormatAttribivARB, xrefs: 002505F6
opengl32.dll, xrefs: 00250428
wglGetExtensionsStringARB, xrefs: 002505B7
%, xrefs: 0025052B
WGL_ARB_create_context_no_error, xrefs: 002507F2
WGL_ARB_framebuffer_sRGB, xrefs: 00250678
wglShareLists, xrefs: 002504E7
wglMakeCurrent, xrefs: 002504CD
wglGetProcAddress, xrefs: 0025047F
(, xrefs: 00250523
WGL_ARB_create_context_profile, xrefs: 00250735
WGL_ARB_context_flush_control, xrefs: 002508E4
WGL: Failed to set pixel format for dummy context, xrefs: 002509E7
WGL_ARB_multisample, xrefs: 00250639
wglDeleteContext, xrefs: 00250465
wglGetExtensionsStringEXT, xrefs: 002505A2
wglGetCurrentContext, xrefs: 002504B3
WGL_EXT_framebuffer_sRGB, xrefs: 002506B7
WGL_EXT_create_context_es2_profile, xrefs: 00250774
WGL: Failed to make dummy context current, xrefs: 00250A02
WGL_EXT_colorspace, xrefs: 00250870
WGL_EXT_swap_control, xrefs: 00250831
wglCreateContextAttribsARB, xrefs: 002505CC
wglCreateContext, xrefs: 0025044B
WGL_ARB_pixel_format, xrefs: 002508AF
WGL_ARB_create_context_robustness, xrefs: 002507B3

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressProc$FormatPixel$ChooseLibraryLoad
String ID: %$($WGL: Failed to create dummy context$WGL: Failed to load opengl32.dll$WGL: Failed to make dummy context current$WGL: Failed to set pixel format for dummy context$WGL_ARB_context_flush_control$WGL_ARB_create_context$WGL_ARB_create_context_no_error$WGL_ARB_create_context_profile$WGL_ARB_create_context_robustness$WGL_ARB_framebuffer_sRGB$WGL_ARB_multisample$WGL_ARB_pixel_format$WGL_EXT_colorspace$WGL_EXT_create_context_es2_profile$WGL_EXT_framebuffer_sRGB$WGL_EXT_swap_control$opengl32.dll$wglCreateContext$wglCreateContextAttribsARB$wglDeleteContext$wglGetCurrentContext$wglGetCurrentDC$wglGetExtensionsStringARB$wglGetExtensionsStringEXT$wglGetPixelFormatAttribivARB$wglGetProcAddress$wglMakeCurrent$wglShareLists$wglSwapIntervalEXT
API String ID: 2177870187-3315370416
Opcode ID: 48e2e590b77f0b8ee6287d7a09cd5504bd2d84eafaf9602925e5d5e3790b6f39
Instruction ID: 68a37b1047da20487b06fc5a58d043376f1073f441291cd59768db79093999b5
Opcode Fuzzy Hash: 48e2e590b77f0b8ee6287d7a09cd5504bd2d84eafaf9602925e5d5e3790b6f39
Instruction Fuzzy Hash: 22F120B86243019FD740AF79DDC522A7BE4BB4A746F01483CDA8AC3216E774D458CF6A

Function 0024CBD0 Relevance: 45.9, APIs: 20, Strings: 6, Instructions: 412
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00249EC0: EnumDisplaySettingsExW.USER32 ref: 00249F11

Part of subcall function 0024A370: EnumDisplaySettingsW.USER32 ref: 0024A3B1

Part of subcall function 002471E0: MultiByteToWideChar.KERNEL32 ref: 0024721C
Part of subcall function 002471E0: calloc.MSVCRT ref: 00247232
Part of subcall function 002471E0: MultiByteToWideChar.KERNEL32 ref: 0024725C

GetModuleHandleW.KERNEL32 ref: 0024CC5A
CreateWindowExW.USER32 ref: 0024CCBA
free.MSVCRT ref: 0024CCD0
SetPropW.USER32 ref: 0024CCF2

Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475D9
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475F5
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 00247611

DragAcceptFiles.SHELL32 ref: 0024CDBE
ShowWindow.USER32 ref: 0024CE37
BringWindowToTop.USER32 ref: 0024CE49
SetForegroundWindow.USER32 ref: 0024CE5B
SetFocus.USER32 ref: 0024CE6D
GetMonitorInfoW.USER32 ref: 0024CED6
SetWindowPos.USER32 ref: 0024CF1C

Strings

Win32: Failed to create window, xrefs: 0024CF35
GLFW30, xrefs: 0024CC9B
(, xrefs: 0024CEC4
`, xrefs: 0024CFE9
I, xrefs: 0024CD7F
GLFW, xrefs: 0024CCE7

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Window$ConditionMask$ByteCharDisplayEnumMultiSettingsWide$AcceptBringCreateDragFilesFocusForegroundHandleInfoModuleMonitorPropShowcallocfree
String ID: ($GLFW$GLFW30$I$Win32: Failed to create window$`
API String ID: 2978877559-4072544135
Opcode ID: 6fb4d9a32f22ed04d8290cd0cffc82c80ba0d55139c97fd2cf2410ecd080508a
Instruction ID: 7748c455b6768922603d17152173622de9f667c2560ac7e63180b9509014e0d0
Opcode Fuzzy Hash: 6fb4d9a32f22ed04d8290cd0cffc82c80ba0d55139c97fd2cf2410ecd080508a
Instruction Fuzzy Hash: 3212EEB4A193018FD754EF69C68871ABBF0BF85700F10892EE8988B355E7B5D858CF52

Function 001C4D60 Relevance: 43.9, APIs: 10, Strings: 15, Instructions: 184
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsW.SHLWAPI ref: 001C4D77
SHCreateDirectory.SHELL32 ref: 001C4D99
GetFullPathNameW.KERNEL32 ref: 001C4DC5
GetLastError.KERNEL32 ref: 001C4EA8
MessageBoxW.USER32 ref: 001C504F

Part of subcall function 001C24F0: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,001C4E02), ref: 001C2512

Part of subcall function 00210260: GetModuleFileNameW.KERNEL32 ref: 002102BC
Part of subcall function 00210260: memset.MSVCRT ref: 00210369
Part of subcall function 00210260: free.MSVCRT ref: 002103FB
Part of subcall function 00210260: free.MSVCRT ref: 0021040F
Part of subcall function 00210260: free.MSVCRT ref: 0021041D
Part of subcall function 00210260: _wremove.MSVCRT ref: 00210471

Part of subcall function 00210260: free.MSVCRT ref: 00210490
Part of subcall function 00210260: free.MSVCRT ref: 002104A4
Part of subcall function 00210260: free.MSVCRT ref: 002104B2
Part of subcall function 00210260: _wremove.MSVCRT ref: 0021051C
Part of subcall function 00210260: free.MSVCRT ref: 0021053B
Part of subcall function 00210260: free.MSVCRT ref: 00210549
Part of subcall function 00210260: free.MSVCRT ref: 00210557

ShellExecuteW.SHELL32 ref: 001C509B

Strings

InstallerThread: PathFileExists, xrefs: 001C4EE0
%ls, xrefs: 001C4DDA
InstallerThread: VerifyDiskSpace: GetArchiveDataSize, xrefs: 001C50D8
$, xrefs: 001C4FA4
Path exists, xrefs: 001C4FAC
open, xrefs: 001C508C
Overwrite?, xrefs: 001C4FB4
InstallerThread: swprintfInvalid path., xrefs: 001C5040
InstallerThread: GetFullPathName, xrefs: 001C4F08
InstallerThread: VerifyPath, xrefs: 001C4EB5, 001C4FE8
InstallerThread: VerifyDiskSpace: GetFreeDiskSpace, xrefs: 001C5010
regedit, xrefs: 001C5084
Error, xrefs: 001C5038
/s %ls, xrefs: 001C4E71
InstallerThread: VerifyDiskSpace, xrefs: 001C50B8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$FileNamePath_wremove$CreateDirectoryDiskErrorExecuteExistsFreeFullLastMessageModuleShellSpacememset
String ID: $$%ls$/s %ls$Error$InstallerThread: GetFullPathName$InstallerThread: PathFileExists$InstallerThread: VerifyDiskSpace$InstallerThread: VerifyDiskSpace: GetArchiveDataSize$InstallerThread: VerifyDiskSpace: GetFreeDiskSpace$InstallerThread: VerifyPath$InstallerThread: swprintfInvalid path.$Overwrite?$Path exists$open$regedit
API String ID: 399809809-3701533513
Opcode ID: f58acc2d8958f4292bee4e4d9453aab54cf88d42b0e47f7ed6e96e7c20a80aa3
Instruction ID: adab0050fcf353af7ba7478d26f9207a4ea8acea2401e8a0233d84617558a055
Opcode Fuzzy Hash: f58acc2d8958f4292bee4e4d9453aab54cf88d42b0e47f7ed6e96e7c20a80aa3
Instruction Fuzzy Hash: 1D81E3B410C700DFD704AF64D55872EBBF0AFA0315F42C92DE9C98A246D7B99498CB97

Function 001C5BEC Relevance: 26.3, APIs: 6, Strings: 9, Instructions: 75
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 001C5C08
MessageBoxW.USER32 ref: 001C5C3E
MessageBoxW.USER32 ref: 001C5C6B
MessageBoxW.USER32 ref: 001C5C98
ReleaseMutex.KERNEL32 ref: 001C5CAA
MessageBoxW.USER32 ref: 001C5CDF

Strings

Crack, xrefs: 001C5C27
$, xrefs: 001C5C79
Uninstaller, xrefs: 001C5C81
Error, xrefs: 001C5CC8
Shortcut, xrefs: 001C5C54
Create shortcut?, xrefs: 001C5C5C
Create uninstaller?, xrefs: 001C5C89
InstallFinishCallback: Installation failed. Please try again., xrefs: 001C5CD0
Apply crack?, xrefs: 001C5C2F

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Message$MutexObjectReleaseSingleWait
String ID: $$Apply crack?$Crack$Create shortcut?$Create uninstaller?$Error$InstallFinishCallback: Installation failed. Please try again.$Shortcut$Uninstaller
API String ID: 3319316258-707245824
Opcode ID: 149b61fd809fad5ba49d22bcde964e367c8d1c12a432ed51d725fc58f8369e2d
Instruction ID: 9ba7d8268450c2cad7a41ffbb458f80f01c2cbee1b032273db19f280766d0879
Opcode Fuzzy Hash: 149b61fd809fad5ba49d22bcde964e367c8d1c12a432ed51d725fc58f8369e2d
Instruction Fuzzy Hash: 0631F1B45097009FC700EF68D68865ABBE1BB94310F52C81EE8C88B365D3B8E484DF5A

Function 001C6930 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 64
synchronizationstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32 ref: 001C6984
WaitForSingleObject.KERNEL32 ref: 001C6998
strlen.MSVCRT ref: 001C69B1

Part of subcall function 001C24A0: GetTempPathW.KERNEL32 ref: 001C24B6
Part of subcall function 001C24A0: GetTempFileNameW.KERNEL32 ref: 001C24DD

Part of subcall function 001C2540: CreateFileW.KERNEL32 ref: 001C257C
Part of subcall function 001C2540: WriteFile.KERNEL32 ref: 001C25B1
Part of subcall function 001C2540: CloseHandle.KERNEL32 ref: 001C25BF

CreateMutexW.KERNEL32 ref: 001C69F8
exit.MSVCRT ref: 001C6A1E
exit.MSVCRT ref: 001C6A36
exit.MSVCRT ref: 001C6A4E

Strings

Init: WriteTempFile, xrefs: 001C6A23
Init: CreateMutex, xrefs: 001C6A0B
Init: WaitForSingleObject, xrefs: 001C6A3B
%ls%ls, xrefs: 001C6946

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CreateFileexit$MutexTemp$CloseHandleNameObjectPathSingleWaitWritestrlen
String ID: %ls%ls$Init: CreateMutex$Init: WaitForSingleObject$Init: WriteTempFile
API String ID: 3709684660-1587004996
Opcode ID: 0fac774342d32cb7b81d60e1bdb34a1b7fbb3c235efb15978164cfd508179384
Instruction ID: 634ac6005dc71d3f306dda61295fd14d2fb9a66bd83faec0e5b9e8ebc24be720
Opcode Fuzzy Hash: 0fac774342d32cb7b81d60e1bdb34a1b7fbb3c235efb15978164cfd508179384
Instruction Fuzzy Hash: 2021E7B05183019BD700BF65D58979EBBE0BF60354F42C82DE8C85B241DBB8D594CF92

Function 0024CA70 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0024CAA9
LoadCursorW.USER32 ref: 0024CAC1
GetModuleHandleW.KERNEL32 ref: 0024CADD
LoadImageW.USER32 ref: 0024CB13
RegisterClassExW.USER32 ref: 0024CB27
LoadImageW.USER32 ref: 0024CB8F

Strings

Win32: Failed to register window class, xrefs: 0024CB3A
GLFW30, xrefs: 0024CACE
GLFW_ICON, xrefs: 0024CB08
0, xrefs: 0024CA86
#, xrefs: 0024CA8E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Load$HandleImageModule$ClassCursorRegister
String ID: #$0$GLFW30$GLFW_ICON$Win32: Failed to register window class
API String ID: 1994909298-1599115447
Opcode ID: 1a39d3039f8d1949b5eb790aa7306c0d47d3c56fa45d4aa0720ad42ad4bd7276
Instruction ID: a312bd5a7baea2b223ac9ed7bd684f58236c98d68be8455cb78f9c26d283aa7a
Opcode Fuzzy Hash: 1a39d3039f8d1949b5eb790aa7306c0d47d3c56fa45d4aa0720ad42ad4bd7276
Instruction Fuzzy Hash: 8821F0B04193019FE780EF28D69831BBAF0EB84748F40892DE4C85B285D7B9D5588B97

Function 00248AD0 Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 00248C85

Strings

XInput Guitar, xrefs: 00248EB0
Xbox Controller, xrefs: 00248EDA
XInput Arcade Stick, xrefs: 00248E80
XInput Dance Pad, xrefs: 00248EA0
XInput Flight Stick, xrefs: 00248E90
XInput Wheel, xrefs: 00248CA1
Wireless Xbox Controller, xrefs: 00248ED5
Failed to enumerate DirectInput8 devices, xrefs: 00248E62
78696e707574%02x000000000000000000, xrefs: 00248C76
Unknown XInput Device, xrefs: 00248EF0
XInput Drum Kit, xrefs: 00248EC0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: sprintf
String ID: 78696e707574%02x000000000000000000$Failed to enumerate DirectInput8 devices$Unknown XInput Device$Wireless Xbox Controller$XInput Arcade Stick$XInput Dance Pad$XInput Drum Kit$XInput Flight Stick$XInput Guitar$XInput Wheel$Xbox Controller
API String ID: 590974362-4133938288
Opcode ID: 522f71128b411a35796e9c7edde16ae044ab073adb110b10cc18e4733766137e
Instruction ID: 23e03d13ef7c3ebfd7951028b18dcc736f1234fcb9992b59a5005823505d7647
Opcode Fuzzy Hash: 522f71128b411a35796e9c7edde16ae044ab073adb110b10cc18e4733766137e
Instruction Fuzzy Hash: 9B911979735202CBDB2C9F29E88063A73A4FB52748B14443FE945C7251DF70D868DB6A

Function 00247F60 Relevance: 18.1, APIs: 12, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnregisterDeviceNotification.USER32 ref: 00247F6F
DestroyWindow.USER32(?,?,?,?,?,?,0023F094,-00000004,00000001,0044EB60,0023F700,?,?,?,?,0139290C), ref: 00247F84
SystemParametersInfoW.USER32 ref: 00247FB2
free.MSVCRT ref: 00247FC3
free.MSVCRT ref: 00247FD0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,0023F094,-00000004,00000001,0044EB60,0023F700), ref: 00247FF0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,0023F094,-00000004,00000001,0044EB60,0023F700), ref: 00248005
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,0023F094,-00000004,00000001,0044EB60,0023F700), ref: 0024801A
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,0023F094,-00000004,00000001,0044EB60,0023F700), ref: 0024802F
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,0023F094,-00000004,00000001,0044EB60,0023F700), ref: 00248044
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,0023F094,-00000004,00000001,0044EB60,0023F700), ref: 00248059
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,0023F094,-00000004,00000001,0044EB60,0023F700), ref: 0024806E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: FreeLibrary$free$DestroyDeviceInfoNotificationParametersSystemUnregisterWindow
String ID:
API String ID: 1825173338-0
Opcode ID: 8184ef53c6d6bc164f7fc9e5d038d3e10332d94a6d94295a9d5783755da100c1
Instruction ID: 5dc150ef136417e8375d46c73e56ad64c2eb33cef2dcd2fbd9ce582c710143ea
Opcode Fuzzy Hash: 8184ef53c6d6bc164f7fc9e5d038d3e10332d94a6d94295a9d5783755da100c1
Instruction Fuzzy Hash: 6E31E9B5A247018FDB10BFB8E98961D7BF0AF01342F054939E885C7222EF74D458CB5A

Function 001C2680 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNEL32 ref: 001C26CC
FormatMessageW.KERNEL32 ref: 001C2717
LocalFree.KERNEL32 ref: 001C272B
malloc.MSVCRT ref: 001C273F
memcpy.MSVCRT ref: 001C2758
LocalFree.KERNEL32 ref: 001C2767
MessageBoxW.USER32 ref: 001C2787

Strings

Error, xrefs: 001C2778
%1%2, xrefs: 001C2708

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Message$FormatFreeLocal$mallocmemcpy
String ID: %1%2$Error
API String ID: 83372426-1004375922
Opcode ID: b4c6874506d11a3a29e24c4417b7493feaac23c159b13cbb0445c7d531985e47
Instruction ID: 20c22b7a94a1f15d2748ef43ed832b0dc751aefcc4e760c6a6706cb6c3c33c20
Opcode Fuzzy Hash: b4c6874506d11a3a29e24c4417b7493feaac23c159b13cbb0445c7d531985e47
Instruction Fuzzy Hash: F131C0B55083059FD300EF69D58975BBBE4AF88358F00892EE88897251E7B8D6488F97

Function 0032DDA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 0032DDB5

Strings

N2, xrefs: 003308C4
what(): , xrefs: 00330918

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc
String ID: what(): $N2
API String ID: 2803490479-1011025255
Opcode ID: a6edf11302ab5ace98815d098cd510e3b748efbc3f17bd77a85b28a3be136e42
Instruction ID: b30964f256a6d79c480cf6f0c5fd418e49f544fb3f9c1e2039d90ec1707adb89
Opcode Fuzzy Hash: a6edf11302ab5ace98815d098cd510e3b748efbc3f17bd77a85b28a3be136e42
Instruction Fuzzy Hash: 5011D7B45183219FD712BFB8D58672EBAE4AF84744F12881DE4C88F242DBB885809F53

Function 001E69A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32 ref: 001E69CF
MessageBoxW.USER32 ref: 001E69FC

Strings

select_path_thread: CoInitializeEx., xrefs: 001E69ED
A, xrefs: 001E69B8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: InitializeMessage
String ID: A$select_path_thread: CoInitializeEx.
API String ID: 2132078583-1076498671
Opcode ID: fb590c21e95d6d3a8d54b7b4d9e0887a77e37a667af9180cd1e5ae14de4ab541
Instruction ID: 3c4f17b9184acde33c1e6a71f11737ac56f7a78642ff37c65a639b34c1b52673
Opcode Fuzzy Hash: fb590c21e95d6d3a8d54b7b4d9e0887a77e37a667af9180cd1e5ae14de4ab541
Instruction Fuzzy Hash: 5F21F9B14087008FE314AF68D94C35EBFE0BF80346F41882DE48987216D774C498CB5B

Function 001C64F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 48
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathRemoveFileSpecA.SHLWAPI ref: 001C6520
free.MSVCRT ref: 001C6558
MessageBoxW.USER32 ref: 001C658D
exit.MSVCRT ref: 001C659D

Strings

,InitModulePath: astrtokn, xrefs: 001C6507
Error, xrefs: 001C6576, 001C65AA, 001C65C4
ModulePath: PathRemoveFileSpecA, xrefs: 001C65CC
ModulePath: swprintf, xrefs: 001C65B2

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: FileMessagePathRemoveSpecexitfree
String ID: ,InitModulePath: astrtokn$Error$ModulePath: PathRemoveFileSpecA$ModulePath: swprintf
API String ID: 424394031-685578126
Opcode ID: c24c4594aaed83fefdc0c68be373c62048a6e1f6d5d180ba449a8421ee405e59
Instruction ID: 3e088274abd9f7a8bc7d9149433edffbb01d049c1ed46889136252fa4d481098
Opcode Fuzzy Hash: c24c4594aaed83fefdc0c68be373c62048a6e1f6d5d180ba449a8421ee405e59
Instruction Fuzzy Hash: 4811B0B4509700AFD711AF65D64975EBAE0AF90384F12C81CE4C94B269D7B9C498DF83

Function 00276BD0 Relevance: 13.6, APIs: 9, Instructions: 103threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00276BFB
CreateEventA.KERNEL32 ref: 00276C23
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000004,774CDF20,002776AD), ref: 00276C65
GetCurrentThread.KERNEL32 ref: 00276C69
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000004,774CDF20,002776AD), ref: 00276C71
DuplicateHandle.KERNELBASE ref: 00276C9D
GetThreadPriority.KERNEL32 ref: 00276CB4
TlsSetValue.KERNEL32 ref: 00276CE0
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,00000004,774CDF20,002776AD), ref: 003329A6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Current$Thread$Process$CreateDuplicateEventHandlePriorityValueabort
String ID:
API String ID: 1404136710-0
Opcode ID: e6a357c7082ab704009b67f15966134dedd356121854a996969df6b48e967f64
Instruction ID: 955e70e79654ed9c19c8105f34ac7c2dc002c930c639b44e00cb0eb917dcb28a
Opcode Fuzzy Hash: e6a357c7082ab704009b67f15966134dedd356121854a996969df6b48e967f64
Instruction Fuzzy Hash: 91315AB15043018FD710AF79E98931ABFE4FB44315F00866EE8888B396E774C458CFA2

Function 0024D350 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

RemovePropW.USER32 ref: 0024D394
DestroyWindow.USER32(?,?,?,?,?,?,?,00246101,?,?,-00000004,0044EB60,0023EFEB,-00000004,00000001,0044EB60), ref: 0024D3A6
DestroyIcon.USER32(?,?,?,?,?,00246101,?,?,-00000004,0044EB60,0023EFEB,-00000004,00000001,0044EB60,0023F700), ref: 0024D3C6
DestroyIcon.USER32(?,?,?,?,?,00246101,?,?,-00000004,0044EB60,0023EFEB,-00000004,00000001,0044EB60,0023F700), ref: 0024D3DC

Strings

GLFW, xrefs: 0024D389

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Destroy$Icon$PropRemoveWindow
String ID: GLFW
API String ID: 1689334242-220981224
Opcode ID: 390d2a79478637cf8201f7b0379efeaca2916fb74d4d6b98477ff41e4e8e74fe
Instruction ID: 0d4492ae1fb89e83cd794effe9959937734f8e1c0289fc88fcbe4dddacbcedfe
Opcode Fuzzy Hash: 390d2a79478637cf8201f7b0379efeaca2916fb74d4d6b98477ff41e4e8e74fe
Instruction Fuzzy Hash: 7331D4B0614701CFDB14AF78DA8871A7BF4BB41705F44486DE8858B256DBB8D894CF53

Function 001C51C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 57threadCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 001C51D1
CreateThread.KERNEL32 ref: 001C5284

Strings

Install: swprintfInvalid path., xrefs: 001C52A8
%ls, xrefs: 001C51DE, 001C5209, 001C5233
Error, xrefs: 001C52A0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID: %ls$Error$Install: swprintfInvalid path.
API String ID: 3032276028-3208929446
Opcode ID: 74ccfe04676ee88b76cbb019b9564a31302f615d17e2f9571d726185db328076
Instruction ID: 02d162b3c7a34b28d6cf165a0331c9a79f40d11c067ac0ca14cd3b7c51e340f7
Opcode Fuzzy Hash: 74ccfe04676ee88b76cbb019b9564a31302f615d17e2f9571d726185db328076
Instruction Fuzzy Hash: A021DDB4409741ABD701EFA4D58875ABBF0AB91344F418C2EE9888B244E7B8D488CF52

Function 0024D429 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53windowthreadCOMMON

Download Yara Rule

APIs

RemovePropW.USER32 ref: 0024D394
DestroyWindow.USER32(?,?,?,?,?,?,?,00246101,?,?,-00000004,0044EB60,0023EFEB,-00000004,00000001,0044EB60), ref: 0024D3A6
DestroyIcon.USER32(?,?,?,?,?,00246101,?,?,-00000004,0044EB60,0023EFEB,-00000004,00000001,0044EB60,0023F700), ref: 0024D3C6
DestroyIcon.USER32(?,?,?,?,?,00246101,?,?,-00000004,0044EB60,0023EFEB,-00000004,00000001,0044EB60,0023F700), ref: 0024D3DC
SetThreadExecutionState.KERNEL32 ref: 0024D437

Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475D9
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475F5
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 00247611

SystemParametersInfoW.USER32 ref: 0024D485

Strings

GLFW, xrefs: 0024D389

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ConditionDestroyMask$Icon$ExecutionInfoParametersPropRemoveStateSystemThreadWindow
String ID: GLFW
API String ID: 1778296145-220981224
Opcode ID: e61f73d150b9e6d4b9259064165978b6e7f93cf363f2937598e720c6106779d3
Instruction ID: 4f30d86b6d4132e9128f276a09845dad453960aa0731957fde0d62389ace5fad
Opcode Fuzzy Hash: e61f73d150b9e6d4b9259064165978b6e7f93cf363f2937598e720c6106779d3
Instruction Fuzzy Hash: 2B2193B16157018FDB14AF74DA8931A7BE4AF41701F05487DEC898B246EB74D898CB52

Function 001C4D5B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81filewindowCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI ref: 001C4D77
SHCreateDirectory.SHELL32 ref: 001C4D99
GetFullPathNameW.KERNEL32 ref: 001C4DC5
GetLastError.KERNEL32 ref: 001C4EA8
MessageBoxW.USER32 ref: 001C504F

Part of subcall function 001C24F0: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,001C4E02), ref: 001C2512

Part of subcall function 00210260: GetModuleFileNameW.KERNEL32 ref: 002102BC
Part of subcall function 00210260: memset.MSVCRT ref: 00210369
Part of subcall function 00210260: free.MSVCRT ref: 002103FB
Part of subcall function 00210260: free.MSVCRT ref: 0021040F
Part of subcall function 00210260: free.MSVCRT ref: 0021041D
Part of subcall function 00210260: _wremove.MSVCRT ref: 00210471

Part of subcall function 00210260: free.MSVCRT ref: 00210490
Part of subcall function 00210260: free.MSVCRT ref: 002104A4
Part of subcall function 00210260: free.MSVCRT ref: 002104B2
Part of subcall function 00210260: _wremove.MSVCRT ref: 0021051C
Part of subcall function 00210260: free.MSVCRT ref: 0021053B
Part of subcall function 00210260: free.MSVCRT ref: 00210549
Part of subcall function 00210260: free.MSVCRT ref: 00210557

ShellExecuteW.SHELL32 ref: 001C509B

Strings

%ls, xrefs: 001C4DDA
/s %ls, xrefs: 001C4E71

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$FileNamePath_wremove$CreateDirectoryDiskErrorExecuteExistsFreeFullLastMessageModuleShellSpacememset
String ID: %ls$/s %ls
API String ID: 399809809-1073503050
Opcode ID: 4b0153cde11f1bbf8ffb46fb215132193cbf29732f60667e62abb2f5f9c1dcc4
Instruction ID: 6c54464c0c7ab397ac438f8876f6cbb4d716812df867081241393a8867b5c992
Opcode Fuzzy Hash: 4b0153cde11f1bbf8ffb46fb215132193cbf29732f60667e62abb2f5f9c1dcc4
Instruction Fuzzy Hash: 1E3125B05087009FD714AF25D99476FBBF0AFA0744F01882DF98887241D7B9E489CF96

Function 001C5CB8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16synchronizationwindowCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 001C5CAA
MessageBoxW.USER32 ref: 001C5CDF

Strings

Error, xrefs: 001C5CC8
InstallFinishCallback: Installation failed. Please try again., xrefs: 001C5CD0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: MessageMutexRelease
String ID: Error$InstallFinishCallback: Installation failed. Please try again.
API String ID: 408918528-3817216040
Opcode ID: 4b9496141a226d7156e19e3988955b90b0b09c898d196a7c7818a6828c442dc5
Instruction ID: 27cd0b6997b0e70a7966baea14a4d156001f52593b0316f6669051f44eb8e912
Opcode Fuzzy Hash: 4b9496141a226d7156e19e3988955b90b0b09c898d196a7c7818a6828c442dc5
Instruction Fuzzy Hash: 98E0B6F18097009FD704AF68DA4935ABBF0BB41302F42881DE99957225D7B49098DB47

Function 001E6A23 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

SHBrowseForFolderW.SHELL32 ref: 001E6A2F
SHGetPathFromIDListW.SHELL32 ref: 001E6A49
CoTaskMemFree.OLE32 ref: 001E6A62
CoUninitialize.COMBASE ref: 001E6A6B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: BrowseFolderFreeFromListPathTaskUninitialize
String ID:
API String ID: 4093211858-0
Opcode ID: d16634dbe93d8792f1096f9b44bbb16fb03708ff42de89bb03f26b4de018881e
Instruction ID: e1ff531352cea8aaabcbea3b07f372eb90c77774805aa5d1a031696b0f8c727f
Opcode Fuzzy Hash: d16634dbe93d8792f1096f9b44bbb16fb03708ff42de89bb03f26b4de018881e
Instruction Fuzzy Hash: 3CF0DA714087018FD351AF78AA4C05DBBE0BF45342F414839E88693212DB30D558CB56

Function 0024CBA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00247F92,?,?,?,?,?,?,0023F094,-00000004,00000001), ref: 0024CBAA
UnregisterClassW.USER32 ref: 0024CBBE

Strings

GLFW30, xrefs: 0024CBB7

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ClassHandleModuleUnregister
String ID: GLFW30
API String ID: 2811962237-1000490103
Opcode ID: 339a5d11b98be8ee98ad8928dcbca988f4fa1625183e231ed21e71220418d09a
Instruction ID: ed2052ce76fab51e1fd54166064105b54d5e15c2c0b56dd1142bee709a82370e
Opcode Fuzzy Hash: 339a5d11b98be8ee98ad8928dcbca988f4fa1625183e231ed21e71220418d09a
Instruction Fuzzy Hash: A9C0C9F18042008FC700BFACD60A3197EF0BB01302F81456DD4C942115E7B482588B67

Function 001C1284 Relevance: 5.1, APIs: 4, Instructions: 89stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001C12FB
strlen.MSVCRT ref: 001C132B
malloc.MSVCRT ref: 001C1336
memcpy.MSVCRT ref: 001C134C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: b340eae4bddba69cf80cfaea35736dc8d992181f0efdea58967ae92123e095cc
Instruction ID: 38e2e637bd13bb995704554767b5bc28e28bd20f06c97e276f4186afe055db72
Opcode Fuzzy Hash: b340eae4bddba69cf80cfaea35736dc8d992181f0efdea58967ae92123e095cc
Instruction Fuzzy Hash: A03166B5A047059FDB10DFA4E981BA9BBE2FB8A300F25852DD9449B312E735D904CF85

Function 001C12A6 Relevance: 5.1, APIs: 4, Instructions: 79stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001C12FB
strlen.MSVCRT ref: 001C132B
malloc.MSVCRT ref: 001C1336
memcpy.MSVCRT ref: 001C134C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: f36ffae7bfb8acf38b417a4a680b211b3b0f87ff4474ba7c8c9c00cc6d444e15
Instruction ID: 372619b7528b208b32b6e716983dd6a7aa64847947d7cc1bc4c3bbdde5dbe54c
Opcode Fuzzy Hash: f36ffae7bfb8acf38b417a4a680b211b3b0f87ff4474ba7c8c9c00cc6d444e15
Instruction Fuzzy Hash: 9C3112B5A00B15DFCB10DFA4E980B99BBF1BB89300F25852ED9489B312E734E915CF85

Function 001C13C3 Relevance: 5.1, APIs: 4, Instructions: 65stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001C12FB
strlen.MSVCRT ref: 001C132B
malloc.MSVCRT ref: 001C1336
memcpy.MSVCRT ref: 001C134C
_cexit.MSVCRT ref: 001C1458
exit.MSVCRT ref: 001C149E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$_cexitexitmemcpystrlen
String ID:
API String ID: 825743840-0
Opcode ID: 0255359e8a09d4949fab560796efcc3ed9be87e1c6569cd6f786d6e2ff02a213
Instruction ID: 906f011e61f7ef5fd4dd27d7144f205036ed5055be72aa4a86709062c5170542
Opcode Fuzzy Hash: 0255359e8a09d4949fab560796efcc3ed9be87e1c6569cd6f786d6e2ff02a213
Instruction Fuzzy Hash: EE21E2B5A04705DFCB15EFA8E980A9DBBF1BB89300F21852ED94897311E734A911CF85

Function 0024B20C Relevance: 4.6, APIs: 3, Instructions: 92keyboardCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 0024B0DF
ShowWindow.USER32 ref: 0024B13E
free.MSVCRT ref: 0024B2C3
calloc.MSVCRT ref: 0024B2D7
GetKeyState.USER32 ref: 0024B81B
GetKeyState.USER32 ref: 0024B82D
GetKeyState.USER32 ref: 0024B844
GetKeyState.USER32 ref: 0024B85B
GetKeyState.USER32 ref: 0024B86C
GetKeyState.USER32 ref: 0024B888
GetKeyState.USER32 ref: 0024B89E
GetKeyState.USER32 ref: 0024B927
GetKeyState.USER32 ref: 0024B93D
GetKeyState.USER32 ref: 0024B95C
GetKeyState.USER32 ref: 0024B97B
GetKeyState.USER32 ref: 0024B98C
GetKeyState.USER32 ref: 0024B9B6
GetKeyState.USER32 ref: 0024B9D4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: State$Window$ProcShowcallocfree
String ID:
API String ID: 4245685813-0
Opcode ID: 1b6ad9156f31728757bb8a16cb8a7d934afa61f2a488a8b88eb79534c69681b2
Instruction ID: f8cb11e8c9cb6f760ee2faae3750b86e319e1b9f021c06fbf38f9e3b966ab9c2
Opcode Fuzzy Hash: 1b6ad9156f31728757bb8a16cb8a7d934afa61f2a488a8b88eb79534c69681b2
Instruction Fuzzy Hash: ED41FDB4A187409FD754DF29C484A5EFBE0FF88311F118A2EE89983261D375E9958F42

Function 001C2540 Relevance: 4.5, APIs: 3, Instructions: 38fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 001C257C
WriteFile.KERNEL32 ref: 001C25B1
CloseHandle.KERNEL32 ref: 001C25BF

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 51410327847cf35e6f2d6494e0d83e3748bed16020f82a685c88cae407822f44
Instruction ID: 98b1e7f4f596aa48215149039ed8cb468e51d52d92241572505f22a4fbafb32b
Opcode Fuzzy Hash: 51410327847cf35e6f2d6494e0d83e3748bed16020f82a685c88cae407822f44
Instruction Fuzzy Hash: EE0175B05093019FD700EF38D58970BBBF0BB89354F058E2DE89987295E3B9D959CB82

Function 00248F00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,00000001,00247ECC), ref: 00248F1A

Strings

Win32: Failed to create interface, xrefs: 00248F65

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: HandleModule
String ID: Win32: Failed to create interface
API String ID: 4139908857-3250580677
Opcode ID: e07d0c5c21b0ca096b2526909e0c0f6b4624b4f4c6a7ccd0bfe57c7836d1080e
Instruction ID: f72e21e3902f60b5864168b2f2ccba3cc7c42efea50addcaa1654f8166332c2a
Opcode Fuzzy Hash: e07d0c5c21b0ca096b2526909e0c0f6b4624b4f4c6a7ccd0bfe57c7836d1080e
Instruction Fuzzy Hash: BBF09AB44383018FD304BF24E98831F7BE0EB41344F90891DE8C556241EBB4D4A8CB56

Function 001ED590 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 001ED600

Strings

0y(, xrefs: 001ED59E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Uninitialize
String ID: 0y(
API String ID: 3861434553-274880199
Opcode ID: 571196308e5e71bf21d8b95b563b873d3e6c03ce779e1c7e50f333a655a091a1
Instruction ID: 0cbb61c127cd4874efeccdea6c64acd741e916677f6785da981e9e9468f28765
Opcode Fuzzy Hash: 571196308e5e71bf21d8b95b563b873d3e6c03ce779e1c7e50f333a655a091a1
Instruction Fuzzy Hash: 5EF037B45087808FE320AF35E94A30A7BF1BB58304F0492A8D88587361E7B5C848DF46

Function 001E6B10 Relevance: 3.0, APIs: 2, Instructions: 21threadCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 001E6B21
CreateThread.KERNEL32 ref: 001E6B55

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID:
API String ID: 3032276028-0
Opcode ID: 6806997782424addc343983690396a18668c4d308a8c3a7d20d7c2340d2acca6
Instruction ID: 95e6bbf3d05d709e8c171c8372a9fe5af5d1e7e42f082a1a2b6b8231a3273085
Opcode Fuzzy Hash: 6806997782424addc343983690396a18668c4d308a8c3a7d20d7c2340d2acca6
Instruction Fuzzy Hash: 04F0C2B05093419FDB00AFA9DA8830EBFF0BB85345F80892CE4848B245E7B984588B93

Function 001C24A0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32 ref: 001C24B6
GetTempFileNameW.KERNEL32 ref: 001C24DD

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Temp$FileNamePath
String ID:
API String ID: 3285503233-0
Opcode ID: cb03ea1e5a039e5688f44b88d7d3695d866318707755384fe940b0c0d6a04c87
Instruction ID: bce0e49c58b916ac5a8c07483f243b6d3499f666ad3bc21dfbf9d7e4e8138317
Opcode Fuzzy Hash: cb03ea1e5a039e5688f44b88d7d3695d866318707755384fe940b0c0d6a04c87
Instruction Fuzzy Hash: E6E0EEF080A3009FD340AF68EA8921EBFE0AB84301F40892DE4C842245E7B880988B63

Function 0020FEE8 Relevance: 2.6, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0033053C

Part of subcall function 0032DE40: malloc.MSVCRT ref: 0032DE4E

malloc.MSVCRT ref: 00330638

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: bfa1af78457b61294abf6c57c039b481a474ea30747c3ec5451fcfb03ecba547
Instruction ID: a07732e4134387838f5133d7bf67cc06ebc201fe37d85dc8abe79fb3443b124b
Opcode Fuzzy Hash: bfa1af78457b61294abf6c57c039b481a474ea30747c3ec5451fcfb03ecba547
Instruction Fuzzy Hash: FE21F8B441A7118BC3127F60E59622EBAE0EF52749F429C1CE5C94F352DB7884948F9B

Function 001C19A0 Relevance: 2.5, APIs: 2, Instructions: 49COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001C19E1
memcpy.MSVCRT(?,?,?,00000004,00000000,00000000,001C1A79,00000000,00000000,?,001C1B52), ref: 001C19FB

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: mallocmemcpy
String ID:
API String ID: 4276657696-0
Opcode ID: 2c6d32170590453c7e6d4b77db946e731c4b023d156cd9effd5de32d41398a33
Instruction ID: 853acba893bfe184b44ef613d45e3f373a2366be2e289711b1b7a39f798eda03
Opcode Fuzzy Hash: 2c6d32170590453c7e6d4b77db946e731c4b023d156cd9effd5de32d41398a33
Instruction Fuzzy Hash: 27015A75A19300AFD720AF6DD480E1ABBE4EF8A314F95486EF988C7712D732D8108B51

Function 001C1B80 Relevance: 2.5, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001C1BA3

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2863a3e224c5b6115fbf4b9e6e11e3bb53a95180e91cd43dcd39bb14a1d2147c
Instruction ID: 7ee5cb25db05eb4bcde33a62429c5a040b866ace7c30980c2ba94ea69e4aa264
Opcode Fuzzy Hash: 2863a3e224c5b6115fbf4b9e6e11e3bb53a95180e91cd43dcd39bb14a1d2147c
Instruction Fuzzy Hash: 77F03475A443009BCB20EF68E8C1A9AB3E0BF19354F05496CE88997702E331FD509F91

Function 001C19D4 Relevance: 2.5, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001C19E1
memcpy.MSVCRT(?,?,?,00000004,00000000,00000000,001C1A79,00000000,00000000,?,001C1B52), ref: 001C19FB

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: mallocmemcpy
String ID:
API String ID: 4276657696-0
Opcode ID: 223c1bd6b89e647c58ff400f4fe48360ef4aaaf5a48989e2acd574cb12cf458d
Instruction ID: 3d457fdc22419583a9949f9a195b7337e80a92410eb59a94aad4dcf926cf7769
Opcode Fuzzy Hash: 223c1bd6b89e647c58ff400f4fe48360ef4aaaf5a48989e2acd574cb12cf458d
Instruction Fuzzy Hash: 14F09275A19741AFC710AFADD48080ABBE0BF89350F56482EE98897311DA31E8118B42

Function 001C1F20 Relevance: 2.5, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001C1F2C
memcpy.MSVCRT ref: 001C1F46

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: mallocmemcpy
String ID:
API String ID: 4276657696-0
Opcode ID: ad6066a9917df3bdf3fb9e12f9afcffb5a16baba10dd29cefa5dbbfc7e9ba223
Instruction ID: 989331ef45f5cc21f7b6ede20e144a1d1595d2847333f8a4a4b86200bab592d9
Opcode Fuzzy Hash: ad6066a9917df3bdf3fb9e12f9afcffb5a16baba10dd29cefa5dbbfc7e9ba223
Instruction Fuzzy Hash: E3E0ECB19197115BCB00FF29998140ABAE4BF59654F42496DF888A7302D730D9508B92

Function 0024BC2C Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00247650: VerSetConditionMask.KERNEL32 ref: 002476A6
Part of subcall function 00247650: VerSetConditionMask.KERNEL32 ref: 002476C2
Part of subcall function 00247650: VerSetConditionMask.KERNEL32 ref: 002476DE

DefWindowProcW.USER32 ref: 0024B0DF
SetWindowPos.USER32 ref: 0024C50C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ConditionMask$Window$Proc
String ID:
API String ID: 2534664883-0
Opcode ID: 62ab209caebcc1a5ee57053681bc17279f0c7bc05ccbbf9e97402af66e84cfbd
Instruction ID: 114381a38fe4505d2b912f5fbc2a6018f6419c1428278c0c7b84746833bf83cc
Opcode Fuzzy Hash: 62ab209caebcc1a5ee57053681bc17279f0c7bc05ccbbf9e97402af66e84cfbd
Instruction Fuzzy Hash: AC010272A19300EFC360AF29D18466ABBF4FF84301F518C1DE8D992251E73488608F43

Function 0024B15C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 0024B0DF
ShowWindow.USER32 ref: 0024B13E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Window$ProcShow
String ID:
API String ID: 2377915770-0
Opcode ID: 59c774923a0e817e5fb2b66acb0a95b4490ea0f5da54dcacc7ed879a308ffac6
Instruction ID: cad91f388a8fdb903549a686ee9fcf0555486c55ff035d9e80aa883710302f82
Opcode Fuzzy Hash: 59c774923a0e817e5fb2b66acb0a95b4490ea0f5da54dcacc7ed879a308ffac6
Instruction Fuzzy Hash: 01F04931B14701CAD7399F29D48876AB7E0FB80312F00882ED4A983250D335E8548B12

Function 0024B1B7 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 0024B0DF
ShowWindow.USER32 ref: 0024B13E

Part of subcall function 00248F90: free.MSVCRT ref: 00249063

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Window$ProcShowfree
String ID:
API String ID: 2251009850-0
Opcode ID: 2d47557e6da5f895238a7557a16ece7b086fbc0a37c32f810dc71398236c1359
Instruction ID: b32266cde3a1ed33731f3b31531fd92535b7fe5cbffaf81e4ae6da95c62d1665
Opcode Fuzzy Hash: 2d47557e6da5f895238a7557a16ece7b086fbc0a37c32f810dc71398236c1359
Instruction Fuzzy Hash: 1FF0E231718301DED7689F28D0447AAB7F0BF81312F01C82EE4D883650DB7598A8CB53

Function 0024BFF7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 0024B0DF
ShowWindow.USER32 ref: 0024B13E

Part of subcall function 0024AE20: ClipCursor.USER32 ref: 0024AE4A
Part of subcall function 0024AE20: ClientToScreen.USER32 ref: 0024AEB1
Part of subcall function 0024AE20: SetCursorPos.USER32 ref: 0024AEC9
Part of subcall function 0024AE20: SetCursor.USER32 ref: 0024AEEC

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Cursor$Window$ClientClipProcScreenShow
String ID:
API String ID: 3400033131-0
Opcode ID: 2ad127a957a871e00f4317e1229455fedef900c8a92f22fe6f8b0e1dc02a8d84
Instruction ID: 9f155686faa37e7bd69c228d7f310152ad75c9d48a10d7da93bae2bad69da48f
Opcode Fuzzy Hash: 2ad127a957a871e00f4317e1229455fedef900c8a92f22fe6f8b0e1dc02a8d84
Instruction Fuzzy Hash: 75E03972B043008FD729AF28E44436AF7F0FF80322F00892AE49987240D7799968CB83

Function 0024B099 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 0024B0DF
ShowWindow.USER32 ref: 0024B13E

Part of subcall function 00249900: calloc.MSVCRT ref: 00249927
Part of subcall function 00249900: memcpy.MSVCRT ref: 00249949
Part of subcall function 00249900: EnumDisplayDevicesW.USER32 ref: 00249994
Part of subcall function 00249900: EnumDisplayDevicesW.USER32 ref: 002499FC
Part of subcall function 00249900: wcscmp.MSVCRT ref: 00249A3A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: DevicesDisplayEnumWindow$ProcShowcallocmemcpywcscmp
String ID:
API String ID: 4108177171-0
Opcode ID: 087d383a31cc10a00e8ce1e35b51a440b55511233b39d81f4f7efe4bf9808e66
Instruction ID: 658ca30e2c24c65da24bc7c7d2b142f07646ceab7f00716cad26387b49946663
Opcode Fuzzy Hash: 087d383a31cc10a00e8ce1e35b51a440b55511233b39d81f4f7efe4bf9808e66
Instruction Fuzzy Hash: 39E0ED759043059ED728AF68D08476EB7E0EF50312F10882EE4DC83251D73994A48B52

Function 0024C36C Relevance: 1.5, APIs: 1, Instructions: 20keyboardCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 0024B0DF
GetKeyState.USER32 ref: 0024B81B
GetKeyState.USER32 ref: 0024B82D
GetKeyState.USER32 ref: 0024B844
GetKeyState.USER32 ref: 0024B85B
GetKeyState.USER32 ref: 0024B86C
GetKeyState.USER32 ref: 0024B888
GetKeyState.USER32 ref: 0024B89E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: State$ProcWindow
String ID:
API String ID: 2239742768-0
Opcode ID: 5031e2d661f8bf14c7e162f7f4366eb0867554c626d4096f11b6777ad892444d
Instruction ID: 3624c31ce9923f1ecc5efdb13369d5568391e8490394f43cd4c71890ab827cde
Opcode Fuzzy Hash: 5031e2d661f8bf14c7e162f7f4366eb0867554c626d4096f11b6777ad892444d
Instruction Fuzzy Hash: CEE01A72A183008FD3259F59E48866AF7F0FB84311F50882FE8D983651E77994A48B17

Function 0024BA77 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

Part of subcall function 002473A0: WideCharToMultiByte.KERNEL32 ref: 00247432
Part of subcall function 002473A0: MapVirtualKeyW.USER32 ref: 0024746C
Part of subcall function 002473A0: ToUnicode.USER32 ref: 0024749E
Part of subcall function 002473A0: ToUnicode.USER32 ref: 002474D3

DefWindowProcW.USER32 ref: 0024B0DF

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Unicode$ByteCharMultiProcVirtualWideWindow
String ID:
API String ID: 3587877768-0
Opcode ID: f08aeeb5a78fb91d493025eb995f63837e68e8023e199bfb783d49164a713adc
Instruction ID: 5eaddbbc8fd99125820e945af783b11f2089e25b1f0cd225641102aeb1fef9d7
Opcode Fuzzy Hash: f08aeeb5a78fb91d493025eb995f63837e68e8023e199bfb783d49164a713adc
Instruction Fuzzy Hash: 1CE01272A083009FD324AF28E44075AFBE0FF80322F00892AE89883201E73494289B82

Function 001C5100 Relevance: 1.5, APIs: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?,?,?,?,?,001C71ED), ref: 001C5136

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 7e7aba2ec1403b9bc40075787bd0a5b94fc794dd2b7409bbaacbca98db1ef898
Instruction ID: 9930b20c3f8ba993c0b3357da3c26d01f0bf9a4bcde993fdba930923efc2bce9
Opcode Fuzzy Hash: 7e7aba2ec1403b9bc40075787bd0a5b94fc794dd2b7409bbaacbca98db1ef898
Instruction Fuzzy Hash: ACE0B6B04053008FD700AF68C69830A7FF0BB88305F4485ADE8884F346D3BA84548F96

Function 0024A770 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?,?,?,?,00000000,0023F0D7,-00000004,00000001,0044EB60,0023F700,?,?,?,?,0139290C,001C7311), ref: 0024A784

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 78c2532096b9202e6fa53ed971df674b1394079a6772333400f07b0740789ac2
Instruction ID: 985f13c0c61f08bea6bbaf8ff04d7897143891fd9b202fd5a56eb133b60c5843
Opcode Fuzzy Hash: 78c2532096b9202e6fa53ed971df674b1394079a6772333400f07b0740789ac2
Instruction Fuzzy Hash: 82D067B55002448BDB10AF68DAC97197BF4BB05305F448598D8458F34AE775D8148B92

Function 00250B50 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,?,00247FDA), ref: 00250B5F

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 0f58149fc94f4e8497deffca0a7cb8bbb71613da082478167e3ace467bd43298
Instruction ID: 4496899e0ca44326e65e9a4051b5322187e7053106bc8043fd274906ec036787
Opcode Fuzzy Hash: 0f58149fc94f4e8497deffca0a7cb8bbb71613da082478167e3ace467bd43298
Instruction Fuzzy Hash: D1C08CF29002008BCB007F7CA9896183BA0BA00302F8905B8CC0082012FA30D22C866B

Function 00284150 Relevance: 1.4, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00330638

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 865da496a32c0d936a4ac3c81cea354c12ddad346f6b43016498e3beafc7b5b7
Instruction ID: 95c63af6932bebd8ee76f064bf4be9e7df1de08c998cb23fa64e494276e46bd4
Opcode Fuzzy Hash: 865da496a32c0d936a4ac3c81cea354c12ddad346f6b43016498e3beafc7b5b7
Instruction Fuzzy Hash: 7C5191B8A193028FD715FF64E48462ABBE0FF95304F05895DE8888F765E7709894CF92

Function 00284250 Relevance: 1.3, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00330638

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 50acd2fb010fe8d4c2b84514cdadb0a643eb2c9abb926ca0f6f3912b182815b4
Instruction ID: c8e4207dd290265636818a232149e5b074579414a6323bb3ca0ac52279557f94
Opcode Fuzzy Hash: 50acd2fb010fe8d4c2b84514cdadb0a643eb2c9abb926ca0f6f3912b182815b4
Instruction Fuzzy Hash: 3C31F2B46193028FD711BF64D88061ABBE0FF59344F45896CD9888B356E77484948F92

Function 00210DE3 Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 0032DE40: malloc.MSVCRT ref: 0032DE4E

malloc.MSVCRT ref: 00330638

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f9ab24f192edd79ce3ea07eade3b78986314e03939d49864827d1bf53f1ce981
Instruction ID: 3c3ed4eae9af1a774b76c665960ae2377b7688973f33e4bae8f87100b46991f8
Opcode Fuzzy Hash: f9ab24f192edd79ce3ea07eade3b78986314e03939d49864827d1bf53f1ce981
Instruction Fuzzy Hash: D521F4F441A7118EC3027F60E59622EBAE0EF52749F429C2CE1C94F652DB7880948F9B

Function 00210DEA Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0032DE40: malloc.MSVCRT ref: 0032DE4E

malloc.MSVCRT ref: 00330638

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: d43de5a8da00e8f38dd807cd5bb60936b0ee8fc76a35b4bd2a2ca8944df7caca
Instruction ID: 113bcfb8e222a40c85626169dd2a9796e937e0fe5ce34b8b3c9ee5f237fcd7f9
Opcode Fuzzy Hash: d43de5a8da00e8f38dd807cd5bb60936b0ee8fc76a35b4bd2a2ca8944df7caca
Instruction Fuzzy Hash: CE1134F481A3018EC3027F60E59622EBAE0FF52348F469C1CE1C94F252DB7880948F9B

Non-executed Functions

Function 0023720D Relevance: 46.3, APIs: 25, Strings: 1, Instructions: 824COMMON

Download Yara Rule

APIs

Part of subcall function 00215731: EnterCriticalSection.KERNEL32(00357D30,0023BDFF,?,00000000,00000000,?,?,0023C461,0023C74F,00000003,00000010,0023C74F,00000010,BASS/2.4,00000000), ref: 00215736

ceil.MSVCRT ref: 0023732A
ceil.MSVCRT ref: 00237377
ceil.MSVCRT ref: 002373BD
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 002373D3

Part of subcall function 0021573D: LeaveCriticalSection.KERNEL32(00357D30,0023BE3D,?,00000000,00000000,?,?,0023C461,0023C74F,00000003,00000010,0023C74F,00000010,BASS/2.4,00000000), ref: 00215742

Strings

\\.\sysaudio, xrefs: 002376FA

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ceil$CriticalSection$CreateEnterEventLeave
String ID: \\.\sysaudio
API String ID: 217412056-4248085100
Opcode ID: 2861e557f4fe3598e371ee5e2d6fd02bc3b5d9274205084b4dd0ab9cfa55c835
Instruction ID: 582352de8e3198786b32f70b5b64821acc7cb8da0585106bce5b875291148ef0
Opcode Fuzzy Hash: 2861e557f4fe3598e371ee5e2d6fd02bc3b5d9274205084b4dd0ab9cfa55c835
Instruction Fuzzy Hash: E6627AF1624346DBDF259F64C889BA93BB8FF44700F20416AFD159A2A2EB70D865CF50

Function 0025EB70 Relevance: 36.5, APIs: 24, Instructions: 459stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0025EBE7

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 297957ce782c12b8fad21ce20c28c3f28672284d5cd33f8459a4e3a954a50c4a
Instruction ID: 008e2fb1e3eb3692c329b774c35fa3f1f1225ab01fa40a33b6e1794d97e0e705
Opcode Fuzzy Hash: 297957ce782c12b8fad21ce20c28c3f28672284d5cd33f8459a4e3a954a50c4a
Instruction Fuzzy Hash: 960238B15283428FDF18CF28C480365BBE2AF45315F0E86AEDC994B386C7759A5DCB46

Function 00242600 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 92clipboardmemoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0024FD8C
GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0024FDB0
GlobalLock.KERNEL32 ref: 0024FDC6
MultiByteToWideChar.KERNEL32 ref: 0024FDF6
GlobalUnlock.KERNEL32 ref: 0024FDFE
OpenClipboard.USER32 ref: 0024FE0F
EmptyClipboard.USER32 ref: 0024FE1C
SetClipboardData.USER32 ref: 0024FE2D

Strings

Win32: Failed to allocate global handle for clipboard, xrefs: 0024FE70
Win32: Failed to open clipboard, xrefs: 0024FE90
Win32: Failed to lock global handle, xrefs: 0024FE43

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ClipboardGlobal$ByteCharMultiWide$AllocDataEmptyLockOpenUnlock
String ID: Win32: Failed to allocate global handle for clipboard$Win32: Failed to lock global handle$Win32: Failed to open clipboard
API String ID: 1314454821-415499367
Opcode ID: 20276cac415918325ee1d7c6ab3bb3c59f74f334be16c7315d5d6de37bea70f6
Instruction ID: f5b743f4d4d3be76f9ccb8a903d909c2ebc3e224f554dabe9e2d5744c96df33d
Opcode Fuzzy Hash: 20276cac415918325ee1d7c6ab3bb3c59f74f334be16c7315d5d6de37bea70f6
Instruction Fuzzy Hash: B0310AB59193019FD300AF69EA4831ABBE0FB85351F00893EE8C986261D7B58498DB93

Function 00242640 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 64clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0024FEAD
GetClipboardData.USER32 ref: 0024FEC1
GlobalLock.KERNEL32 ref: 0024FED3
free.MSVCRT ref: 0024FEEA

Part of subcall function 002472B0: WideCharToMultiByte.KERNEL32 ref: 002472FC
Part of subcall function 002472B0: calloc.MSVCRT ref: 00247312
Part of subcall function 002472B0: WideCharToMultiByte.KERNEL32 ref: 0024734C

GlobalUnlock.KERNEL32 ref: 0024FEFF
CloseClipboard.USER32 ref: 0024FF08
CloseClipboard.USER32 ref: 0024FF54
CloseClipboard.USER32 ref: 0024FF74

Strings

Win32: Failed to open clipboard, xrefs: 0024FF20
Win32: Failed to lock global handle, xrefs: 0024FF60
Win32: Failed to convert clipboard to string, xrefs: 0024FF40

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Clipboard$Close$ByteCharGlobalMultiWide$DataLockOpenUnlockcallocfree
String ID: Win32: Failed to convert clipboard to string$Win32: Failed to lock global handle$Win32: Failed to open clipboard
API String ID: 1311553417-1912854309
Opcode ID: 04f167532f9911ef5d69304d758e6a7c9e43fe127739de89c41951541e65603c
Instruction ID: 9eb4e144bfe6b3855db1e343e617df2a9e98f0d4e1a6cff907c8c6a3e1c44628
Opcode Fuzzy Hash: 04f167532f9911ef5d69304d758e6a7c9e43fe127739de89c41951541e65603c
Instruction Fuzzy Hash: 3D214FB45293018FD7417F78EA0921E7AF0AF46341F464839F8C9C7256DBB4C4988BA7

Function 002468C0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

Invalid window attribute 0x%08X, xrefs: 00246AD4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: Invalid window attribute 0x%08X
API String ID: 0-4208774108
Opcode ID: 4854ac6bceb43022c4550582d4b770341833a148c76317b2cb43c819af25ff56
Instruction ID: 33f26f738fb9b17bac02e75c9306ef10e35a6b0ee84a0043fd8d2f9111311ff6
Opcode Fuzzy Hash: 4854ac6bceb43022c4550582d4b770341833a148c76317b2cb43c819af25ff56
Instruction Fuzzy Hash: 418175706346128BD71CEF68D68D669B7F0FB45304F154979E88ACB312E2B4D9A4CB83

Function 00284340 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 191COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 002843DF
exit.MSVCRT ref: 00284437
malloc.MSVCRT ref: 002843F5

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

malloc.MSVCRT ref: 00284484
malloc.MSVCRT ref: 0028449A
exit.MSVCRT ref: 002844DC
longjmp.MSVCRT ref: 0028451F

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 00284628
ERROR: archive structure corrupted (bad data), xrefs: 00284404, 002844A9
%s, xrefs: 00284424, 002844C9

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exit$Charfreelongjmp
String ID: %s$ERROR: archive structure corrupted (bad data)$ERROR: can't alloc %lu memory bytes
API String ID: 2693856100-1639016738
Opcode ID: ffac1bc9eaf307eafdbdbd19f8f7172ecd2283fc2266ed6a8acb5daebd099507
Instruction ID: 1feb88f63b22541d9f45841633f37582b328c597969543a70f28195bc045530a
Opcode Fuzzy Hash: ffac1bc9eaf307eafdbdbd19f8f7172ecd2283fc2266ed6a8acb5daebd099507
Instruction Fuzzy Hash: 7D6107B6A296168BD710BF28D84231EB6D1EF41304F56843DE49C8B385EB7CD8658B93

Function 001F2951 Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0032FC2B
free.MSVCRT ref: 0032FC37
free.MSVCRT ref: 0032FC43
free.MSVCRT ref: 0032FC4F
free.MSVCRT ref: 0032FC5B

Part of subcall function 001F1190: malloc.MSVCRT ref: 001F11B5
Part of subcall function 001F1190: malloc.MSVCRT ref: 001F11CB
Part of subcall function 001F1190: exit.MSVCRT ref: 001F1209

Strings

^, xrefs: 0032FC73

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$malloc$exit
String ID: ^
API String ID: 3267382430-1590793086
Opcode ID: 50b023579718e6dc7a7458d052d873712f7dae111a1017cf282b754256a72a33
Instruction ID: 7b23f9370c13faf756e9ec721a5e21e641ed609e4ede21d9094f4bae5cb7c660
Opcode Fuzzy Hash: 50b023579718e6dc7a7458d052d873712f7dae111a1017cf282b754256a72a33
Instruction Fuzzy Hash: 70F03FB49197049BC710BF74D18646DBAE0AF45700F815C2CE9C5AB302D738AAA19F97

Function 001F2FF9 Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0032FC2B
free.MSVCRT ref: 0032FC37
free.MSVCRT ref: 0032FC43
free.MSVCRT ref: 0032FC4F
free.MSVCRT ref: 0032FC5B

Part of subcall function 001F1190: malloc.MSVCRT ref: 001F11B5
Part of subcall function 001F1190: malloc.MSVCRT ref: 001F11CB
Part of subcall function 001F1190: exit.MSVCRT ref: 001F1209

Strings

^, xrefs: 0032FC73

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$malloc$exit
String ID: ^
API String ID: 3267382430-1590793086
Opcode ID: 2b22f8c4daf03ea6f2fa7924fcff247b64ac934be604f51fd165028543e58f3c
Instruction ID: 6e473ccd630704118c9c50ede39a641ed2e44fa7917cc0629bde1d10906c2ad9
Opcode Fuzzy Hash: 2b22f8c4daf03ea6f2fa7924fcff247b64ac934be604f51fd165028543e58f3c
Instruction Fuzzy Hash: 0DF06CB4919704ABC710BF74818646DBAF0AF4A700F815C2CF9C9A7302E734EA919F46

Function 0022F31B Relevance: 7.8, APIs: 5, Instructions: 295COMMON

Download Yara Rule

APIs

acmStreamConvert.MSACM32(00000000,?,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 0022F427
memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0022F44D
memcpy.MSVCRT(?,?,00000000,?,?,?,?,?,?,?,?), ref: 0022F476
memcpy.MSVCRT(?,?,?,?), ref: 0022F4BB
memcpy.MSVCRT(00000000,?,?), ref: 0022F515

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: memcpy$ConvertStreammemmove
String ID:
API String ID: 4264401998-0
Opcode ID: a719d8a6d04f680abf2b6c701615adeac726ab5b129c56969de367e6a406cc5b
Instruction ID: abd49b3327fb79b2c8093d7bc35a95c2fe51071c0790fc066c098fca2d11b1aa
Opcode Fuzzy Hash: a719d8a6d04f680abf2b6c701615adeac726ab5b129c56969de367e6a406cc5b
Instruction Fuzzy Hash: 8DB15670610712AFDB64DF69D984A6BB7F5EF84310F00C93DE9AA8A220D770E964CF01

Function 0023AF7B Relevance: 7.6, APIs: 5, Instructions: 110timesynchronizationCOMMON

Download Yara Rule

APIs

timeBeginPeriod.WINMM(?), ref: 0023AF9A

Part of subcall function 0022EB67: __aullrem.LIBCMT ref: 0022EB7D

timeGetTime.WINMM(?,00000000), ref: 0023AFC5

Part of subcall function 00221C7A: EnterCriticalSection.KERNEL32(-000012B0,002336BD,?,?,?,?,00000000,00000000), ref: 00221C80

timeGetTime.WINMM ref: 0023AFD6
WaitForSingleObject.KERNEL32(?,?), ref: 0023AFFC
timeEndPeriod.WINMM(?), ref: 0023B0A8

Part of subcall function 00221C87: LeaveCriticalSection.KERNEL32(-000012B0,002336D3,?,00C9FE00,?,?,?,?,00000000,00000000), ref: 00221C8D

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: time$CriticalPeriodSectionTime$BeginEnterLeaveObjectSingleWait__aullrem
String ID:
API String ID: 3955597780-0
Opcode ID: f6ece7dbae74c9346cea724a5e9fb28e03d7bb77b886005c20ba6e306c26dfd9
Instruction ID: f519141b551cb8ba6629caf8bea20124c9034c9ff710735051f0ebc77000affc
Opcode Fuzzy Hash: f6ece7dbae74c9346cea724a5e9fb28e03d7bb77b886005c20ba6e306c26dfd9
Instruction Fuzzy Hash: F841C2B1A14312ABC711EF65D885A5ABBE5BF48310F00493AF848E7252D771EC20CF92

Function 00209058 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 441COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 002090D9
exit.MSVCRT ref: 00209120

Strings

Fatal error: encode_table() isn't implemented in this coder, xrefs: 002090EB
%s, xrefs: 0020910D

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exitlongjmp
String ID: %s$Fatal error: encode_table() isn't implemented in this coder
API String ID: 2266059207-1718256178
Opcode ID: 4bc80eae74ab341eb283327c95d3f89f35d31388b20cbdbfc0818e95c7edd24c
Instruction ID: 547a8f9eaf7da482848b4bd390e1d13e6657801ddad9345462a2ebd83564a1d3
Opcode Fuzzy Hash: 4bc80eae74ab341eb283327c95d3f89f35d31388b20cbdbfc0818e95c7edd24c
Instruction Fuzzy Hash: 7C02BF759153158FDB84EF28C4C025ABBE1FB89314F18866EDC899B38AD330E959CF81

Function 002470E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0024712B
FormatMessageW.KERNEL32 ref: 00247163
WideCharToMultiByte.KERNEL32 ref: 002471A7

Part of subcall function 0023F1D0: strcpy.MSVCRT ref: 0023F235

Strings

%s: %s, xrefs: 002471BB

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ByteCharErrorFormatLastMessageMultiWidestrcpy
String ID: %s: %s
API String ID: 1881214218-3740598653
Opcode ID: 9cfb57c07403f7a94e8e430b6ede5a4945d0b0a8b1348c0b53ab875d1deed762
Instruction ID: 2fdcd738ccae30b50af8b50940b917df01ac85dce4cf74b9a4b643c1371c263f
Opcode Fuzzy Hash: 9cfb57c07403f7a94e8e430b6ede5a4945d0b0a8b1348c0b53ab875d1deed762
Instruction Fuzzy Hash: 9821A0B15093429BE320EF29D55875BBBE1BF88308F408A2DE59897291D7B885498B87

Function 002D60D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

basic_string::_S_construct null not valid, xrefs: 002D6150, 002D61E0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: basic_string::_S_construct null not valid
API String ID: 0-290684606
Opcode ID: 395c0d0f257db9bb622da910f6d84e964d634f3b6a1bc0482b067c3d309d589f
Instruction ID: dc48343eb6ba315e8d837ef22dc2fb324ba0583e7d5b55f52f097dbbfa88c3a2
Opcode Fuzzy Hash: 395c0d0f257db9bb622da910f6d84e964d634f3b6a1bc0482b067c3d309d589f
Instruction Fuzzy Hash: 85319CB1529342AFC311AF6AC58862BFFE4EF91350F58882EE8CC47302C375D8548B92

Function 001C8FF0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 001C9103

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 2f339ad89ba3ae4c2356d9ba71b16ccef1d5c504ef9c932ca7a8c72f0b8612c2
Instruction ID: e9da7b11275a4a66ce4fe69b51ebd1202d9d0f3b3d190b34489fb2569413d19b
Opcode Fuzzy Hash: 2f339ad89ba3ae4c2356d9ba71b16ccef1d5c504ef9c932ca7a8c72f0b8612c2
Instruction Fuzzy Hash: EB3148B4D046108FCB04EF69C185BAABBF4BF59310F45846EEC98AB346D734D954CBA2

Function 00212520 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000064,002F0003,0033DB34,00000020,?,00000200,00000064,00000000), ref: 00212554
WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,0035BD4C,000000FF,00000000,00000000,00000048), ref: 0021257B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ByteCharControlDeviceMultiWide
String ID:
API String ID: 1419012440-0
Opcode ID: 10ece1784d49b5ecff7f6ecb206cf5a982aa25f4dd7f2c71edf080b0c21470c2
Instruction ID: 83d132fe723cb70e7e3e9108c3c6330b35b23179e251e7d63e62aabc84e90c32
Opcode Fuzzy Hash: 10ece1784d49b5ecff7f6ecb206cf5a982aa25f4dd7f2c71edf080b0c21470c2
Instruction Fuzzy Hash: 7CF0A0753803197BF7209B50DC8AFE6BAACEB01B90F1001317F18E91D2D6F0EA54C6A8

Function 001EEB60 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 001EEB6A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 462557d5bd343cea67fb1a5fdae4586d32b1e4512c9248c48b3e4025070bd6e9
Instruction ID: ea439a715f54e3d35d73a4083548fcafabf4292f720ab37f847997d6b7ce1c84
Opcode Fuzzy Hash: 462557d5bd343cea67fb1a5fdae4586d32b1e4512c9248c48b3e4025070bd6e9
Instruction Fuzzy Hash: 5AC04CF59043448FC600FF68D549519BBF0BB40241F845929E88582305EA74D22D8A87

Function 001C831D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a95fb49109aa7c9bf3b77a630d204c11382a45983629bf76454d8ff980aecc4
Instruction ID: d952e5f47771ec51fd1587a32b42823415c3bef41187dedd65591e892f29ba4b
Opcode Fuzzy Hash: 3a95fb49109aa7c9bf3b77a630d204c11382a45983629bf76454d8ff980aecc4
Instruction Fuzzy Hash: 0E117970A156009ACB05BF34C59277DB6A0AF90700F45887CE88A5B347DF38DA448BA7

Function 001C8316 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080bdf12f93e2fdf756bd3777090ef662e7cc1410b387a1f42a9cd0e53f6676a
Instruction ID: 01cb1da7d4b8ebc56052c41993e389c1aecc6ed9935510d2a1ec1bdf3a4c0256
Opcode Fuzzy Hash: 080bdf12f93e2fdf756bd3777090ef662e7cc1410b387a1f42a9cd0e53f6676a
Instruction Fuzzy Hash: 33F01770A09610ABC7057F70C59273EB6A4AF51B04F42586DF88A5B343DF78CA858BDB

Function 001C8644 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea9861681d967c1b97e0ce2d570806b306d915668d92abd4f5d1dd4e0219e6d
Instruction ID: 5ea086d2b506b955cdc0f3d6147188e7080c3157005dd76cee72a0b8d99bad76
Opcode Fuzzy Hash: 9ea9861681d967c1b97e0ce2d570806b306d915668d92abd4f5d1dd4e0219e6d
Instruction Fuzzy Hash: 9EF08CB09092109BC7057F70C59273DB6E4AF52704F42686DF88A6B343DF78CA848B9B

Function 00210FA3 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9129e070d46f460f44505443c40056203fc384cc58c4fd0c01bcd63b16bbc189
Instruction ID: 70592db7efa4fb8b7ef9e6aa77656bfe985434a2f237c3e79dbfddc196141bf6
Opcode Fuzzy Hash: 9129e070d46f460f44505443c40056203fc384cc58c4fd0c01bcd63b16bbc189
Instruction Fuzzy Hash: 2FE092B35642464BE322CF1EACC1B55A7EEB704312F64C43AE404C6630CB64D8A44718

Function 001C9116 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66eb887e1f0a9a57756bd89a3faa37b5f2c985023b9039adfe96c5632e44c03d
Instruction ID: 7f0f5966335d64ef5d212a35bb9644ca59ee7d355c4e499c6994b0a7f31ad657
Opcode Fuzzy Hash: 66eb887e1f0a9a57756bd89a3faa37b5f2c985023b9039adfe96c5632e44c03d
Instruction Fuzzy Hash: 74E065709092009AD7067F70C59273DB6A0AF92704F9A486DE48A5B243DF38CA458BEB

Function 00280FF0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06849849084399e20ed55ee2db7cbcb2a85aabb176019eac087c0c2df2a756e7
Instruction ID: a87c5fe3b975b2b70e5c30b2b651c91474ab821691c5ece8f84a35189f0462ca
Opcode Fuzzy Hash: 06849849084399e20ed55ee2db7cbcb2a85aabb176019eac087c0c2df2a756e7
Instruction Fuzzy Hash: EBC08CB0C047408BC202BF38A10A23CFAB07F42300FC42CACE5801B30AE635C01C869B

Function 002112B7 Relevance: 73.6, APIs: 19, Strings: 23, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00215731: EnterCriticalSection.KERNEL32(00357D30,0023BDFF,?,00000000,00000000,?,?,0023C461,0023C74F,00000003,00000010,0023C74F,00000010,BASS/2.4,00000000), ref: 00215736

LoadLibraryA.KERNEL32(wininet,00000000,?,002114F9,000000F0,?,00231C27,00000000,00000000,?,?,?,?,?,?), ref: 002112D7
GetProcAddress.KERNEL32(00000000,InternetOpenA), ref: 002112F6
GetProcAddress.KERNEL32(00000000,InternetSetOptionA), ref: 00211303
GetProcAddress.KERNEL32(00000000,InternetQueryOptionA), ref: 00211310
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 0021131D
GetProcAddress.KERNEL32(00000000,InternetGetConnectedState), ref: 0021132A
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 00211337
GetProcAddress.KERNEL32(00000000,InternetReadFileExA), ref: 00211344
GetProcAddress.KERNEL32(00000000,InternetSetFilePointer), ref: 00211351
GetProcAddress.KERNEL32(00000000,InternetConnectA), ref: 0021136C
GetProcAddress.KERNEL32(00000000,InternetCrackUrlA), ref: 00211387
GetProcAddress.KERNEL32(00000000,HttpOpenRequestA), ref: 002113A2
GetProcAddress.KERNEL32(00000000,HttpSendRequestA), ref: 002113AF
GetProcAddress.KERNEL32(00000000,HttpQueryInfoA), ref: 002113BC
GetProcAddress.KERNEL32(00000000,FtpOpenFileA), ref: 002113D7
GetProcAddress.KERNEL32(00000000,FtpCommandA), ref: 002113E4
GetProcAddress.KERNEL32(00000000,FtpGetFileSize), ref: 002113F1
LoadLibraryA.KERNEL32(ws2_32,?,002114F9,000000F0,?,00231C27,00000000,00000000,?,?,?,?,?,?), ref: 002113FD
GetProcAddress.KERNEL32(00000000,shutdown), ref: 0021140E

Strings

InternetCloseHandle, xrefs: 00211312
HttpOpenRequestA, xrefs: 0021138E
ws2_32, xrefs: 002113F3
InternetOpenA, xrefs: 002112EE
shutdown, xrefs: 00211408
FtpCommandA, xrefs: 002113D9
FtpGetFileSize, xrefs: 002113E6
InternetReadFileExA, xrefs: 00211339
wininet, xrefs: 002112D2
HttpQueryInfoA, xrefs: 002113B1
FtpOpenFileA, xrefs: 002113C3
HttpSendRequestA, xrefs: 002113A4
InternetCrackUrlW, xrefs: 00211380, 00211385
HttpOpenRequestW, xrefs: 0021139B, 002113A0
InternetGetConnectedState, xrefs: 0021131F
InternetConnectW, xrefs: 00211365, 0021136A
InternetSetFilePointer, xrefs: 00211346
FtpOpenFileW, xrefs: 002113D0, 002113D5
InternetReadFile, xrefs: 0021132C
InternetQueryOptionA, xrefs: 00211305
InternetCrackUrlA, xrefs: 00211373
InternetSetOptionA, xrefs: 002112F8
InternetConnectA, xrefs: 00211358

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad$CriticalEnterSection
String ID: FtpCommandA$FtpGetFileSize$FtpOpenFileA$FtpOpenFileW$HttpOpenRequestA$HttpOpenRequestW$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetConnectW$InternetCrackUrlA$InternetCrackUrlW$InternetGetConnectedState$InternetOpenA$InternetQueryOptionA$InternetReadFile$InternetReadFileExA$InternetSetFilePointer$InternetSetOptionA$shutdown$wininet$ws2_32
API String ID: 479578514-3113607249
Opcode ID: 9abc1d6376a21727d84640e9b60b16b616b30ad1e77e93b83e0d61820d430039
Instruction ID: ec3eb8445c14f83380d474b83f7b983c7c6408751b3ddefeeb4c48116010c60a
Opcode Fuzzy Hash: 9abc1d6376a21727d84640e9b60b16b616b30ad1e77e93b83e0d61820d430039
Instruction Fuzzy Hash: CB313D74E55318AA8723BF7A6C4985BBEFCEF65B52B0004ABE404D3271DEB89451CF60

Function 001F4EB0 Relevance: 63.4, APIs: 22, Strings: 14, Instructions: 440COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001F4ECC
_write.MSVCRT ref: 001F4EEE
free.MSVCRT ref: 001F4F1D
longjmp.MSVCRT ref: 001F4F73
exit.MSVCRT ref: 001F4FCC
malloc.MSVCRT ref: 001F4FF8
free.MSVCRT ref: 001F5047

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 001F4F97, 001F5111, 001F54C7
$$arcdatafile$$.tmp, xrefs: 001F51DC, 001F5467
ppmonstr e -o%d -m%d -r%d %s, xrefs: 001F528C
4[6 [6, xrefs: 001F52DB
ppmonstr d %s, xrefs: 001F52DE
pmm, xrefs: 001F5157, 001F51A9
^, xrefs: 001F5400
%s, xrefs: 001F4FB9, 001F5133, 001F54E9
[6, xrefs: 001F5266
$$arcdatafile$$.pmm, xrefs: 001F51E3
<stdin>, xrefs: 001F5518
read, xrefs: 001F4F0B
<stdout>, xrefs: 001F5533
write, xrefs: 001F502E, 001F507C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: freemalloc$_writeexitlongjmp
String ID: %s$ <stdin>$ <stdout>$ [6$$$arcdatafile$$.pmm$$$arcdatafile$$.tmp$4[6 [6$ERROR: can't alloc %lu memory bytes$^$pmm$ppmonstr d %s$ppmonstr e -o%d -m%d -r%d %s$read$write
API String ID: 3559836011-2115152460
Opcode ID: d3df98a4ec7ff921d98204493871af92e1d1cfba2bfff53a960de18fe4954fc2
Instruction ID: 0dc458462ad78d8f54b5e6e08a648d25a8e5936707f057928d0f7d4acab7e850
Opcode Fuzzy Hash: d3df98a4ec7ff921d98204493871af92e1d1cfba2bfff53a960de18fe4954fc2
Instruction Fuzzy Hash: 35028DB1608B189FD721EF29C48136ABBE1BF84314F56892DEA8C9B301D775D945CF82

Function 001F6251 Relevance: 56.3, APIs: 25, Strings: 7, Instructions: 338stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 001F5B72
_wmkdir.MSVCRT ref: 001F5BC4
malloc.MSVCRT ref: 001F5C15
malloc.MSVCRT ref: 001F5C31
malloc.MSVCRT ref: 001F5C4B
strcpy.MSVCRT ref: 001F5CA8
strlen.MSVCRT ref: 001F5CB6
strcpy.MSVCRT ref: 001F5CD4
strchr.MSVCRT ref: 001F6267
strlen.MSVCRT ref: 001F6285

Strings

Ts;, xrefs: 001F6630, 001F5E52
read, xrefs: 001F61CE
freearc%u.tmp, xrefs: 001F5B42
@q(, xrefs: 001F5BEA, 001F5D2D, 001F6604, 001F6676
Ts;, xrefs: 001F66A2, 001F5D0F
Ts;, xrefs: 001F5B1C, 001F5B4D
:/\, xrefs: 001F625C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: mallocstrcpy$strlen$_wmkdirstrchr
String ID: :/\$@q($Ts;$Ts;$Ts;$freearc%u.tmp$read
API String ID: 323131915-3721916319
Opcode ID: 296a916f9d4ed23994e7931bb7a2b46274e7f2c4fea6ec42bcfd4dc254934f91
Instruction ID: 2f7a69be3c4f7e91c316c83474e5adab307a8ec820c1fdd09e32cebb7fbefbcc
Opcode Fuzzy Hash: 296a916f9d4ed23994e7931bb7a2b46274e7f2c4fea6ec42bcfd4dc254934f91
Instruction Fuzzy Hash: 1E02A5B49047288FCB61EF68C9857DDBBF0AF49314F0189A9E98CA7341D7749A94CF42

Function 0020E2C0 Relevance: 53.0, APIs: 25, Strings: 5, Instructions: 454stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT(00000000,770C2CB0,00000000,0020F716), ref: 0020E2D7
CharToOemW.USER32(00000000,770C2CB0), ref: 0020E2FB
_wopen.MSVCRT ref: 0020E31A
malloc.MSVCRT ref: 0020E33B
exit.MSVCRT ref: 0020E396
malloc.MSVCRT ref: 0020E351

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

longjmp.MSVCRT ref: 0020E3CF
exit.MSVCRT ref: 0020E431
malloc.MSVCRT ref: 0020E482
malloc.MSVCRT ref: 0020E49B
malloc.MSVCRT ref: 0020E4B2
CharToOemW.USER32 ref: 0020E4E7
malloc.MSVCRT ref: 0020E52C
malloc.MSVCRT ref: 0020E548
malloc.MSVCRT ref: 0020E562
CharToOemW.USER32 ref: 0020E59D
malloc.MSVCRT ref: 0020E5C4
malloc.MSVCRT ref: 0020E5E0
malloc.MSVCRT ref: 0020E5FA
CharToOemW.USER32 ref: 0020E635

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 0020E3FC, 0020E8AE, 0020E908, 0020E966, 0020E9C4
ERROR: can't close file %s, xrefs: 0020E818
@q(, xrefs: 0020E458, 0020E510, 0020E5A9
ERROR: can't open file %s, xrefs: 0020E35F
%s, xrefs: 0020E383, 0020E41E, 0020E83C, 0020E8CE, 0020E928, 0020E986

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$Char$exit$_wopenfreelongjmpstrcpy
String ID: %s$@q($ERROR: can't alloc %lu memory bytes$ERROR: can't close file %s$ERROR: can't open file %s
API String ID: 647301629-909990664
Opcode ID: 3ced259a38291337a5502b6b1f72f5481b715bfa7613026b11de29ed59a56280
Instruction ID: 6d451fd73cb00b6aa24404a592f5857f502f089d5868a332f23264e79b922959
Opcode Fuzzy Hash: 3ced259a38291337a5502b6b1f72f5481b715bfa7613026b11de29ed59a56280
Instruction Fuzzy Hash: DD1226B09183158FDB50EF28C58575ABBE0BF48344F1689ADE88C9B356D774D890CF92

Function 0025E0A0 Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

@, xrefs: 0025E345

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: e81bb0f8b3d1bfb062a620fa17e5f7958e579c33afe3b219d5b7248a08fc320c
Instruction ID: a71fb681b667cb9ee12e9a421a12130f8f2c3f9dfedf115c1125a1f1657e0240
Opcode Fuzzy Hash: e81bb0f8b3d1bfb062a620fa17e5f7958e579c33afe3b219d5b7248a08fc320c
Instruction Fuzzy Hash: A6B1E3716283469FDB28CF28D480B6ABBE1BF85305F05446CED989B342C374ED59CB96

Function 00246FE0 Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 223windowkeyboardCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 0024F283
TranslateMessage.USER32 ref: 0024F296
DispatchMessageW.USER32 ref: 0024F29E
GetActiveWindow.USER32 ref: 0024F2D0
GetPropW.USER32 ref: 0024F2E5
GetAsyncKeyState.USER32 ref: 0024F301
GetAsyncKeyState.USER32 ref: 0024F30F
GetClientRect.USER32 ref: 0024F352
ClientToScreen.USER32 ref: 0024F3A6
SetCursorPos.USER32 ref: 0024F3BE

Strings

GLFW, xrefs: 0024F2DA

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Message$AsyncClientState$ActiveCursorDispatchPeekPropRectScreenTranslateWindow
String ID: GLFW
API String ID: 1164748732-220981224
Opcode ID: 59352d619b58ce2aa5f67df853ab8a99d833dd94aa3a7cbdb67ef4840795e7fd
Instruction ID: 561dc1955e977bf6e1943a808313ef06f502185d60f001222548bbd88e9dbc5a
Opcode Fuzzy Hash: 59352d619b58ce2aa5f67df853ab8a99d833dd94aa3a7cbdb67ef4840795e7fd
Instruction Fuzzy Hash: B7815BB59143448BEB44AF399A4836ABEF1AFC4300F05883EDCC98B245DBF4D459DB82

Function 0020D0E0 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 299stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0020D110
malloc.MSVCRT ref: 0020D12C
malloc.MSVCRT ref: 0020D146
CharToOemW.USER32 ref: 0020D187
malloc.MSVCRT ref: 0020D1B8
malloc.MSVCRT ref: 0020D1D8
malloc.MSVCRT ref: 0020D1F2
CharToOemW.USER32 ref: 0020D230
malloc.MSVCRT ref: 0020D261
malloc.MSVCRT ref: 0020D281
malloc.MSVCRT ref: 0020D29B
CharToOemW.USER32 ref: 0020D2D9
CharToOemW.USER32 ref: 0020D32A
CharToOemW.USER32 ref: 0020D363
CharToOemW.USER32 ref: 0020D39C
malloc.MSVCRT ref: 0020D3A8
strcpy.MSVCRT ref: 0020D41A
CharToOemW.USER32 ref: 0020D44A
exit.MSVCRT ref: 0020D4CB
longjmp.MSVCRT(?,?,?,?,?,00000000,?,00000000,?,0021039A), ref: 0020D4DF

Strings

@q(, xrefs: 0020D190, 0020D235
ERROR: can't alloc %lu memory bytes, xrefs: 0020D498, 0020D50E, 0020D565, 0020D627
@q(, xrefs: 0020D0F5, 0020D19D, 0020D23F
%s, xrefs: 0020D4B8, 0020D52E, 0020D585, 0020D647

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$Char$exitlongjmpstrcpy
String ID: %s$@q($@q($ERROR: can't alloc %lu memory bytes
API String ID: 1574489026-1911585362
Opcode ID: 9bdc0f2592242c218ea9af430e4baf23e339343c7f0ff65047f7a87aca9db369
Instruction ID: 9839932605d3fac71d2d5de94e4f6ead565ba7af3a642028cadc815e12c17ee0
Opcode Fuzzy Hash: 9bdc0f2592242c218ea9af430e4baf23e339343c7f0ff65047f7a87aca9db369
Instruction Fuzzy Hash: 25E107B09193049FC751EF68C58535ABBE0AF08304F05887DEE8CAF346D7B898549FA6

Function 001F6291 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 249stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 001F5CD4
malloc.MSVCRT ref: 001F5D58
malloc.MSVCRT ref: 001F5D74
malloc.MSVCRT ref: 001F5D8E
strcpy.MSVCRT ref: 001F5DEB
strlen.MSVCRT ref: 001F5DF9
strcpy.MSVCRT ref: 001F5E17
malloc.MSVCRT ref: 001F5F6C
malloc.MSVCRT ref: 001F5FCF
malloc.MSVCRT ref: 001F5FEF
malloc.MSVCRT ref: 001F6015
free.MSVCRT ref: 001F6135
free.MSVCRT ref: 001F6143
free.MSVCRT ref: 001F6151
_write.MSVCRT ref: 001F61BA
_write.MSVCRT ref: 001F617F

Part of subcall function 001EF1E0: wcschr.MSVCRT ref: 001EF1F5

_wopen.MSVCRT ref: 001F6225
free.MSVCRT ref: 001F6247
strchr.MSVCRT ref: 001F62AD
strlen.MSVCRT ref: 001F62D1

Part of subcall function 001F5550: strstr.MSVCRT ref: 001F559A
Part of subcall function 001F5550: strcat.MSVCRT ref: 001F560A
Part of subcall function 001F5550: strcat.MSVCRT ref: 001F5616
Part of subcall function 001F5550: strcat.MSVCRT ref: 001F5626
Part of subcall function 001F5550: strstr.MSVCRT ref: 001F567B
Part of subcall function 001F5550: strstr.MSVCRT ref: 001F56B1

_wrename.MSVCRT ref: 001F6380
_wopen.MSVCRT ref: 001F639F
_wrename.MSVCRT ref: 001F63FC
_wopen.MSVCRT ref: 001F641B
_filelengthi64.MSVCRT ref: 001F6449
_filelengthi64.MSVCRT ref: 001F645A
malloc.MSVCRT ref: 001F647F
exit.MSVCRT ref: 001F656A
longjmp.MSVCRT ref: 001F657F
free.MSVCRT ref: 001F664F
free.MSVCRT ref: 001F665D
free.MSVCRT ref: 001F666B
free.MSVCRT ref: 001F66C1
free.MSVCRT ref: 001F66CF
free.MSVCRT ref: 001F66DD
free.MSVCRT ref: 001F6C18
_close.MSVCRT ref: 001F6C26
malloc.MSVCRT ref: 001F6C47
malloc.MSVCRT ref: 001F6C5D

Strings

Ts;, xrefs: 001F6630, 001F5E52
read, xrefs: 001F61CE
@q(, xrefs: 001F5D2D, 001F6604, 001F6676
Ts;, xrefs: 001F66A2, 001F5D0F
:/\, xrefs: 001F629C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$malloc$_wopenstrcatstrcpystrstr$_filelengthi64_wrename_writestrlen$_closeexitlongjmpstrchrwcschr
String ID: :/\$@q($Ts;$Ts;$read
API String ID: 3010328184-4128176265
Opcode ID: 8c97c92990a20de2af4a2b871d0b11d19bc54dbb2f73813ed409aac6bd12a61b
Instruction ID: 002bb7e56750864630651a80d0838f27027ebaa742a1c6323896a6fe515ba88f
Opcode Fuzzy Hash: 8c97c92990a20de2af4a2b871d0b11d19bc54dbb2f73813ed409aac6bd12a61b
Instruction Fuzzy Hash: 38D1A2B49047288FCB61EF28C9857DDBBF0AF49314F0189E9E988A7341D7749A84CF81

Function 00252F60 Relevance: 36.9, APIs: 9, Strings: 12, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,0024D255), ref: 00252FB5
GetProcAddress.KERNEL32 ref: 00252FD4
GetProcAddress.KERNEL32 ref: 00252FEE
GetProcAddress.KERNEL32 ref: 00253008
GetProcAddress.KERNEL32 ref: 00253022
GetProcAddress.KERNEL32 ref: 0025303C
GetProcAddress.KERNEL32 ref: 00253056
GetProcAddress.KERNEL32 ref: 00253070
FreeLibrary.KERNEL32 ref: 002530DA

Strings

OSMesaMakeCurrent, xrefs: 00253017
OSMesa.dll, xrefs: 00252F73
OSMesa: Library not found, xrefs: 002530F5
OSMesaGetProcAddress, xrefs: 00253065
C:, xrefs: 00252F94
OSMesaCreateContextAttribs, xrefs: 00252FE3
OSMesaGetDepthBuffer, xrefs: 0025304B
OSMesaDestroyContext, xrefs: 00252FFD
OSMesa: Failed to load required entry points, xrefs: 002530B4
OSMesaGetColorBuffer, xrefs: 00253031
OSMesaCreateContextExt, xrefs: 00252FC9
libOSMesa.dll, xrefs: 00252F6B, 00252F98

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: OSMesa.dll$OSMesa: Failed to load required entry points$OSMesa: Library not found$OSMesaCreateContextAttribs$OSMesaCreateContextExt$OSMesaDestroyContext$OSMesaGetColorBuffer$OSMesaGetDepthBuffer$OSMesaGetProcAddress$OSMesaMakeCurrent$libOSMesa.dll$C:
API String ID: 2449869053-1118952530
Opcode ID: 247c2bfdce3bcfbf87e51652bc022dd9698e4786d658098a7c6e475b501146ac
Instruction ID: 7ab1e158274fe5f2429b06e8279f4f2686d26086ea308c5a6e5ed657610f3797
Opcode Fuzzy Hash: 247c2bfdce3bcfbf87e51652bc022dd9698e4786d658098a7c6e475b501146ac
Instruction Fuzzy Hash: 434128B99193459FDB40EF69F98422ABBF0EB45346F04443CE88497255F770C898CF4A

Function 0023E860 Relevance: 36.3, APIs: 3, Strings: 21, Instructions: 346stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0024A7A0: TlsGetValue.KERNEL32 ref: 0024A7AD

strncmp.MSVCRT ref: 0023E976
sscanf.MSVCRT ref: 0023E9B4

Strings

GL_ARB_debug_output, xrefs: 0023EF22
GL_ARB_compatibility, xrefs: 0023EE97
glGetStringi, xrefs: 0023EA14
OpenGL ES version string retrieval is broken, xrefs: 0023EC20
glGetIntegerv, xrefs: 0023E8EB
OpenGL version string retrieval is broken, xrefs: 0023ED90
OpenGL ES-CL , xrefs: 0023E877
glGetString, xrefs: 0023E8FE
Cannot make current with a window that has no OpenGL or OpenGL ES context, xrefs: 0023ECE0, 0023EDD0, 0023EF04
GL_EXT_robustness, xrefs: 0023EE10
No version found in OpenGL ES version string, xrefs: 0023E9CD
Requested OpenGL ES version %i.%i, got version %i.%i, xrefs: 0023ED29
Entry point retrieval is broken, xrefs: 0023EC40
OpenGL ES , xrefs: 0023E87F
OpenGL ES-CM , xrefs: 0023E86F, 0023E946
No version found in OpenGL version string, xrefs: 0023ED70
GL_KHR_context_flush_control, xrefs: 0023EB21
glClear, xrefs: 0023EB5F
GL_ARB_robustness, xrefs: 0023EAD9
%d.%d.%d, xrefs: 0023E991
Requested OpenGL version %i.%i, got version %i.%i, xrefs: 0023EDF0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Valuesscanfstrncmp
String ID: %d.%d.%d$Cannot make current with a window that has no OpenGL or OpenGL ES context$Entry point retrieval is useren$GL_ARB_compatibility$GL_ARB_debug_output$GL_ARB_robustness$GL_EXT_robustness$GL_KHR_context_flush_control$No version found in OpenGL ES version string$No version found in OpenGL version string$OpenGL ES $OpenGL ES version string retrieval is useren$OpenGL ES-CL $OpenGL ES-CM $OpenGL version string retrieval is useren$Requested OpenGL ES version %i.%i, got version %i.%i$Requested OpenGL version %i.%i, got version %i.%i$glClear$glGetIntegerv$glGetString$glGetStringi
API String ID: 1410306227-46266315
Opcode ID: af6ea5b1eb5e4148957ebcfda56401240d7c9bb6b128de523db503ac090674d3
Instruction ID: 1ee456897884d395bd5a57007dccb72721355c22d3aba5efa61d56e0f253d2fb
Opcode Fuzzy Hash: af6ea5b1eb5e4148957ebcfda56401240d7c9bb6b128de523db503ac090674d3
Instruction Fuzzy Hash: 4FE13DB4528301CBDB11AF64D1493AEB7E0BF40304F16887EECC94B296D7B59899CF52

Function 0025E3B0 Relevance: 36.2, APIs: 24, Instructions: 169COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 0033292E
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332933
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332938
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 0033293D
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332942
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332947
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 0033294C
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332951
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332956
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 0033295B
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332960
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332968
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033296D
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332972
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332977
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033297C
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332981
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332986
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033298B
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332990
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332995
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033299C
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 003329A1
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,00000004,774CDF20,002776AD), ref: 003329A6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 202ebf834efedc974bd8f5fafcbd00723fe1255603d2ed0770ab0a75cabbed2c
Instruction ID: f28691b30f8cd2f35f9cc5eb530c82a6c356ce91e9a04b991d03e4e4a8d8bffd
Opcode Fuzzy Hash: 202ebf834efedc974bd8f5fafcbd00723fe1255603d2ed0770ab0a75cabbed2c
Instruction Fuzzy Hash: 85512931A206159FCB18CF28C4817EDBBF1BF49315F0A8129EDAC9B341D330AA658F85

Function 0024E280 Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 441COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32 ref: 0024E333
SetWindowPos.USER32 ref: 0024E375
GetMonitorInfoW.USER32 ref: 0024E471

Strings

(, xrefs: 0024E45F

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: InfoMonitor$Window
String ID: (
API String ID: 3397208210-3887548279
Opcode ID: 9eea919aae5f268a086e0302b2ceab6cf53b55541129390eca9a487bf15d54ea
Instruction ID: ee62085cdb237353df3e9476fca8d08ccd180284aa7f2cb5950da9846bed81ca
Opcode Fuzzy Hash: 9eea919aae5f268a086e0302b2ceab6cf53b55541129390eca9a487bf15d54ea
Instruction Fuzzy Hash: AA1237B45183018FEB58EF28C58831ABBF1BF84315F16892DE8998B356E774D854CF82

Function 0020B100 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 184COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0020B10B
longjmp.MSVCRT(?,?,00000000,0020D4F8,?,?,?,?,?,00000000,?,00000000,?,0021039A), ref: 0020B133
exit.MSVCRT ref: 0020B188
free.MSVCRT ref: 0020B1B2
malloc.MSVCRT ref: 0020B1C1
_lseeki64.MSVCRT ref: 0020B1EB
malloc.MSVCRT ref: 0020B20D
malloc.MSVCRT ref: 0020B223
exit.MSVCRT ref: 0020B265
longjmp.MSVCRT ref: 0020B27F
_read.MSVCRT ref: 0020B29D

Strings

ERROR: file read operation failed, xrefs: 0020B352
ERROR: can't read %lu bytes, xrefs: 0020B2F0
ERROR: can't alloc %lu memory bytes, xrefs: 0020B153, 0020B394
%s, xrefs: 0020B175, 0020B252
ERROR: file seek operation failed, xrefs: 0020B232

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exitlongjmp$_lseeki64_readfree
String ID: %s$ERROR: can't alloc %lu memory bytes$ERROR: can't read %lu bytes$ERROR: file read operation failed$ERROR: file seek operation failed
API String ID: 889463729-4100299135
Opcode ID: cea59968cdb1c070932f689e591cb980b739754b68fda250f17766d608abf092
Instruction ID: 7b7dc188845050ee120607462f60590cab50ee0a380253a77ed0d6b92902c3c3
Opcode Fuzzy Hash: cea59968cdb1c070932f689e591cb980b739754b68fda250f17766d608abf092
Instruction Fuzzy Hash: 2A6138B06287069FD721EF69D48531EBBE0BF89345F11882DE9889B352D7B4C8508B96

Function 00286DE0 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_wremove.MSVCRT ref: 00286E2B
free.MSVCRT ref: 00286E44
free.MSVCRT ref: 00286E4F
free.MSVCRT ref: 00286E5A

Part of subcall function 001EF270: memmove.MSVCRT(?,?,?,?,00000000,0020F8C4), ref: 001EF2CE

_close.MSVCRT ref: 00286F03
malloc.MSVCRT ref: 00286F21
malloc.MSVCRT ref: 00286F37
exit.MSVCRT ref: 00286F80

Strings

ERROR: can't close file %s, xrefs: 00286EBC, 00286F49
ERROR: can't alloc %lu memory bytes, xrefs: 00287004, 00287065
@q(, xrefs: 00286DEB
@q(, xrefs: 00286E15
%s, xrefs: 00286EE0, 00286F6D, 00287026, 00287087

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$malloc$_close_wremoveexitmemmove
String ID: %s$@q($@q($ERROR: can't alloc %lu memory bytes$ERROR: can't close file %s
API String ID: 2251729985-616239092
Opcode ID: a03d25775a07d053953e13523b90537785c1f3b8ba18739ba8553e546912cf04
Instruction ID: 07541e1641c380e711f22c358e91ed6bd7eaff13639142fdb2248bc2500945b7
Opcode Fuzzy Hash: a03d25775a07d053953e13523b90537785c1f3b8ba18739ba8553e546912cf04
Instruction Fuzzy Hash: 9D616DB85197119BD711BF69D58932EBBE0BF50300F45886DE9C88F386DB74D890CB92

Function 002107EC Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0021053B
free.MSVCRT ref: 00210549
free.MSVCRT ref: 00210557
free.MSVCRT ref: 00210624
free.MSVCRT ref: 00210632
free.MSVCRT ref: 00210640
free.MSVCRT ref: 00210685
_close.MSVCRT ref: 002107F3
malloc.MSVCRT ref: 00210814
exit.MSVCRT ref: 00210876
_close.MSVCRT ref: 00210883
malloc.MSVCRT ref: 002108A5
malloc.MSVCRT ref: 002108BB

Part of subcall function 001EE7F0: longjmp.MSVCRT(?,?,00040000,00000000,0020B171,?,?,00000000,0020D4F8,?,?,?,?,?,00000000,?), ref: 001EE853
Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE880
Part of subcall function 001EE7F0: OemToCharW.USER32 ref: 001EE896
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE8AE

malloc.MSVCRT ref: 0021082A

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

exit.MSVCRT ref: 00210907
_close.MSVCRT ref: 00210913
malloc.MSVCRT ref: 00210934
malloc.MSVCRT ref: 0021094A

Part of subcall function 001EE7F0: longjmp.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000,0020D4F8), ref: 001EE8D3

exit.MSVCRT ref: 00210996
_close.MSVCRT ref: 002109A3
longjmp.MSVCRT ref: 002109CD
_close.MSVCRT ref: 002109DB
malloc.MSVCRT ref: 002109F9
malloc.MSVCRT ref: 00210A0F
exit.MSVCRT ref: 00210A5B
malloc.MSVCRT ref: 00210AF7
malloc.MSVCRT ref: 00210B0D
exit.MSVCRT ref: 00210B59
exit.MSVCRT ref: 00210C66
exit.MSVCRT ref: 00210CCB
exit.MSVCRT ref: 00210D30
exit.MSVCRT ref: 00210D95

Strings

ERROR: can't close file %s, xrefs: 0021083F, 002108D0, 0021095F, 00210A24
%s, xrefs: 00210863, 002108F4, 00210983, 00210A48

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exitfree$_close$longjmp$Char
String ID: %s$ERROR: can't close file %s
API String ID: 2887407855-2251370396
Opcode ID: 22afa84348717ff95b403ba89e7338b7ef5794bd41df5c79b022fc7371a66886
Instruction ID: e36e3729514ee5cd0f095f2c5b06f8db33c4ba4a29e947ffb53b20f57475b87f
Opcode Fuzzy Hash: 22afa84348717ff95b403ba89e7338b7ef5794bd41df5c79b022fc7371a66886
Instruction Fuzzy Hash: E8511DB05287129BD720BF65C58126EBBE4AF51740F06882DE9C89B302DBB4D8D0DF92

Function 00214F63 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00215731: EnterCriticalSection.KERNEL32(00357D30,0023BDFF,?,00000000,00000000,?,?,0023C461,0023C74F,00000003,00000010,0023C74F,00000010,BASS/2.4,00000000), ref: 00215736

LoadLibraryA.KERNEL32(mfreadwrite,77317130,00215066,00000000,77317130,?,?,00231BA6,?,FFE7FFFF), ref: 00214F81
LoadLibraryA.KERNEL32(mfplat,00000000,?,?,00231BA6,?,FFE7FFFF), ref: 00214F96
GetProcAddress.KERNEL32(00000000,MFStartup), ref: 00214FAE
GetProcAddress.KERNEL32(MFCreateSourceReaderFromByteStream), ref: 00214FCC
GetProcAddress.KERNEL32(00000000,MFCreateAsyncResult), ref: 00214FD9
GetProcAddress.KERNEL32(00000000,MFPutWorkItem), ref: 00214FE6
GetProcAddress.KERNEL32(00000000,MFInvokeCallback), ref: 00214FF3
GetProcAddress.KERNEL32(00000000,MFCreateAttributes), ref: 00215000
GetProcAddress.KERNEL32(00000000,MFCreateMediaType), ref: 0021500D
GetProcAddress.KERNEL32(00000000,MFCreateWaveFormatExFromMFMediaType), ref: 0021501A

Strings

mfplat, xrefs: 00214F91
MFPutWorkItem, xrefs: 00214FDB
MFCreateAttributes, xrefs: 00214FF5
MFInvokeCallback, xrefs: 00214FE8
MFCreateAsyncResult, xrefs: 00214FCE
MFCreateWaveFormatExFromMFMediaType, xrefs: 0021500F
MFStartup, xrefs: 00214FA8
mfreadwrite, xrefs: 00214F7C
MFCreateSourceReaderFromByteStream, xrefs: 00214FC1
MFCreateMediaType, xrefs: 00215002

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad$CriticalEnterSection
String ID: MFCreateAsyncResult$MFCreateAttributes$MFCreateMediaType$MFCreateSourceReaderFromByteStream$MFCreateWaveFormatExFromMFMediaType$MFInvokeCallback$MFPutWorkItem$MFStartup$mfplat$mfreadwrite
API String ID: 479578514-1323034271
Opcode ID: 83b1926933020ce3fee5216b024c84bbc0e26046d3e6c952541c9d2f57af7658
Instruction ID: c0c6d57402c8aac5d69edd1c037ada2f171be0c68a52e40fc27f5336ba40740b
Opcode Fuzzy Hash: 83b1926933020ce3fee5216b024c84bbc0e26046d3e6c952541c9d2f57af7658
Instruction Fuzzy Hash: 41114571A51726E6C7126B75BC059DB6EECABA9B51F00049BE410D21B0EBF494458B50

Function 0021504E Relevance: 33.7, APIs: 13, Strings: 6, Instructions: 471sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00214F63: LoadLibraryA.KERNEL32(mfreadwrite,77317130,00215066,00000000,77317130,?,?,00231BA6,?,FFE7FFFF), ref: 00214F81
Part of subcall function 00214F63: LoadLibraryA.KERNEL32(mfplat,00000000,?,?,00231BA6,?,FFE7FFFF), ref: 00214F96
Part of subcall function 00214F63: GetProcAddress.KERNEL32(00000000,MFStartup), ref: 00214FAE
Part of subcall function 00214F63: GetProcAddress.KERNEL32(MFCreateSourceReaderFromByteStream), ref: 00214FCC
Part of subcall function 00214F63: GetProcAddress.KERNEL32(00000000,MFCreateAsyncResult), ref: 00214FD9
Part of subcall function 00214F63: GetProcAddress.KERNEL32(00000000,MFPutWorkItem), ref: 00214FE6
Part of subcall function 00214F63: GetProcAddress.KERNEL32(00000000,MFInvokeCallback), ref: 00214FF3
Part of subcall function 00214F63: GetProcAddress.KERNEL32(00000000,MFCreateAttributes), ref: 00215000
Part of subcall function 00214F63: GetProcAddress.KERNEL32(00000000,MFCreateMediaType), ref: 0021500D
Part of subcall function 00214F63: GetProcAddress.KERNEL32(00000000,MFCreateWaveFormatExFromMFMediaType), ref: 0021501A

free.MSVCRT ref: 002150E8
Sleep.KERNEL32(00000014,00000001,?,00231BA6,?,FFE7FFFF), ref: 002151C7
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00215323
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00215341
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,0000000C,00000000,00000000,?,?), ref: 0021538B
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,?,00000000,00000000), ref: 002153B3
sprintf.MSVCRT ref: 002153C5
PropVariantClear.OLE32(00000013), ref: 002153F4
PropVariantClear.OLE32(?,?,00231BA6,?,FFE7FFFF), ref: 00215411
EnterCriticalSection.KERNEL32(00000070,?,00231BA6,?,FFE7FFFF), ref: 00215469
LeaveCriticalSection.KERNEL32(00000070,?,00231BA6,?,FFE7FFFF), ref: 002154E1
sscanf.MSVCRT ref: 0021552D
__aulldiv.LIBCMT ref: 00215579

Strings

R[!, xrefs: 002154C7
%x %x %x %llx, xrefs: 00215527
iTunSMPB=, xrefs: 00215501
Ha!, xrefs: 002154D7
auds, xrefs: 00215143
`d!, xrefs: 002154F3

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressProc$ByteCharMultiWide$ClearCriticalLibraryLoadPropSectionVariant$EnterLeaveSleep__aulldivfreesprintfsscanf
String ID: %x %x %x %llx$Ha!$R[!$`d!$auds$iTunSMPB=
API String ID: 2978935900-1782756325
Opcode ID: 3978db87a739110e1d30609117806b5fe4e285a4eef81edcd00a411a976a9f4d
Instruction ID: e5310fd86d3a53468fc4b31fbaa00f3bdccf4f6acfe3068c02b3d4ff5552f276
Opcode Fuzzy Hash: 3978db87a739110e1d30609117806b5fe4e285a4eef81edcd00a411a976a9f4d
Instruction Fuzzy Hash: 000276B1118706EFC710EF64C884AABBBE9FF98354F10495DF596872A0C771E891CB62

Function 002865F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 245COMMON

Download Yara Rule

APIs

_filelengthi64.MSVCRT ref: 00286623
_filelengthi64.MSVCRT ref: 00286650
malloc.MSVCRT ref: 002866CD
malloc.MSVCRT ref: 002866E3
exit.MSVCRT ref: 00286725

Strings

ERROR: archive structure corrupted (bad string), xrefs: 002868D6
ERROR: archive structure corrupted (strange descriptor), xrefs: 00286836
ERROR: can't alloc %lu memory bytes, xrefs: 00286976
ERROR: archive structure corrupted (bad data), xrefs: 0028686C
ERROR: archive structure corrupted (descriptor failed CRC check), xrefs: 002866F2
%s, xrefs: 00286712, 0028688C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: _filelengthi64malloc$exit
String ID: %s$ERROR: archive structure corrupted (bad data)$ERROR: archive structure corrupted (bad string)$ERROR: archive structure corrupted (descriptor failed CRC check)$ERROR: archive structure corrupted (strange descriptor)$ERROR: can't alloc %lu memory bytes
API String ID: 2950442535-972693666
Opcode ID: a2df44172a10327d06524c6310b935a8ee1dc8027c8a947b7bc5d5bbabcf2143
Instruction ID: 79b6f527f4dab05f196f9623391cf24f4df8944b3388a1e83e6320f28860b3fa
Opcode Fuzzy Hash: a2df44172a10327d06524c6310b935a8ee1dc8027c8a947b7bc5d5bbabcf2143
Instruction Fuzzy Hash: 20A147B99152058FCB10EF69C58469EBBF1FF88320F15856AE888AB385D774DC50CF92

Function 002473A0 Relevance: 33.3, APIs: 4, Strings: 15, Instructions: 92keyboardCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00247432
MapVirtualKeyW.USER32 ref: 0024746C
ToUnicode.USER32 ref: 0024749E
ToUnicode.USER32 ref: 002474D3

Strings

e, xrefs: 00247518
`, xrefs: 002474F0
i, xrefs: 00247538
m, xrefs: 00247558
k, xrefs: 00247560
h, xrefs: 00247530
d, xrefs: 00247510
f, xrefs: 00247520
a, xrefs: 002474F8
j, xrefs: 00247550
b, xrefs: 00247500
o, xrefs: 00247548
g, xrefs: 00247528
n, xrefs: 00247540
c, xrefs: 00247508

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Unicode$ByteCharMultiVirtualWide
String ID: `$a$b$c$d$e$f$g$h$i$j$k$m$n$o
API String ID: 4148918737-2028020120
Opcode ID: 362d80234034e24053759957121302d9e5a7800f7d59f63776295c4350fc5cee
Instruction ID: 0411d655fe9e25a8bc753a28641b19a0e4749399f711b37db6c8b3044c5c20a3
Opcode Fuzzy Hash: 362d80234034e24053759957121302d9e5a7800f7d59f63776295c4350fc5cee
Instruction Fuzzy Hash: 1B4107B04087418FE310DF29D59832BBFF5FB81718F508A1DE9954A291D3BA85698F93

Function 0025F1D0 Relevance: 33.1, APIs: 22, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 0025EB70: strlen.MSVCRT ref: 0025EBE7

abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332938
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 0033293D
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332942
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332947
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 0033294C
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332951
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332956
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 0033295B
abort.MSVCRT(?,?,?,00000001,?,?,0025E519), ref: 00332960
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332968
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033296D
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332972
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332977
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033297C
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332981
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332986
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033298B
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332990
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332995
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033299C
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 003329A1
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,00000004,774CDF20,002776AD), ref: 003329A6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: abort$strlen
String ID:
API String ID: 2656325428-0
Opcode ID: bdadab97ef66c901d4d6e6de9bf54786b43cf90c419f741cecc3054040dabf74
Instruction ID: a4dd76c6989f28087c165789fe8edbae85a654ba0e99b787dd31b54008606bec
Opcode Fuzzy Hash: bdadab97ef66c901d4d6e6de9bf54786b43cf90c419f741cecc3054040dabf74
Instruction Fuzzy Hash: 01318EB41283C6CAE711CF28E8457597FD46BA6309F044578EA8497793D3B98908CB6F

Function 001F2A63 Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 367COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001F2A81
malloc.MSVCRT ref: 001F2A9A
malloc.MSVCRT ref: 001F2AB3
malloc.MSVCRT ref: 001F2ACC
malloc.MSVCRT ref: 001F2AE5
realloc.MSVCRT ref: 001F2BE2
realloc.MSVCRT ref: 001F2C3C
memcpy.MSVCRT ref: 001F2DB8
free.MSVCRT ref: 001F2EE4
free.MSVCRT ref: 001F2EF0
free.MSVCRT ref: 001F2EFC
free.MSVCRT ref: 001F2F08
free.MSVCRT ref: 001F2F14
realloc.MSVCRT ref: 001F2F44
realloc.MSVCRT ref: 001F2FA6
realloc.MSVCRT ref: 001F2FCC

Strings

read, xrefs: 001F2B06, 001F2B45, 001F2BA2, 001F2BFC, 001F2C56, 001F2CA3
write, xrefs: 001F2EB1

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: freemallocrealloc$memcpy
String ID: read$write
API String ID: 2810443421-1125055369
Opcode ID: d258412df75102684e2670389bfb5666c49563ed35c5dca0e9441bf4523a5fe3
Instruction ID: 0067af096f33c896d9e8499de86bdedcfb89eb74ae3bffddaede5e171d3fa197
Opcode Fuzzy Hash: d258412df75102684e2670389bfb5666c49563ed35c5dca0e9441bf4523a5fe3
Instruction Fuzzy Hash: 67F101B59083558FC721DF68C48066EBBF0BF89754F15892EF9C9A7301E375E9848B82

Function 0020EC80 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 339stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 0020ECFF
CharToOemW.USER32 ref: 0020ED35
_wmkdir.MSVCRT ref: 0020ED8B

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 0020EC44, 0020F162
ERROR: can't open file %s, xrefs: 0020F0CA
%s, xrefs: 0020EB69, 0020EC66, 0020F0EE, 0020F184

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Char_wmkdirstrcpy
String ID: %s$ERROR: can't alloc %lu memory bytes$ERROR: can't open file %s
API String ID: 145990715-3391998779
Opcode ID: cecf1ca042fa4d545eee0e7f11901556f7770d16adfcc3f80aadc5b83877049a
Instruction ID: bb33713ce7f8eb7d3f82a676a3a97989977a4d9b23e34d9f696c858ff5f7e0a3
Opcode Fuzzy Hash: cecf1ca042fa4d545eee0e7f11901556f7770d16adfcc3f80aadc5b83877049a
Instruction Fuzzy Hash: 6FE126B46183058FCB10EF28C58461ABBE5FF89310F15896DED888B346D771E8A5CB92

Function 00240412 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 271COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 0024F74B

Strings

Invalid input mode 0x%08X, xrefs: 00240476
Raw mouse motion is not supported on this system, xrefs: 002405EC
Win32: Failed to register raw input device, xrefs: 0024F212
Win32: Failed to remove raw input device, xrefs: 0024F1B6
Invalid cursor mode 0x%08X, xrefs: 002404F0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Cursor
String ID: Invalid cursor mode 0x%08X$Invalid input mode 0x%08X$Raw mouse motion is not supported on this system$Win32: Failed to register raw input device$Win32: Failed to remove raw input device
API String ID: 3268636600-2247386432
Opcode ID: f4bc22ec13c31d55f0be37f42640d09b603e06a5f2d78858ca8e52e09df4eb7f
Instruction ID: 691a8c53c7aa17e83792ee87979d44f2093421729aded07ea24d8f8fb00d6714
Opcode Fuzzy Hash: f4bc22ec13c31d55f0be37f42640d09b603e06a5f2d78858ca8e52e09df4eb7f
Instruction Fuzzy Hash: 80B18FB18183428FDB55EF24D68435ABBE4FF85304F45497EE8898B206D3B8D994CF92

Function 0025F310 Relevance: 31.6, APIs: 21, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 407815d839711de72e075415c4d0c7b20a4545c105fa74919e7d2ca1bf9af811
Instruction ID: 7ea795140239fd652968f5ce65e903a898e030a5d613b94c4a6b05f2ce959914
Opcode Fuzzy Hash: 407815d839711de72e075415c4d0c7b20a4545c105fa74919e7d2ca1bf9af811
Instruction Fuzzy Hash: D531CBB16243419FEB24DF2CD585B2AB7E0AF81305F10897EEA98D7252D374C858CB46

Function 00246B59 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 298COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 0024EC1C
GetClientRect.USER32 ref: 0024EC4F
ClientToScreen.USER32 ref: 0024ECCB
ClientToScreen.USER32 ref: 0024ECE1
SetWindowLongW.USER32 ref: 0024ECFB
SetWindowPos.USER32 ref: 0024ED41
GetWindowLongW.USER32 ref: 0024EDDC
GetClientRect.USER32 ref: 0024EE0F
ClientToScreen.USER32 ref: 0024EE8B
ClientToScreen.USER32 ref: 0024EEA1
SetWindowLongW.USER32 ref: 0024EEBB
SetWindowPos.USER32 ref: 0024EF01

Strings

Invalid window attribute 0x%08X, xrefs: 00246BA8
4, xrefs: 0024EED0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ClientWindow$LongScreen$Rect
String ID: 4$Invalid window attribute 0x%08X
API String ID: 911421538-3363298114
Opcode ID: fee9ea709ddad00c9eeaf54c40dbccdee981ece6f4180fdafa28f9a453205977
Instruction ID: 22abc0703af670630b8155f9009eeacebd3172fce8f1ec18c36f2aaedbb8437d
Opcode Fuzzy Hash: fee9ea709ddad00c9eeaf54c40dbccdee981ece6f4180fdafa28f9a453205977
Instruction Fuzzy Hash: B6D128B4A193028FDB04EF28D58871ABBF4FF85305F15892DE8898B315E774D894CB82

Function 00248570 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 232COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 002486B0
qsort.MSVCRT ref: 00248706
WideCharToMultiByte.KERNEL32 ref: 00248745
sprintf.MSVCRT ref: 002487F9
free.MSVCRT ref: 00248844
free.MSVCRT ref: 002488FA
sprintf.MSVCRT ref: 00248954

Strings

05000000%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x00, xrefs: 00248772
Win32: Failed to set device axis mode, xrefs: 002488C0
Win32: Failed to create device, xrefs: 00248960
03000000%02x%02x0000%02x%02x000000000000, xrefs: 00248926
Win32: Failed to convert joystick name to UTF-8, xrefs: 002488A0
Win32: Failed to set device data format, xrefs: 00248894
Win32: Failed to query device capabilities, xrefs: 00248860
PIDV, xrefs: 00248756
,, xrefs: 002485E3
Win32: Failed to enumerate device objects, xrefs: 002488D0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: freesprintf$ByteCharMultiWidecallocqsort
String ID: ,$03000000%02x%02x0000%02x%02x000000000000$05000000%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x00$PIDV$Win32: Failed to convert joystick name to UTF-8$Win32: Failed to create device$Win32: Failed to enumerate device objects$Win32: Failed to query device capabilities$Win32: Failed to set device axis mode$Win32: Failed to set device data format
API String ID: 3181258603-2786012021
Opcode ID: 4aa2cc3e38ab5c669ba60ae746ba38c09466d435225a3ca4b259ae76f9aad5ac
Instruction ID: 2fa1dca6f446d830d99ca7d6acd1d56eea482406d882e6d10ec7c5bfffd78df0
Opcode Fuzzy Hash: 4aa2cc3e38ab5c669ba60ae746ba38c09466d435225a3ca4b259ae76f9aad5ac
Instruction Fuzzy Hash: ACB1BBB49287418FD314EF29C18475FBBE0AF89304F10892EE9989B315D7B4D989DF82

Function 00244FA0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 168libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00244FF7
GetProcAddress.KERNEL32 ref: 00245018
FreeLibrary.KERNEL32 ref: 0024509F

Strings

Vulkan: Failed to query instance extensions: %s, xrefs: 002451DB
Vulkan: Loader not found, xrefs: 002450F0
Vulkan: Window surface creation extensions not found, xrefs: 002450D0
Vulkan: Loader does not export vkGetInstanceProcAddr, xrefs: 0024520D
Vulkan: Failed to query instance extension count: %s, xrefs: 0024507B
vulkan-1.dll, xrefs: 00244FF0
VK_KHR_win32_surface, xrefs: 0024518D
Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties, xrefs: 00245233
vkGetInstanceProcAddr, xrefs: 0024500D
VK_KHR_surface, xrefs: 00245156
vkEnumerateInstanceExtensionProperties, xrefs: 0024502E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VK_KHR_surface$VK_KHR_win32_surface$Vulkan: Failed to query instance extension count: %s$Vulkan: Failed to query instance extensions: %s$Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties$Vulkan: Loader does not export vkGetInstanceProcAddr$Vulkan: Loader not found$Vulkan: Window surface creation extensions not found$vkEnumerateInstanceExtensionProperties$vkGetInstanceProcAddr$vulkan-1.dll
API String ID: 145871493-927530291
Opcode ID: 03699c3f29292c3f58bc1adf7a6dc1ed2d7b6c25ab5e67c6ca4d7800b3aedf2a
Instruction ID: e1d45ed9bd36baad3f15c1851cfc89e78cac8873608c64e26e5300a10cb8fc44
Opcode Fuzzy Hash: 03699c3f29292c3f58bc1adf7a6dc1ed2d7b6c25ab5e67c6ca4d7800b3aedf2a
Instruction Fuzzy Hash: 29515FB5A287118FD714BF74E94532BBBE0EB45744F15883DE8CC87211E7B588A8CB82

Function 001F64E4 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

_close.MSVCRT ref: 001F64EB
malloc.MSVCRT ref: 001F6508
malloc.MSVCRT ref: 001F651E
exit.MSVCRT ref: 001F656A

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

longjmp.MSVCRT ref: 001F657F
free.MSVCRT ref: 001F664F
free.MSVCRT ref: 001F665D
free.MSVCRT ref: 001F666B
free.MSVCRT ref: 001F66C1
free.MSVCRT ref: 001F66CF
free.MSVCRT ref: 001F66DD

Strings

ERROR: can't close file %s, xrefs: 001F6533
Ts;, xrefs: 001F6630
read, xrefs: 001F65A7
@q(, xrefs: 001F6604, 001F6676
Ts;, xrefs: 001F66A2
%s, xrefs: 001F6557

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$malloc$Char_closeexitlongjmp
String ID: %s$@q($ERROR: can't close file %s$Ts;$Ts;$read
API String ID: 2545666375-20730449
Opcode ID: 2be5710dd91e27ad3e42088a5cf43a88e2b2167b3ed5caffe268f8cb8f1a96d4
Instruction ID: 90284ececa369331a3f22d852ee983d8c8f076c1af37ea23d31307124817a906
Opcode Fuzzy Hash: 2be5710dd91e27ad3e42088a5cf43a88e2b2167b3ed5caffe268f8cb8f1a96d4
Instruction Fuzzy Hash: F051E6B4A087199BCB21EF64C8856EDB7F0AF05340F4188ADE988E7241D774DE94CF81

Function 0020EA90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

_close.MSVCRT ref: 0020EAFB
malloc.MSVCRT ref: 0020EB1D
malloc.MSVCRT ref: 0020EB33
exit.MSVCRT ref: 0020EB7C
_close.MSVCRT ref: 0020EB8B
malloc.MSVCRT ref: 0020EBA5
malloc.MSVCRT ref: 0020EBB7

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 0020EC44
ERROR: can't close file %s, xrefs: 0020EB49
%s, xrefs: 0020EB69, 0020EC66

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$_close$exit
String ID: %s$ERROR: can't alloc %lu memory bytes$ERROR: can't close file %s
API String ID: 174611332-2669338241
Opcode ID: fbe0195eaaef8453dfa9723c130853ef8579d9347637be0c13f6eb27757d4b91
Instruction ID: 1820cdd3e4c492adac3d176fb71a0b5b75546c506f51847798c94b8aad773312
Opcode Fuzzy Hash: fbe0195eaaef8453dfa9723c130853ef8579d9347637be0c13f6eb27757d4b91
Instruction Fuzzy Hash: 2EA16F706143058FDB10EF28C48471ABBE1FF85310F16896DE9889B346D735D8A1CF92

Function 00244C80 Relevance: 28.2, APIs: 6, Strings: 10, Instructions: 153libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00244CD7
GetProcAddress.KERNEL32 ref: 00244CF8
FreeLibrary.KERNEL32 ref: 00244D7F

Strings

Vulkan: Failed to query instance extensions: %s, xrefs: 00244E8B
Vulkan: Loader not found, xrefs: 00244D90
Vulkan: Loader does not export vkGetInstanceProcAddr, xrefs: 00244DAE
Vulkan: Failed to query instance extension count: %s, xrefs: 00244D5B
vulkan-1.dll, xrefs: 00244CD0
VK_KHR_win32_surface, xrefs: 00244E64
Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties, xrefs: 00244F03
vkGetInstanceProcAddr, xrefs: 00244CED
VK_KHR_surface, xrefs: 00244E4E
vkEnumerateInstanceExtensionProperties, xrefs: 00244D0E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VK_KHR_surface$VK_KHR_win32_surface$Vulkan: Failed to query instance extension count: %s$Vulkan: Failed to query instance extensions: %s$Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties$Vulkan: Loader does not export vkGetInstanceProcAddr$Vulkan: Loader not found$vkEnumerateInstanceExtensionProperties$vkGetInstanceProcAddr$vulkan-1.dll
API String ID: 145871493-3031290315
Opcode ID: 8cb78db6a91977d147fb037ce5f34590dca7f60781befa190baa7ffb25cc703b
Instruction ID: 2eb542590465ad7181d824a3c9b78954d4f0440640c45672b4b8f005a4ee5087
Opcode Fuzzy Hash: 8cb78db6a91977d147fb037ce5f34590dca7f60781befa190baa7ffb25cc703b
Instruction Fuzzy Hash: 50518FB4A293019FD715BF74E94532B7BE0FB85344F05883DE88887214E7B488A9DB86

Function 001C60A0 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 150synchronizationprocesswindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 001C60BA

Part of subcall function 001EBE70: mbstowcs.MSVCRT ref: 001EBE8E

wcscmp.MSVCRT ref: 001C60EE
ReleaseMutex.KERNEL32 ref: 001C6151

Part of subcall function 001C51C0: CloseHandle.KERNEL32 ref: 001C51D1
Part of subcall function 001C51C0: CreateThread.KERNEL32 ref: 001C5284

MessageBoxW.USER32 ref: 001C61C7
ReleaseMutex.KERNEL32 ref: 001C61D8
CreateProcessW.KERNEL32 ref: 001C62A1
CloseHandle.KERNEL32 ref: 001C62B7
CloseHandle.KERNEL32 ref: 001C62C3
ReleaseMutex.KERNEL32 ref: 001C62E5

Part of subcall function 001EBCC0: mbstowcs.MSVCRT ref: 001EBCDE

Part of subcall function 001C27C0: GetFullPathNameW.KERNEL32 ref: 001C27F2
Part of subcall function 001C27C0: wcslen.MSVCRT ref: 001C2806
Part of subcall function 001C27C0: wcslen.MSVCRT ref: 001C281C
Part of subcall function 001C27C0: wcsncmp.MSVCRT ref: 001C2831

Strings

aA, xrefs: 001C6182
Error, xrefs: 001C61B0, 001C6308
Install Game, xrefs: 001C60E3
InstallCallback: MakeValidInstallpathInvalid path., xrefs: 001C61B8
InstallCallback: swprintfInvalid path., xrefs: 001C6310
%ls\%ls, xrefs: 001C622A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CloseHandleMutexRelease$Creatembstowcswcslen$FullMessageNameObjectPathProcessSingleThreadWaitwcscmpwcsncmp
String ID: %ls\%ls$Error$Install Game$InstallCallback: MakeValidInstallpathInvalid path.$InstallCallback: swprintfInvalid path.$aA
API String ID: 193152645-2585443390
Opcode ID: d84d5aaed086f8db001accc088b6e1abda18bb8ee4ca5910f0a7776b860f7d3d
Instruction ID: bef217cd90f747040ddbc64497ceacc743718baf50d405725df6bf4878cb8705
Opcode Fuzzy Hash: d84d5aaed086f8db001accc088b6e1abda18bb8ee4ca5910f0a7776b860f7d3d
Instruction Fuzzy Hash: 9D5114B55097019FD300EF68E98869EBBE0BB94715F01892DE8C887311EB75D488CF97

Function 0020B3D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 0020B100: free.MSVCRT ref: 0020B1B2
Part of subcall function 0020B100: malloc.MSVCRT ref: 0020B1C1
Part of subcall function 0020B100: _lseeki64.MSVCRT ref: 0020B1EB
Part of subcall function 0020B100: malloc.MSVCRT ref: 0020B20D
Part of subcall function 0020B100: malloc.MSVCRT ref: 0020B223
Part of subcall function 0020B100: exit.MSVCRT ref: 0020B265
Part of subcall function 0020B100: longjmp.MSVCRT ref: 0020B27F
Part of subcall function 0020B100: _read.MSVCRT ref: 0020B29D
Part of subcall function 0020B100: malloc.MSVCRT ref: 0020B2C7
Part of subcall function 0020B100: malloc.MSVCRT ref: 0020B2DD

malloc.MSVCRT ref: 0020B41A
malloc.MSVCRT ref: 0020B46C
exit.MSVCRT ref: 0020B4C4
malloc.MSVCRT ref: 0020B482

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

longjmp.MSVCRT ref: 0020B4E9
malloc.MSVCRT ref: 0020B4F7
malloc.MSVCRT ref: 0020B50D
exit.MSVCRT ref: 0020B557
free.MSVCRT ref: 0020B565
malloc.MSVCRT ref: 0020B59C
malloc.MSVCRT ref: 0020B5AE

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 0020B605
%s, xrefs: 0020B4B1, 0020B544
ERROR: unsupported compression method "%s", xrefs: 0020B520
ERROR: archive structure corrupted (decompression of control block failed), xrefs: 0020B491
ERROR: archive structure corrupted (control block failed CRC check), xrefs: 0020B5B9

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exitfree$longjmp$Char_lseeki64_read
String ID: %s$ERROR: archive structure corrupted (control block failed CRC check)$ERROR: archive structure corrupted (decompression of control block failed)$ERROR: can't alloc %lu memory bytes$ERROR: unsupported compression method "%s"
API String ID: 3950243888-519644090
Opcode ID: acb828d260cd1529935b8aa607ec181a1e192a1732dabccd7f0a07080b559e89
Instruction ID: 354c8434b8e7224d6f576b347403fd550ebb6f548adc295ea885832b27164e61
Opcode Fuzzy Hash: acb828d260cd1529935b8aa607ec181a1e192a1732dabccd7f0a07080b559e89
Instruction Fuzzy Hash: E35105B06187099BC721EF69C49121EFBE0BF48740F51C92DE9C897342DBB4D9508F92

Function 002445E0 Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 135libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 002445F0
GetProcAddress.KERNEL32 ref: 00244611
FreeLibrary.KERNEL32 ref: 0024467D
calloc.MSVCRT ref: 002446BF

Strings

Vulkan: Failed to query instance extensions: %s, xrefs: 002447AD
Vulkan: Loader not found, xrefs: 00244695
Vulkan: Loader does not export vkGetInstanceProcAddr, xrefs: 00244800
Vulkan: Failed to query instance extension count: %s, xrefs: 00244788
vulkan-1.dll, xrefs: 002445E9
VK_KHR_win32_surface, xrefs: 0024472D
Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties, xrefs: 002447D2
vkGetInstanceProcAddr, xrefs: 00244606
VK_KHR_surface, xrefs: 002446F6
vkEnumerateInstanceExtensionProperties, xrefs: 00244627

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProccalloc
String ID: VK_KHR_surface$VK_KHR_win32_surface$Vulkan: Failed to query instance extension count: %s$Vulkan: Failed to query instance extensions: %s$Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties$Vulkan: Loader does not export vkGetInstanceProcAddr$Vulkan: Loader not found$vkEnumerateInstanceExtensionProperties$vkGetInstanceProcAddr$vulkan-1.dll
API String ID: 2340843210-3031290315
Opcode ID: f279b82da9378494ea9bd26b4ff7ccfd44517478b03079893a753b15ef68c94e
Instruction ID: be028245dccc53f7e49cd2032f3b24c585f500405196439dcbe4b989bb9b8f03
Opcode Fuzzy Hash: f279b82da9378494ea9bd26b4ff7ccfd44517478b03079893a753b15ef68c94e
Instruction Fuzzy Hash: E04181B55293018FD714BF74EA4536BBBE4EB46344F02483DE8C887250E7B484A9CF96

Function 00244810 Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 133libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00244837
GetProcAddress.KERNEL32 ref: 00244858
FreeLibrary.KERNEL32 ref: 002448CA

Strings

Vulkan: Failed to query instance extensions: %s, xrefs: 002449A8
Vulkan: Loader not found, xrefs: 002448EB
Vulkan: Loader does not export vkGetInstanceProcAddr, xrefs: 00244A25
Vulkan: Failed to query instance extension count: %s, xrefs: 00244A08
vulkan-1.dll, xrefs: 00244830
VK_KHR_win32_surface, xrefs: 00244980
Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties, xrefs: 00244A4B
vkGetInstanceProcAddr, xrefs: 0024484D
VK_KHR_surface, xrefs: 0024494A
vkEnumerateInstanceExtensionProperties, xrefs: 0024486E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VK_KHR_surface$VK_KHR_win32_surface$Vulkan: Failed to query instance extension count: %s$Vulkan: Failed to query instance extensions: %s$Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties$Vulkan: Loader does not export vkGetInstanceProcAddr$Vulkan: Loader not found$vkEnumerateInstanceExtensionProperties$vkGetInstanceProcAddr$vulkan-1.dll
API String ID: 145871493-3031290315
Opcode ID: 8618d104bc51d62f44e2cc8d86859ff095ebc430348b0c20fe67c65ad3f728e6
Instruction ID: fc85c881d91e419e1b7395f3a5a501937a63c217f60132f4bc188a0ec3c955f7
Opcode Fuzzy Hash: 8618d104bc51d62f44e2cc8d86859ff095ebc430348b0c20fe67c65ad3f728e6
Instruction Fuzzy Hash: DC5150B59283419FD714BF74EA4532FBBE0EB45345F11443DE8C88B250E7B488A8DB86

Function 00206830 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 224COMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 00206857

Strings

:p%d, xrefs: 002069E0
:c%d, xrefs: 002069A4
:h%s, xrefs: 00206959
:x%d, xrefs: 00206BFB
data error, xrefs: 00206840
:al%d, xrefs: 00206AE1
:ah%s, xrefs: 00206AC3
:u%d, xrefs: 00206A0C
:s%d, xrefs: 00206BDB
:t%d, xrefs: 00206A33
tor%s:%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00206BAC
:%d, xrefs: 00206936
:fb%d, xrefs: 00206B16
:l%d, xrefs: 00206985

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exit
String ID: :%d$:ah%s$:al%d$:c%d$:fb%d$:h%s$:l%d$:p%d$:s%d$:t%d$:u%d$:x%d$data error$tor%s:%s%s%s%s%s%s%s%s%s%s%s%s
API String ID: 2483651598-677178743
Opcode ID: 166d99e3f8fd6f9333b8b84138b61182a4599a8f33cb9d72b5c97b7adaf522a2
Instruction ID: 2fcd537ceefdc8e309f827bf08bd362c183597edd978649d7ea0b40c7c758573
Opcode Fuzzy Hash: 166d99e3f8fd6f9333b8b84138b61182a4599a8f33cb9d72b5c97b7adaf522a2
Instruction Fuzzy Hash: 0BB1EEB59097408FC721DF29C18559AFBE4FF89740F51892EE88987316E730E994CF82

Function 0020F1A0 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 209COMMON

Download Yara Rule

Strings

ERROR: archive data corrupted (decompression fails), xrefs: 0020F413
ERROR: can't alloc %lu memory bytes, xrefs: 0020F162, 0020F4BA
%s, xrefs: 0020F0EE, 0020F184, 0020F322
ERROR: file seek operation failed, xrefs: 0020F302
ERROR: unsupported compression method %s, xrefs: 0020F455

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: %s$ERROR: archive data corrupted (decompression fails)$ERROR: can't alloc %lu memory bytes$ERROR: file seek operation failed$ERROR: unsupported compression method %s
API String ID: 0-762570233
Opcode ID: f49cf1668a89da687b5f1bdfa20cd84ccc379ace8b8bfd244f648a41baeef118
Instruction ID: 075d43012debb7a4ed45f487baddc4aa9eb40dcb159d4484b2459652e4636a9c
Opcode Fuzzy Hash: f49cf1668a89da687b5f1bdfa20cd84ccc379ace8b8bfd244f648a41baeef118
Instruction Fuzzy Hash: F98150B46287069FC760EF28C28062AB7E1BF44714F11857DE9989B782D774EC65CF82

Function 00244A55 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 134libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00244A97
GetProcAddress.KERNEL32 ref: 00244AB4
FreeLibrary.KERNEL32 ref: 00244B1B

Strings

Vulkan: Failed to query instance extensions: %s, xrefs: 00244C28
Vulkan: Loader does not export vkGetInstanceProcAddr, xrefs: 00244C4D
vulkan-1.dll, xrefs: 00244A90
VK_KHR_win32_surface, xrefs: 00244BCD
Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties, xrefs: 00244C73
vkGetInstanceProcAddr, xrefs: 00244AA9
VK_KHR_surface, xrefs: 00244B96
vkEnumerateInstanceExtensionProperties, xrefs: 00244ACA

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VK_KHR_surface$VK_KHR_win32_surface$Vulkan: Failed to query instance extensions: %s$Vulkan: Failed to retrieve vkEnumerateInstanceExtensionProperties$Vulkan: Loader does not export vkGetInstanceProcAddr$vkEnumerateInstanceExtensionProperties$vkGetInstanceProcAddr$vulkan-1.dll
API String ID: 145871493-369610246
Opcode ID: eae101333c7231a8ad70fd24abf841231120de07943f97a02c2e350bcb8857e2
Instruction ID: 51448e06e9fdac53e66eb63fd73a5c5877ec1a8c964da9b445ecb70786fc4465
Opcode Fuzzy Hash: eae101333c7231a8ad70fd24abf841231120de07943f97a02c2e350bcb8857e2
Instruction Fuzzy Hash: BA41B1B59283018FD714BF74E94536ABBE0EB41348F05483DE8888B254E7B5D8A9CBD6

Function 0024A8B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 0024A939
CreateDIBSection.GDI32 ref: 0024A96F
ReleaseDC.USER32 ref: 0024A989
CreateBitmap.GDI32 ref: 0024A9BE
CreateIconIndirect.USER32 ref: 0024AA4D
DeleteObject.GDI32 ref: 0024AA61
DeleteObject.GDI32 ref: 0024AA69
DeleteObject.GDI32 ref: 0024AB02

Strings

Win32: Failed to create mask bitmap, xrefs: 0024AAE9
Win32: Failed to create icon, xrefs: 0024AAB0
Win32: Failed to create RGBA bitmap, xrefs: 0024AAD1
Win32: Failed to create cursor, xrefs: 0024AA8B
|, xrefs: 0024A8E0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CreateDeleteObject$BitmapIconIndirectReleaseSection
String ID: Win32: Failed to create RGBA bitmap$Win32: Failed to create cursor$Win32: Failed to create icon$Win32: Failed to create mask bitmap$|
API String ID: 1620490831-2899190849
Opcode ID: ca76e7c9276d2b43136bb8688187718a753dacee84a7ee2e19c896133de72777
Instruction ID: 8063b5edbaa324b3b69b64e79ec65be82d25d11f4f58dff43c0fea01e9c20665
Opcode Fuzzy Hash: ca76e7c9276d2b43136bb8688187718a753dacee84a7ee2e19c896133de72777
Instruction Fuzzy Hash: FB61E0B55093418FD310EF68D68871AFBF0BB89304F00892EE8D98B352D7B5D948CB92

Function 001EED70 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 113processCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 001EEDB8
_get_osfhandle.MSVCRT ref: 001EEDC8
_get_osfhandle.MSVCRT ref: 001EEDD8
CreateProcessW.KERNEL32 ref: 001EEE5A
CloseHandle.KERNEL32 ref: 001EEE91
CloseHandle.KERNEL32 ref: 001EEE9D
_get_osfhandle.MSVCRT ref: 001EEEBD
_get_osfhandle.MSVCRT ref: 001EEECD
_get_osfhandle.MSVCRT ref: 001EEEDD
CreateProcessW.KERNEL32 ref: 001EEF5F

Strings

D, xrefs: 001EED8B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: _get_osfhandle$CloseCreateHandleProcess
String ID: D
API String ID: 900265694-2746444292
Opcode ID: f355bcc60106bcb3155a5b155726eade8a05dba52111c76b91c70e7fc473803b
Instruction ID: e83170fcde1070b8c5b9321e087a4b95a423f04083200f03539b89294bb6209b
Opcode Fuzzy Hash: f355bcc60106bcb3155a5b155726eade8a05dba52111c76b91c70e7fc473803b
Instruction Fuzzy Hash: EB516BB05083409FE760EF69D58875ABBF0BF85344F41892DE9D887391D7BA98488F87

Function 0023C66B Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?), ref: 0023C67E
QueryPerformanceFrequency.KERNEL32(?), ref: 0023C693

Part of subcall function 00211B93: GetCurrentThread.KERNEL32 ref: 00211BBE
Part of subcall function 00211B93: SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 00211BCA
Part of subcall function 00211B93: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,0023C6AC), ref: 00211BD2
Part of subcall function 00211B93: SetThreadAffinityMask.KERNEL32(0023C6AC,00000000), ref: 00211BE0

TlsAlloc.KERNEL32 ref: 0023C6B6
InitializeCriticalSection.KERNEL32(00359260), ref: 0023C6F9
InitializeCriticalSection.KERNEL32(0035BC74), ref: 0023C700
InitializeCriticalSection.KERNEL32(00357D30), ref: 0023C707
InitializeCriticalSection.KERNEL32(003577E0), ref: 0023C70E
InitializeCriticalSection.KERNEL32(003578A4), ref: 0023C715
InitializeCriticalSection.KERNEL32(0035A37C), ref: 0023C71C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0023C724
_strdup.MSVCRT(No sound,00000000,00000000), ref: 0023C736

Strings

BASS/2.4, xrefs: 0023C743
No sound, xrefs: 0023C72C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalInitializeSection$Thread$AffinityMaskPerformanceQuery$AllocCounterCreateCurrentEventFrequencyVersion_strdup
String ID: BASS/2.4$No sound
API String ID: 4876088-2048376307
Opcode ID: 80d9dae50627760b6df3598f2f02bc7b15b55aa3ed7a3e84c68b75feb3ac89ce
Instruction ID: b566fc992188c28c26f50f80c82d8a51d3dae9924b06fc3a7d4d7a69a731a994
Opcode Fuzzy Hash: 80d9dae50627760b6df3598f2f02bc7b15b55aa3ed7a3e84c68b75feb3ac89ce
Instruction Fuzzy Hash: 2F1163B0959728A6C6127BB1BD0E99A7EA8EF01B52F000556F848521B2DFB48550CFE6

Function 00276700 Relevance: 22.8, APIs: 4, Strings: 9, Instructions: 48threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00276774
_ultoa.MSVCRT ref: 0027678D
OutputDebugStringA.KERNEL32 ref: 002767CD
abort.MSVCRT ref: 002767D6

Strings

Erro, xrefs: 0027679F
r cl, xrefs: 0027671A
ng u, xrefs: 0027672A
p sp, xrefs: 00276732
eani, xrefs: 00276722
in_k, xrefs: 0027673A
for , xrefs: 0027674A
thre, xrefs: 00276752
eys , xrefs: 00276742

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Erro$eani$eys $for $in_k$ng u$p sp$r cl$thre
API String ID: 4191895893-1533723150
Opcode ID: 73fad2fb478e5b4c9c6d9406de47fe510be8939e2c08fc836ec99176b4f4d738
Instruction ID: fcdb2d82a145539607d62a9ebff85212172e7dcf6537a5bf88265fafb2ec0467
Opcode Fuzzy Hash: 73fad2fb478e5b4c9c6d9406de47fe510be8939e2c08fc836ec99176b4f4d738
Instruction Fuzzy Hash: 0F2117B011C7429FE728DF68D14972FFAE2EB81749F449D1CF0854A2A2C7B5CA588B47

Function 001ECC9C Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 192COMMON

Download Yara Rule

APIs

Part of subcall function 0020BAC0: InitializeCriticalSection.KERNEL32 ref: 0020BACA

Part of subcall function 0020B840: CreateEventW.KERNEL32 ref: 0020B869

free.MSVCRT ref: 001ECEFD
DeleteCriticalSection.KERNEL32 ref: 001ECF25
free.MSVCRT ref: 001ECF38
DeleteCriticalSection.KERNEL32 ref: 001ECF61
free.MSVCRT ref: 001ECF74
DeleteCriticalSection.KERNEL32 ref: 001ECF9D
free.MSVCRT ref: 001ECFB0
DeleteCriticalSection.KERNEL32 ref: 001ECFD6
free.MSVCRT ref: 001ECFE6
DeleteCriticalSection.KERNEL32 ref: 001ED006

Strings

`-(, xrefs: 001ECCE3, 001ECEEE
`-(, xrefs: 001ECE76, 001ECED4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$Deletefree$CreateEventInitialize
String ID: `-($`-(
API String ID: 2386916121-776069354
Opcode ID: 8417618d96c3313b6ec7a14e08be26150d09a4fb2e04a8a683c1da7cf703619e
Instruction ID: 6d8b2aa9e03d292aeabb4de424394f58206a477354211861ad8b14b60a5db8d2
Opcode Fuzzy Hash: 8417618d96c3313b6ec7a14e08be26150d09a4fb2e04a8a683c1da7cf703619e
Instruction Fuzzy Hash: 9B91D1B45197848FD720EF64C48979EBBE8BF88304F414D2DE9C987241EBB89558CF92

Function 001F4D40 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 104COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001F4D4B
longjmp.MSVCRT(?,?,00000000,002876A8), ref: 001F4D73
exit.MSVCRT ref: 001F4DC8

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 001F4D93
pmm:%d:%s%s, xrefs: 001F4E42
pmm, xrefs: 001F4DD4
:r0, xrefs: 001F4E23
:r2, xrefs: 001F4E17
%s, xrefs: 001F4DB5

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exitlongjmpmalloc
String ID: %s$:r0$:r2$ERROR: can't alloc %lu memory bytes$pmm$pmm:%d:%s%s
API String ID: 2723687207-131848308
Opcode ID: 61a506b32a4e3ce48b08d4ca5a8ae2a3e515f728101cd1a9193de7855f6f8ce5
Instruction ID: fbbd3cb74c03cdafacc0eece921dd11664c6b4a6667e2919cb532e7b2d518c81
Opcode Fuzzy Hash: 61a506b32a4e3ce48b08d4ca5a8ae2a3e515f728101cd1a9193de7855f6f8ce5
Instruction Fuzzy Hash: C5418DB55087089BD721EF68D98166FBBE1FF84700F51883EE98897306E7749845CB82

Function 001C20F0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 001C2185
WriteFile.KERNEL32 ref: 001C21D6
strncmp.MSVCRT ref: 001C21FB
strlen.MSVCRT ref: 001C220B
WriteFile.KERNEL32 ref: 001C2276
CloseHandle.KERNEL32 ref: 001C2299

Strings

PATH, xrefs: 001C2136
%INS, xrefs: 001C2126
\, xrefs: 001C224F
TALL, xrefs: 001C212E
%ls, xrefs: 001C210B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: File$Write$CloseCreateHandlestrlenstrncmp
String ID: %INS$%ls$PATH$TALL$\
API String ID: 791122412-4221683705
Opcode ID: 2cdbd1a0e5f79966f1f2d0cb2dd9ea7adf507cf0f922967b354f45a287b1f657
Instruction ID: 45305ade8f19cca3d5d16fff1f274854370416167187b9a2602ca1a20cfa7fcd
Opcode Fuzzy Hash: 2cdbd1a0e5f79966f1f2d0cb2dd9ea7adf507cf0f922967b354f45a287b1f657
Instruction Fuzzy Hash: 084138B04083419FD321AF68D98875FBFE0FB91304F01892DE89887251E3B9D548CB93

Function 001EF310 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

_close.MSVCRT ref: 001EF34B
malloc.MSVCRT ref: 001EF36C
malloc.MSVCRT ref: 001EF382
malloc.MSVCRT ref: 001EF3AF
CharToOemW.USER32 ref: 001EF3CD
free.MSVCRT ref: 001EF3D9
exit.MSVCRT ref: 001EF3F5

Strings

%s, xrefs: 001EF3E2
ERROR: can't close file %s, xrefs: 001EF394

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$Char_closeexitfree
String ID: %s$ERROR: can't close file %s
API String ID: 3661669792-2251370396
Opcode ID: ba754afb9ee74a2d37f7690f02ab5ce2a0251b9b5bf753922c04379d424d5e29
Instruction ID: 6075e42f92b4744c0f344ee60fd41330693a5b04ec78253d4134fbd7add6d117
Opcode Fuzzy Hash: ba754afb9ee74a2d37f7690f02ab5ce2a0251b9b5bf753922c04379d424d5e29
Instruction Fuzzy Hash: 8B3166B4908B419BD710BF39D98922E7BF0BF05305F45887CE8C897292DB78D886CB56

Function 0024ACA0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 0024ACB4
ScreenToClient.USER32 ref: 0024ACCE
SetCursor.USER32 ref: 0024AD09
GetClientRect.USER32 ref: 0024AD27
ClientToScreen.USER32 ref: 0024AD43
ClientToScreen.USER32 ref: 0024AD59
ClipCursor.USER32 ref: 0024AD61

Strings

Win32: Failed to register raw input device, xrefs: 0024ADCF

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Client$CursorScreen$ClipRect
String ID: Win32: Failed to register raw input device
API String ID: 15536226-3523228969
Opcode ID: 6ffb2b5fb355d33904818ddd97687caa53a96702278fa0a22a3f73d1dccee926
Instruction ID: f0583bc63455016355cd6987cd175bac58b9299b346870ab027e828eb679a33c
Opcode Fuzzy Hash: 6ffb2b5fb355d33904818ddd97687caa53a96702278fa0a22a3f73d1dccee926
Instruction Fuzzy Hash: E631C8B19187018FD704BF78E68925E7BF4AF45302F014939E8858B216E7B4D898CB97

Function 00285310 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00285346
DeleteCriticalSection.KERNEL32 ref: 00285372
free.MSVCRT ref: 00285384
DeleteCriticalSection.KERNEL32 ref: 002853A7
free.MSVCRT ref: 002853B9
DeleteCriticalSection.KERNEL32 ref: 002853DC
free.MSVCRT ref: 002853EB
DeleteCriticalSection.KERNEL32 ref: 00285408
free.MSVCRT ref: 00285417
DeleteCriticalSection.KERNEL32 ref: 00285434

Strings

`-(, xrefs: 00285333
`-(, xrefs: 00285318

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID: `-($`-(
API String ID: 2988086103-776069354
Opcode ID: 23af6a787881050e0e137f864d67648be4140ad140926a54655372d4a4b8a565
Instruction ID: 967c60d444c982040bee7e50b1778d26a81cfe6e7e4c5b73391bdab71e69f0a0
Opcode Fuzzy Hash: 23af6a787881050e0e137f864d67648be4140ad140926a54655372d4a4b8a565
Instruction Fuzzy Hash: BD3114B05157018BDB10BF38D8C57A97BE8AF00300F4509B9DC849F24AEB74E859CF92

Function 001C27C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 001C27F2
wcslen.MSVCRT ref: 001C2806
wcslen.MSVCRT ref: 001C281C
wcsncmp.MSVCRT ref: 001C2831
MessageBoxW.USER32 ref: 001C28BE
GetLastError.KERNEL32 ref: 001C28D0

Strings

MakeValidInstallPath: swprintfInvalid path., xrefs: 001C28AF
%ls\%ls, xrefs: 001C2849
%ls, xrefs: 001C2883
\, xrefs: 001C2810
Error, xrefs: 001C28A7
MakeValidInstallPath: GetFullPathName, xrefs: 001C28D6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: wcslen$ErrorFullLastMessageNamePathwcsncmp
String ID: %ls$%ls\%ls$Error$MakeValidInstallPath: GetFullPathName$MakeValidInstallPath: swprintfInvalid path.$\
API String ID: 1504657914-973090064
Opcode ID: 5c8c5840db9d3ed09ce7c11a9c12643ae51eaa2c56bfeb361840554d487b96d3
Instruction ID: 2dcdf9838934db9835281cc6500c6285101c95613a9d3dd908c2fc1d79531c21
Opcode Fuzzy Hash: 5c8c5840db9d3ed09ce7c11a9c12643ae51eaa2c56bfeb361840554d487b96d3
Instruction Fuzzy Hash: 4B3124B09083419BD710AF68D58979FBBE0FF90344F40892EE9C887250E7B9C588DB82

Function 0023F1D0 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 191stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 0023F235

Part of subcall function 00266290: _vsnprintf.MSVCRT ref: 002662BE

Part of subcall function 0024A7A0: TlsGetValue.KERNEL32 ref: 0024A7AD

calloc.MSVCRT ref: 0023F333

Strings

requ, xrefs: 0023F638
ble, xrefs: 0023F674
unav, xrefs: 0023F664
d fo, xrefs: 0023F64C
able, xrefs: 0023F5BC
este, xrefs: 0023F644
rmat, xrefs: 0023F654
aila, xrefs: 0023F66C
vail, xrefs: 0023F5B4
is , xrefs: 0023F65C
ERRO, xrefs: 0023F2F2

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Value_vsnprintfcallocstrcpy
String ID: is $ERRO$able$aila$ble$d fo$este$requ$rmat$unav$vail
API String ID: 1747977231-2917496816
Opcode ID: 2d943834818f8fa29555155e40a1a71252f74750151f0ba80bf6334ff22d2c1f
Instruction ID: c94771cefaf40aeda41b3721a85654a1cea86fca35f51191842ed671919f7573
Opcode Fuzzy Hash: 2d943834818f8fa29555155e40a1a71252f74750151f0ba80bf6334ff22d2c1f
Instruction Fuzzy Hash: B2A1C1B4819381DBC764CF56D68121ABBF0BB88744F519A1DF9C82B264C3B58A85CF4B

Function 001E6C30 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 240stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 001E6CBB
malloc.MSVCRT ref: 001E6D57
_strdup.MSVCRT ref: 001E6DEF
malloc.MSVCRT ref: 001E6F1E
_strdup.MSVCRT ref: 001E6F57

Strings

shader_link, xrefs: 001E6F95
shader_compile, xrefs: 001E6F50
glCreateShader, xrefs: 001E6EC3
glCreateProgram, xrefs: 001E6DE8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: _strdupmalloc$strlen
String ID: glCreateProgram$glCreateShader$shader_compile$shader_link
API String ID: 59699954-2841867725
Opcode ID: bc1fbfa4d7ec4bcb5a0da71060cb7694657b2a336b0f2d5519b197eafa917203
Instruction ID: f725352cd351424cb31c46a99245d9761574cebd42c4dcea5e296bee71c30a5e
Opcode Fuzzy Hash: bc1fbfa4d7ec4bcb5a0da71060cb7694657b2a336b0f2d5519b197eafa917203
Instruction Fuzzy Hash: F5A1E2B5608741CFC300EF69D58466EBBF0BF94794F45892DE8899B220DB74E849CB93

Function 001FB0D0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 0020BAC0: InitializeCriticalSection.KERNEL32 ref: 0020BACA

Part of subcall function 0020B840: CreateEventW.KERNEL32 ref: 0020B869

free.MSVCRT ref: 001FB2BC
DeleteCriticalSection.KERNEL32 ref: 001FB2EB
free.MSVCRT ref: 001FB2FE
DeleteCriticalSection.KERNEL32 ref: 001FB327
free.MSVCRT ref: 001FB33A
DeleteCriticalSection.KERNEL32 ref: 001FB363
free.MSVCRT ref: 001FB373
DeleteCriticalSection.KERNEL32 ref: 001FB393
free.MSVCRT ref: 001FB3A3
DeleteCriticalSection.KERNEL32 ref: 001FB3BF

Strings

$p;, xrefs: 001FB22D

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$Deletefree$CreateEventInitialize
String ID: $p;
API String ID: 2386916121-1580312572
Opcode ID: ec4d8079c5848adba148153dbbd72fae747f823ef94205c1dc2a0898c4bd6ccd
Instruction ID: 32fcd8ffb35f71a5cb3605d410b9a822a09e08e40ea81529a3b7a9320b08d934
Opcode Fuzzy Hash: ec4d8079c5848adba148153dbbd72fae747f823ef94205c1dc2a0898c4bd6ccd
Instruction Fuzzy Hash: 047180B45187498BD720EF64C18979EBBE8BF84304F414D2DEAC887282E7759558CF93

Function 00208920 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00208946
malloc.MSVCRT ref: 0020895C
exit.MSVCRT ref: 0020899E
longjmp.MSVCRT ref: 00208A18
malloc.MSVCRT ref: 00208A27
malloc.MSVCRT ref: 00208A39

Strings

Fatal error: DataTables::shift() was called with reversed arguments order, xrefs: 0020896B
Fatal error: DataTables::shift() called when list of tables contains more than one entry, xrefs: 00208A44
ERROR: can't alloc %lu memory bytes, xrefs: 00208A6E
%s, xrefs: 0020898B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exitlongjmp
String ID: %s$ERROR: can't alloc %lu memory bytes$Fatal error: DataTables::shift() called when list of tables contains more than one entry$Fatal error: DataTables::shift() was called with reversed arguments order
API String ID: 2151770896-3033669937
Opcode ID: 9973febfad92d202ce895f3cb808de8108488726b5a08e7d52057b401de16941
Instruction ID: 0150282973380d1acad705ef1b3eb8c0da658e88e0d5daaaa1122e5775e971ba
Opcode Fuzzy Hash: 9973febfad92d202ce895f3cb808de8108488726b5a08e7d52057b401de16941
Instruction Fuzzy Hash: C7317CB06283069BD310BF24D58562FBBE0BF85344F55C92EE4C89B342DB74C8A1CB96

Function 0023C760 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,?,?,?,?,00000000,0023C8FD,0023CD07,?,?,?,?,001C7AEF), ref: 0023C789
DeleteCriticalSection.KERNEL32(00359260,00357CE0,?,?,00000000,0023C8FD,0023CD07,?,?,?,?,001C7AEF), ref: 0023C81D
DeleteCriticalSection.KERNEL32(0035BC74,?,001C7AEF), ref: 0023C824
DeleteCriticalSection.KERNEL32(00357D30,?,001C7AEF), ref: 0023C82B
DeleteCriticalSection.KERNEL32(003577E0,?,001C7AEF), ref: 0023C832
DeleteCriticalSection.KERNEL32(003578A4,?,001C7AEF), ref: 0023C839
TlsGetValue.KERNEL32(?,001C7AEF), ref: 0023C84B
TlsFree.KERNEL32(00000000,?,001C7AEF), ref: 0023C85D
DeleteCriticalSection.KERNEL32(0035A37C,?,001C7AEF), ref: 0023C87F

Part of subcall function 0021105E: free.MSVCRT ref: 00211069

Strings

}5, xrefs: 0023C805
|5, xrefs: 0023C7F6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalDeleteSection$FreeValuefree
String ID: }5$|5
API String ID: 249185191-3269545665
Opcode ID: 6fe856705a75d4e704de384fb3f87e583081ee874f1bc416d82fa080e5c9705c
Instruction ID: e9ac5a251c387871e4ab3ce06e6eb31eaca970a26d852b7a0bb6dea42ca960af
Opcode Fuzzy Hash: 6fe856705a75d4e704de384fb3f87e583081ee874f1bc416d82fa080e5c9705c
Instruction Fuzzy Hash: B5218175E202A59BCA733F61ED41C89B7AAAF587117114020FE8062171CFB35CF59F90

Function 001F2220 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 66libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 001F2252
GetModuleFileNameW.KERNEL32(?,?,?,00000000,001F2794,?,?,00000000,?,00000000,001F28AF), ref: 001F229F
wcsrchr.MSVCRT ref: 001F22B3
wcscpy.MSVCRT ref: 001F22C6
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000,001F28AF), ref: 001F22D4
wcscpy.MSVCRT ref: 001F22E9
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,00000000,001F28AF), ref: 001F22F1

Strings

facompress.dll, xrefs: 001F22B8
\, xrefs: 001F22A8
facompress_mt.dll, xrefs: 001F22DE

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: LibraryLoadwcscpy$AddressFileModuleNameProcwcsrchr
String ID: \$facompress.dll$facompress_mt.dll
API String ID: 2746798982-1939784871
Opcode ID: 30068ba32f9c84be8595f6d818c25fecc3ac9574109a4a1a1b1d818fcb33604b
Instruction ID: 02cb66875397f0b38b4f56ed306e062984300cbc755c7ffdd84cf2a989f01484
Opcode Fuzzy Hash: 30068ba32f9c84be8595f6d818c25fecc3ac9574109a4a1a1b1d818fcb33604b
Instruction Fuzzy Hash: 202138F19097089BD710EF34FAC566ABBF0BB84344F01993DE88987216D374E4589B96

Function 00260190 Relevance: 18.2, APIs: 12, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 65652b8afde157f812c6c2e79bdf3d0b65b3659cd9a082886c18aa1794176e44
Instruction ID: 3bc58fe17ec756eebc02230d0b824b689fdfd0e5eeefc047bfb2ee0fafc12855
Opcode Fuzzy Hash: 65652b8afde157f812c6c2e79bdf3d0b65b3659cd9a082886c18aa1794176e44
Instruction Fuzzy Hash: B451BC716243078FD720DF28C4D476BB3E1AF85314F044A69E8A5DB351D330ECAAAB92

Function 001F06C0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 334COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001F06CC
longjmp.MSVCRT(?,?,00000000,00000000,001F1393,?,?,00000000,001ED421), ref: 001F06F3
exit.MSVCRT ref: 001F0742
EnterCriticalSection.KERNEL32 ref: 001F0779

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 001F070D
%s, xrefs: 001F072F
write, xrefs: 001F07FB, 001F0880, 001F08E7, 001F0955, 001F09EE, 001F0A80, 001F0AE5, 001F0B23
seek_output, xrefs: 001F09B5, 001F0A41, 001F0AA8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalEnterSectionexitlongjmpmalloc
String ID: %s$ERROR: can't alloc %lu memory bytes$seek_output$write
API String ID: 2473507763-2590168287
Opcode ID: fe743c7c5db289c3a6cbc0ae9fab100fa23200c6095110b36c6b1a299bedc9ed
Instruction ID: 2c54688f663e419891aa774372068401607f025485a2b19fb936cfaef196325a
Opcode Fuzzy Hash: fe743c7c5db289c3a6cbc0ae9fab100fa23200c6095110b36c6b1a299bedc9ed
Instruction Fuzzy Hash: 80E108B4908705DFDB41DF29C48465ABBE0FF88354F118A6DE9988B356E374E980CF82

Function 001F728C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 131stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 001F7293
_stricmp.MSVCRT ref: 001F72A7
strchr.MSVCRT ref: 001F72C3
strlen.MSVCRT ref: 001F72CE
malloc.MSVCRT ref: 001F72DB
memcpy.MSVCRT ref: 001F72F5
strlen.MSVCRT ref: 001F742C
exit.MSVCRT ref: 001F79FA
longjmp.MSVCRT ref: 001F7A0E

Strings

$$arcdatafile$$.tmp, xrefs: 001F73D4
$$arcpackedfile$$.tmp, xrefs: 001F73DE
,, xrefs: 001F7312

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strlen$_stricmpexitlongjmpmallocmemcpystrchr
String ID: $$arcdatafile$$.tmp$$$arcpackedfile$$.tmp$,
API String ID: 363984579-3666042910
Opcode ID: a22750a004beeed42c4bd0b22aeb3ccb5df5e0c7f9e73ae17f923e6ad2548180
Instruction ID: 80812dec64e1e522d1acea5934a0883e011f0c1dc003076fc44668ba302d88e3
Opcode Fuzzy Hash: a22750a004beeed42c4bd0b22aeb3ccb5df5e0c7f9e73ae17f923e6ad2548180
Instruction Fuzzy Hash: 64516DB1908B488FDB11DF28C48836EBBE0BF85314F41896DE988AB281D7759949CF52

Function 0025C670 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 0025C69F
vfprintf.MSVCRT ref: 0025C6BF
abort.MSVCRT ref: 0025C6C4
VirtualQuery.KERNEL32 ref: 0025C75B

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 0025C807
Address %p has no image-section, xrefs: 0025C81B
VirtualProtect failed with code 0x%x, xrefs: 0025C7D6
Mingw-w64 runtime failure:, xrefs: 0025C698

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 2513968241-1534286854
Opcode ID: ae2fc219b394b3442647951b91b257d09d9de4ac40177181a3c92e09ef4903c0
Instruction ID: 9d218dce86e371c7b0c5d52ec079117c5e131be9d492851f0cc1c3abaee7de5d
Opcode Fuzzy Hash: ae2fc219b394b3442647951b91b257d09d9de4ac40177181a3c92e09ef4903c0
Instruction Fuzzy Hash: 33519BB69153019FD710EF28D88561AFBE4FF88315F51C92DE8889B216E730E818CF96

Function 00274AF0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00274B22
CreateSemaphoreA.KERNEL32 ref: 00274B78
CreateSemaphoreA.KERNEL32 ref: 00274B9F
InitializeCriticalSection.KERNEL32 ref: 00274BBE
InitializeCriticalSection.KERNEL32 ref: 00274BC9
InitializeCriticalSection.KERNEL32 ref: 00274BD4

Strings

l, xrefs: 00274B13

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID: l
API String ID: 2075313795-2517025534
Opcode ID: 527470cc24e9005c66b042b7d906e8cb757ec133d2a5dce08452e87d41cd7c2f
Instruction ID: 2f224a5e462e3d0b6e851618bb459ecf97c86bef08d75d1c020b3f0a82a8237b
Opcode Fuzzy Hash: 527470cc24e9005c66b042b7d906e8cb757ec133d2a5dce08452e87d41cd7c2f
Instruction Fuzzy Hash: 28313CB15153018FEB10BF29E58835ABBE4EF40314F158A6DD8988B395E779D858CF82

Function 00287280 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

_close.MSVCRT ref: 0028728E
malloc.MSVCRT ref: 002872AB
exit.MSVCRT ref: 00287302
malloc.MSVCRT ref: 002872BD

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

longjmp.MSVCRT(?,?,?,?,?,?,00000000,00000000,?,?,0020F48A), ref: 0028732F
exit.MSVCRT ref: 00287391
_waccess.MSVCRT ref: 002873B1

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 0028735C
ERROR: can't close file %s, xrefs: 002872CB
%s, xrefs: 002872EF, 0028737E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exit$Char_close_waccessfreelongjmp
String ID: %s$ERROR: can't alloc %lu memory bytes$ERROR: can't close file %s
API String ID: 2206358687-2669338241
Opcode ID: f21b90d8b372b2a9c673a5527f0dc0bfe7ffc1922a4e7d02aea822925015cd15
Instruction ID: 36021dc32e257a4066141170887afbd7763a6da6d900ca11187696370f2af7dd
Opcode Fuzzy Hash: f21b90d8b372b2a9c673a5527f0dc0bfe7ffc1922a4e7d02aea822925015cd15
Instruction Fuzzy Hash: C33137B46297049BC310BF39D54631EBBE4BF44741F95886DE8CC9B242DBB8C8509B97

Function 001EEFA5 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 64synchronizationCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 001EEFE4
CoInitializeEx.OLE32 ref: 001EF015
ShellExecuteExW.SHELL32 ref: 001EF021
WaitForSingleObject.KERNEL32 ref: 001EF03D
CloseHandle.KERNEL32 ref: 001EF04D
GetActiveWindow.USER32 ref: 001EF068
CoInitializeEx.OLE32 ref: 001EF099
ShellExecuteExW.SHELL32 ref: 001EF0A5

Strings

@, xrefs: 001EEFDC
<, xrefs: 001EEFC0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ActiveExecuteInitializeShellWindow$CloseHandleObjectSingleWait
String ID: <$@
API String ID: 2501244953-1426351568
Opcode ID: f0891f29c3940f342ed2c1153644b7b686ae603553caca6a8fc9daf090585ab7
Instruction ID: 95e1d6caac4b798f4a4130055761ef5e53a7e6500c659615ed4a5c6c2b0678f0
Opcode Fuzzy Hash: f0891f29c3940f342ed2c1153644b7b686ae603553caca6a8fc9daf090585ab7
Instruction Fuzzy Hash: E021CEB15083018FD310EF68EA8870EBBF1BB85705F014A2DE89997341EB75D5498B96

Function 001F2279 Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 001F2252
GetModuleFileNameW.KERNEL32(?,?,?,00000000,001F2794,?,?,00000000,?,00000000,001F28AF), ref: 001F229F
wcsrchr.MSVCRT ref: 001F22B3
wcscpy.MSVCRT ref: 001F22C6
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000,001F28AF), ref: 001F22D4
wcscpy.MSVCRT ref: 001F22E9
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,00000000,001F28AF), ref: 001F22F1
GetProcAddress.KERNEL32 ref: 001F230C

Strings

facompress.dll, xrefs: 001F22B8
\, xrefs: 001F22A8
facompress_mt.dll, xrefs: 001F22DE

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressLibraryLoadProcwcscpy$FileModuleNamewcsrchr
String ID: \$facompress.dll$facompress_mt.dll
API String ID: 3125217424-1939784871
Opcode ID: 716b93104175b4028e1245a28763cced54df2f4ef26dc0485e21ecff4b688ed7
Instruction ID: 96137e5f454bf5c66056b58488ee26b39b16f12e19eb7cbb367012650648c1ff
Opcode Fuzzy Hash: 716b93104175b4028e1245a28763cced54df2f4ef26dc0485e21ecff4b688ed7
Instruction Fuzzy Hash: 831103B59097088BD700EF34EA8526ABBF0BB84348F01993DE98987316D778A4599B46

Function 002428F0 Relevance: 16.7, APIs: 11, Instructions: 167COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0024294F
free.MSVCRT ref: 0024295A
free.MSVCRT ref: 00242965
free.MSVCRT ref: 00242970
free.MSVCRT ref: 0024297B
free.MSVCRT ref: 00242986
free.MSVCRT ref: 00242991
free.MSVCRT ref: 0024299B
realloc.MSVCRT ref: 00242ADC

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$realloc
String ID:
API String ID: 3347955621-0
Opcode ID: c0796f6711784f4569e8bf613fe5e496ee828f27997d8107ec6bb06479017792
Instruction ID: 038e4f7ab1bbb366ec36337b693a912ca74f472480d254f2911c489dc6828832
Opcode Fuzzy Hash: c0796f6711784f4569e8bf613fe5e496ee828f27997d8107ec6bb06479017792
Instruction Fuzzy Hash: 3161F6B5528301DFC714EF2AD48165ABBE0BF85300F95882EF9858B311E774E959DF82

Function 001FE050 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 135COMMON

Download Yara Rule

APIs

tolower.MSVCRT ref: 001FE17E

Strings

fast, xrefs: 001FE132, 001FE23F
:lp%d, xrefs: 001FE0FB
a%d, xrefs: 001FE26E
:pb%d, xrefs: 001FE0B1
normal, xrefs: 001FE21B, 001FE23A
:lc%d, xrefs: 001FE0D6
max, xrefs: 001FE220
lzma:%s%s%s:%s:%d%s%s%s%s, xrefs: 001FE1F5
%s:%s, xrefs: 001FE14E
:mc%d, xrefs: 001FE08D

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: tolower
String ID: %s:%s$:lc%d$:lp%d$:mc%d$:pb%d$a%d$fast$lzma:%s%s%s:%s:%d%s%s%s%s$max$normal
API String ID: 3025214199-117223130
Opcode ID: c7eb5566bc3e3cbf56bf27671e25cd8a35770a87f818b7f896f59b1b5141653e
Instruction ID: 1982b308ab3aea115634da84e27ffaa6ed9aca707bb08bd4d88a3d3029eeea3b
Opcode Fuzzy Hash: c7eb5566bc3e3cbf56bf27671e25cd8a35770a87f818b7f896f59b1b5141653e
Instruction Fuzzy Hash: 1751F8B85097449BCB55DF24C5805AABBE5BFC8740F51C83EE88887315E731D9458B82

Function 001CE3E0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 299libraryloaderCOMMON

Download Yara Rule

APIs

MonitorFromWindow.USER32 ref: 001CE439
malloc.MSVCRT ref: 001CE5C4
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-00000010,00000001,0139290C), ref: 001CE767
GetProcAddress.KERNEL32 ref: 001CE77F

Strings

Could not initialize NanoVG!, xrefs: 0032F0D4
N2, xrefs: 0032F109
GetDpiForMonitor, xrefs: 001CE774
shcore, xrefs: 001CE760

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressFromLibraryLoadMonitorProcWindowmalloc
String ID: Could not initialize NanoVG!$GetDpiForMonitor$shcore$N2
API String ID: 2860666693-2125931875
Opcode ID: ff56f92e75b8a45c26dca7ffbbdea52399bdc718e21c964dfd6ed50d8cedaff8
Instruction ID: 7627f4a4d04526953a5662f568e1bc4d617ebfa8d9adad5f3b9ca64ea01cec40
Opcode Fuzzy Hash: ff56f92e75b8a45c26dca7ffbbdea52399bdc718e21c964dfd6ed50d8cedaff8
Instruction Fuzzy Hash: 03D157B0908310DFDB04AF64D58979EBBF4BF54304F12886DE8899B252E778D894CF96

Function 001DEAC0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 134stringCOMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 001DEAF2
calloc.MSVCRT ref: 001DEB11
malloc.MSVCRT ref: 001DEB27
strncpy.MSVCRT ref: 001DEB7B
free.MSVCRT ref: 001DEC8C
free.MSVCRT ref: 001DECA1
free.MSVCRT ref: 001DECAE
free.MSVCRT ref: 001DECBC

Strings

?, xrefs: 001DEB60

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$callocmallocreallocstrncpy
String ID: ?
API String ID: 882788776-1684325040
Opcode ID: 5be90a16218e64df58aade3fb22e4dc54e3777b0bac78db101d2c698291a7d2b
Instruction ID: 81f93c6eab5fc964d351eacdd18357db9d85d03442ac86f8e2286b6cb99f7614
Opcode Fuzzy Hash: 5be90a16218e64df58aade3fb22e4dc54e3777b0bac78db101d2c698291a7d2b
Instruction Fuzzy Hash: 5851F270518701CFC710EF29C48465ABBE0BF84354F458A6EE8A89B396E731D969CF52

Function 002483C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

GetRawInputDeviceList.USER32 ref: 002483F3
calloc.MSVCRT ref: 00248421
GetRawInputDeviceList.USER32 ref: 00248437
free.MSVCRT ref: 002484D8

Strings

, xrefs: 00248479
, xrefs: 00248471
IG_, xrefs: 00248537

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: DeviceInputList$callocfree
String ID: $ $IG_
API String ID: 544165277-467309895
Opcode ID: a646fefc831c2349561a2d6df7f7628b52d8d612785ce3826756b5f09ea92721
Instruction ID: 57a32386517ab1ad8f48b5aa8b837b93bfb95bc4be1f464aa2b7c1963e69cac9
Opcode Fuzzy Hash: a646fefc831c2349561a2d6df7f7628b52d8d612785ce3826756b5f09ea92721
Instruction Fuzzy Hash: 634158705283028FD754EF28D48462FBBE0EF84368F108D2EE998C7390E774D9598B52

Function 00206F50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00206F7B
malloc.MSVCRT ref: 00206FB6
malloc.MSVCRT ref: 00206FC8
exit.MSVCRT ref: 0020700E
longjmp.MSVCRT ref: 00207027
exit.MSVCRT ref: 0020707F

Strings

Fatal error: putbuf %d in buffer of size %d, xrefs: 00206FDB
ERROR: can't alloc %lu memory bytes, xrefs: 0020704A
%s, xrefs: 00206FFB, 0020706C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exitmalloc$longjmpmemcpy
String ID: %s$ERROR: can't alloc %lu memory bytes$Fatal error: putbuf %d in buffer of size %d
API String ID: 3121113658-225099155
Opcode ID: 6d15ef7c1fbfe8b1ac8c41dca9c3b3b71c85c09266491aeb4c93a8d5d8f94663
Instruction ID: f3b818488967a4a296aab73fd9d97338c38631ac3504dfa47838faca331fd01a
Opcode Fuzzy Hash: 6d15ef7c1fbfe8b1ac8c41dca9c3b3b71c85c09266491aeb4c93a8d5d8f94663
Instruction Fuzzy Hash: 7F4103B09187019BC700EF69C48570ABBE0BF88718F55CA6DE88C9B346D775D851CF92

Function 002228A1 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 109stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00221D09: memset.MSVCRT ref: 00221D27
Part of subcall function 00221D09: memcpy.MSVCRT(-00000006,?,?,?,0000F000,00225512,-00000006,?,?,?,00000000), ref: 00221D54

memcpy.MSVCRT(00000000,?,00000000,?), ref: 0022296F

Part of subcall function 00210FF1: malloc.MSVCRT ref: 00210FF5

strtoul.MSVCRT ref: 00222991

Strings

STPM, xrefs: 00222946
PNAM, xrefs: 002229B0
XTPM, xrefs: 0022293B
MIDI, xrefs: 0022292C
CHFX, xrefs: 00222951
text, xrefs: 002228ED
CNAM, xrefs: 002229A9

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: memcpy$mallocmemsetstrtoul
String ID: CHFX$CNAM$MIDI$PNAM$STPM$XTPM$text
API String ID: 1671770056-2404278218
Opcode ID: b5e4d0e0f9cca1d1d5cda82d00178bbbf711984f0cb8109ef05308aaa9d85798
Instruction ID: 3e774189bbd1d3c8619430924b06aafb6a41ee7f5d66faa28fd5c2f6b40cd9cf
Opcode Fuzzy Hash: b5e4d0e0f9cca1d1d5cda82d00178bbbf711984f0cb8109ef05308aaa9d85798
Instruction Fuzzy Hash: E6310A75624362FADF25AEE4BC82B7D379C5B61300F300516E845C7042DA66D9FC8712

Function 00208360 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 108COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00208398
exit.MSVCRT ref: 002083FC
malloc.MSVCRT ref: 002083AE

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

longjmp.MSVCRT ref: 0020843F
memcpy.MSVCRT ref: 00208472
exit.MSVCRT ref: 002084F2

Strings

Fatal error: DataTables::add() called with _table_type=%d that is larger than maximum allowed %d, xrefs: 002083C9
ERROR: can't alloc %lu memory bytes, xrefs: 002084BD
%s, xrefs: 002083E9, 002084DF

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exit$Charfreelongjmpmemcpy
String ID: %s$ERROR: can't alloc %lu memory bytes$Fatal error: DataTables::add() called with _table_type=%d that is larger than maximum allowed %d
API String ID: 435699479-403071077
Opcode ID: 53b965d1ad0238b0c5d568f22bc92929c86f4ead037dc55c386b1aaad7853b71
Instruction ID: 9f6e2776c46dd18203c4952aa47f61f0bc32d43460f9125031ce77f3d9c81130
Opcode Fuzzy Hash: 53b965d1ad0238b0c5d568f22bc92929c86f4ead037dc55c386b1aaad7853b71
Instruction Fuzzy Hash: F84121B0518712CFCB10EF28C58561ABBE0BF89344F55C96EE8C88B206D774D891CF92

Function 001F6326 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 91stringCOMMON

Download Yara Rule

APIs

_wrename.MSVCRT ref: 001F6380
_wopen.MSVCRT ref: 001F639F
_wrename.MSVCRT ref: 001F63FC
_wopen.MSVCRT ref: 001F641B
_filelengthi64.MSVCRT ref: 001F6449
_filelengthi64.MSVCRT ref: 001F645A
malloc.MSVCRT ref: 001F647F
malloc.MSVCRT ref: 001F6904
malloc.MSVCRT ref: 001F6920
malloc.MSVCRT ref: 001F693A
strcpy.MSVCRT ref: 001F6993

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 001F6EBA
quasiwrite, xrefs: 001F646E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$_filelengthi64_wopen_wrename$strcpy
String ID: ERROR: can't alloc %lu memory bytes$quasiwrite
API String ID: 3285416094-3075816745
Opcode ID: b6b28c5c1575f6aab556f6f1592b1eb85f7fc331484e8b73d9234555af4c68cb
Instruction ID: 38e71920a0543d46f73bc51191eabd6a2fedb3c07860080bfcae294eb01b82c2
Opcode Fuzzy Hash: b6b28c5c1575f6aab556f6f1592b1eb85f7fc331484e8b73d9234555af4c68cb
Instruction Fuzzy Hash: 3941A1B49087189FCB65DF68C9847AABBF0BF49304F0188A9EA88E7310D774D984CF51

Function 0024AE20 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

ClipCursor.USER32 ref: 0024AE4A
ClientToScreen.USER32 ref: 0024AEB1
SetCursorPos.USER32 ref: 0024AEC9
SetCursor.USER32 ref: 0024AEEC
RegisterRawInputDevices.USER32 ref: 0024AF4B

Strings

Win32: Failed to remove raw input device, xrefs: 0024AF5C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Cursor$ClientClipDevicesInputRegisterScreen
String ID: Win32: Failed to remove raw input device
API String ID: 630632200-53561655
Opcode ID: d079db03ceddae1025e91f7a7f3b438b5ce19586c91992915fb5da6b483e0e25
Instruction ID: de5b673cdab3c6f97347cd760873526b0b3c8d6fa20246cfa194fe0f91b5882f
Opcode Fuzzy Hash: d079db03ceddae1025e91f7a7f3b438b5ce19586c91992915fb5da6b483e0e25
Instruction Fuzzy Hash: 123109B1509301CFD740AF65E64835EBBF0BF8430AF01496DE8898B225E7B5D998CB97

Function 0020EAF4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51stringCOMMON

Download Yara Rule

APIs

_close.MSVCRT ref: 0020EAFB
malloc.MSVCRT ref: 0020EB1D
malloc.MSVCRT ref: 0020EB33

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

exit.MSVCRT ref: 0020EB7C
_close.MSVCRT ref: 0020EB8B
malloc.MSVCRT ref: 0020EBA5
malloc.MSVCRT ref: 0020EBB7
_wremove.MSVCRT ref: 0020EBE3
longjmp.MSVCRT(?,?,00000000,0020F11C,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0020EC17
exit.MSVCRT ref: 0020EC79
strcpy.MSVCRT ref: 0020ECFF
CharToOemW.USER32 ref: 0020ED35
_wmkdir.MSVCRT ref: 0020ED8B

Strings

ERROR: can't close file %s, xrefs: 0020EB49
%s, xrefs: 0020EB69

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$Char_closeexit$_wmkdir_wremovefreelongjmpstrcpy
String ID: %s$ERROR: can't close file %s
API String ID: 4173340046-2251370396
Opcode ID: 9235dd09dc0a3e8686b63c70b0d42c3543601ae94b9e89fb59001931a1da2693
Instruction ID: 3dfd0e9aef414422d0938d4a1a4ca68a9a448cfddb6c0bc7085631ce392e4d0d
Opcode Fuzzy Hash: 9235dd09dc0a3e8686b63c70b0d42c3543601ae94b9e89fb59001931a1da2693
Instruction Fuzzy Hash: 74112EB05287129BEB60BF25C44132E7AE1BF55341F57CC2DE8C99B242DB74C8909F52

Function 0022D103 Relevance: 15.1, APIs: 10, Instructions: 115threadtimesynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0022D11B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0022D126
timeGetTime.WINMM ref: 0022D133
CreateThread.KERNEL32(00000000,00000000,Function_0006CEBE,00000000,00000004,?), ref: 0022D177
SetThreadAffinityMask.KERNEL32(00000000,?), ref: 0022D192
SetThreadPriority.KERNEL32(?,0000000F), ref: 0022D19E
ResumeThread.KERNEL32(?), ref: 0022D1A8
CloseHandle.KERNEL32(?), ref: 0022D1B2
WaitForSingleObject.KERNEL32(000000FF), ref: 0022D1DE
timeGetTime.WINMM ref: 0022D1E4

Part of subcall function 0022CF71: SetEvent.KERNEL32(0022D079,?), ref: 0022CF85
Part of subcall function 0022CF71: WaitForSingleObject.KERNEL32(000000FF), ref: 0022CF93

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Thread$CreateEvent$ObjectSingleTimeWaittime$AffinityCloseHandleMaskPriorityResume
String ID:
API String ID: 1353328452-0
Opcode ID: 02b9f346aec81e54f507a24a140063c30514e8a1cf7b007687c516fc965357d0
Instruction ID: 9bdf41528259cf67d4761ee456076407cea977b2ec8ba513b4c4c4d8ab7901f3
Opcode Fuzzy Hash: 02b9f346aec81e54f507a24a140063c30514e8a1cf7b007687c516fc965357d0
Instruction Fuzzy Hash: D5319072624326AFDB15AFB4BD8A82E76BDF715352B00053AF905D25B1DB709C208A54

Function 00282C30 Relevance: 15.1, APIs: 10, Instructions: 80COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00282C51
DeleteCriticalSection.KERNEL32 ref: 00282C7D
free.MSVCRT ref: 00282C8F
DeleteCriticalSection.KERNEL32 ref: 00282CB2
free.MSVCRT ref: 00282CC4
DeleteCriticalSection.KERNEL32 ref: 00282CE7
free.MSVCRT ref: 00282CF6
DeleteCriticalSection.KERNEL32 ref: 00282D13
free.MSVCRT ref: 00282D22
DeleteCriticalSection.KERNEL32 ref: 00282D3F

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 2e009767229964c900a27ed4f5c03e2f1d385842b691b1625bad2015e7a0ce50
Instruction ID: bce6274e3b4b6355ffd72d502a6c012349070a669fbce722ab0a908772170e73
Opcode Fuzzy Hash: 2e009767229964c900a27ed4f5c03e2f1d385842b691b1625bad2015e7a0ce50
Instruction Fuzzy Hash: 0331E4B14157058ADB10BF78D9857A97BE8AF00300F4609B9DC849F24BEB74E559CF92

Function 00212655 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 253libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(avrt.dll), ref: 00212670
GetProcAddress.KERNEL32(00000000,AvSetMmThreadCharacteristicsA), ref: 00212684
GetProcAddress.KERNEL32(00000000,AvRevertMmThreadCharacteristics), ref: 00212691
WaitForSingleObject.KERNEL32(?,?), ref: 002126E4

Strings

Audio, xrefs: 0021269D
AvSetMmThreadCharacteristicsA, xrefs: 0021267E
AvRevertMmThreadCharacteristics, xrefs: 00212686
avrt.dll, xrefs: 0021266B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressProc$LibraryLoadObjectSingleWait
String ID: Audio$AvRevertMmThreadCharacteristics$AvSetMmThreadCharacteristicsA$avrt.dll
API String ID: 781169432-2339331680
Opcode ID: ab5d16e2c6c78f13fba69fd04ea1524df1326f84aab9b28d63da022ae245b619
Instruction ID: 674c9f29d1b48223e1a403eee4b408708d359f3c6ce960b65bfc4b4b4d2c108a
Opcode Fuzzy Hash: ab5d16e2c6c78f13fba69fd04ea1524df1326f84aab9b28d63da022ae245b619
Instruction Fuzzy Hash: 9EA1ADB0624702DFC710EF25C884AABB7E8FB95315F10092DF596932A1DB70D8A9CF52

Function 00246350 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 0024DA22
GetMonitorInfoW.USER32 ref: 0024DA92
SetWindowPos.USER32 ref: 0024DAD8

Strings

(, xrefs: 0024DA80

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Window$InfoMonitor
String ID: (
API String ID: 544073309-3887548279
Opcode ID: 759e4b0110c85ffc5f39cdbd953137df8b41f44a3f61d3d3e16695e35d75d36d
Instruction ID: 4e8e5d4a1ccea8c2b8b26361b9ba059a3646bd7e4091ae2655d2195060f78033
Opcode Fuzzy Hash: 759e4b0110c85ffc5f39cdbd953137df8b41f44a3f61d3d3e16695e35d75d36d
Instruction Fuzzy Hash: 6F8113B56183018FD708DF28D59871ABBE0FF84314F158A2DE8898B355E774D898CF86

Function 00284640 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00284664
exit.MSVCRT ref: 002846B4
malloc.MSVCRT ref: 00284676

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

longjmp.MSVCRT ref: 002846DF
exit.MSVCRT ref: 00284741

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 0028470C
ERROR: archive structure corrupted (bad data), xrefs: 00284681
%s, xrefs: 002846A1, 0028472E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exit$Charfreelongjmp
String ID: %s$ERROR: archive structure corrupted (bad data)$ERROR: can't alloc %lu memory bytes
API String ID: 2693856100-1639016738
Opcode ID: cf0fc5dce8ec68d5ac0096116bf62ba5cabf72d8a9d0c17707bc33a02ae01767
Instruction ID: bf3e859c3cfda698c44942ec57aef0edfe72ca2349b70eb328d680645465caa0
Opcode Fuzzy Hash: cf0fc5dce8ec68d5ac0096116bf62ba5cabf72d8a9d0c17707bc33a02ae01767
Instruction Fuzzy Hash: 862138B45293159BC310BF68D54631EBBE4BF05748F42882DE5CC9B242DBB9D8A0CF96

Function 001F1190 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001F11B5
exit.MSVCRT ref: 001F1209
malloc.MSVCRT ref: 001F11CB

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

longjmp.MSVCRT ref: 001F123F
exit.MSVCRT ref: 001F1297

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 001F1262
%s, xrefs: 001F11F6, 001F1284
INTERNAL ERROR: Overflow of compression methods table, xrefs: 001F11D6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exit$Charfreelongjmp
String ID: %s$ERROR: can't alloc %lu memory bytes$INTERNAL ERROR: Overflow of compression methods table
API String ID: 2693856100-3746232221
Opcode ID: 98a53110573e54ec7b0e53c45102374a2f3b55820f31f9a05ec6c9765b2002d5
Instruction ID: 2b02f679af20e233ba2d1357e3d77ffeaedf09ce3b5d58ba19402d011f82b6d3
Opcode Fuzzy Hash: 98a53110573e54ec7b0e53c45102374a2f3b55820f31f9a05ec6c9765b2002d5
Instruction Fuzzy Hash: B02127B0919714DBD311BFA5D88122EBBE4FF44700F42992DE5C8D7216D7788850CF96

Function 001F12C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001F12E5
exit.MSVCRT ref: 001F1339
malloc.MSVCRT ref: 001F12FB

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

longjmp.MSVCRT(?,?,00000000,001ED421), ref: 001F137F
exit.MSVCRT ref: 001F13D7

Strings

Too much external compression methods defined, xrefs: 001F1306
ERROR: can't alloc %lu memory bytes, xrefs: 001F13A2
%s, xrefs: 001F1326, 001F13C4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exit$Charfreelongjmp
String ID: %s$ERROR: can't alloc %lu memory bytes$Too much external compression methods defined
API String ID: 2693856100-2943636624
Opcode ID: c0090ea9863fad7bd0a3f1854ea8cb769e28c1988c827de3a23ee57f370d4096
Instruction ID: 87aec57e453143bc692e78e304958486985d5d651d4b7561074b7f479eadd36e
Opcode Fuzzy Hash: c0090ea9863fad7bd0a3f1854ea8cb769e28c1988c827de3a23ee57f370d4096
Instruction Fuzzy Hash: CC2115B0519718EBD310BF64D94222EBBE0FF44714F42982DE5C897212DBB98850CF96

Function 001C52D0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 60windowCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 001C53B6
MessageBoxW.USER32 ref: 001C53EF

Strings

xcopy, xrefs: 001C539F
%ls\%ls, xrefs: 001C52FE, 001C5330
/E /I /Y "%ls" "%ls", xrefs: 001C536F
ApplyCrack: swprintfInvalid path., xrefs: 001C53E0
Error, xrefs: 001C53D8
open, xrefs: 001C53A7

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ExecuteMessageShell
String ID: %ls\%ls$/E /I /Y "%ls" "%ls"$ApplyCrack: swprintfInvalid path.$Error$open$xcopy
API String ID: 649218774-3634419400
Opcode ID: bf21978c83fdad99ceec528087186516f039e5646bad9420b2c9f6332692f026
Instruction ID: aec0608948c793c28090289c923ae79e06516c8b231fc79544f5612dabf00763
Opcode Fuzzy Hash: bf21978c83fdad99ceec528087186516f039e5646bad9420b2c9f6332692f026
Instruction Fuzzy Hash: A921ECB05097419BD310EF64D98879FBBF0BBA5748F01CD1DE59947204E7B8D5888B83

Function 001EE610 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 001EE625
strlen.MSVCRT ref: 001EE633

Part of subcall function 001EDC30: strlen.MSVCRT ref: 001EDC42
Part of subcall function 001EDC30: strlen.MSVCRT ref: 001EDC4C
Part of subcall function 001EDC30: memcpy.MSVCRT(?,?,00000000,?,?,?,001EE650,?,?,?,?,?,?,00000000,001EE863), ref: 001EDC76
Part of subcall function 001EDC30: strcpy.MSVCRT(?,?,00000000,?,?,?,001EE650,?,?,?,?,?,?,00000000,001EE863), ref: 001EDC82
Part of subcall function 001EDC30: strcat.MSVCRT(?,?,00000000,?,?,?,001EE650,?,?,?,?,?,?,00000000,001EE863), ref: 001EDC96

strlen.MSVCRT ref: 001EE663
malloc.MSVCRT ref: 001EE66E
memcpy.MSVCRT(?,?,?,?,?,?,00000000,001EE863), ref: 001EE684

Strings

%s, xrefs: 001EE5CA
ERROR: can't alloc %lu memory bytes, xrefs: 001EE580

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strlen$memcpy$mallocstrcatstrcpystrstr
String ID: %s$ERROR: can't alloc %lu memory bytes
API String ID: 192757537-701587655
Opcode ID: daa2fd3e59e5fef58a834d8b1c674f0b730eede22ad7ab46b8b3f82f986dd639
Instruction ID: a576605474661bdbc5846a3b9b0a3837087c4970071eaf4208dabd89168872e3
Opcode Fuzzy Hash: daa2fd3e59e5fef58a834d8b1c674f0b730eede22ad7ab46b8b3f82f986dd639
Instruction Fuzzy Hash: D11148B16187109BD700BF29A98516EFBE4FF88314F058D2EE4C893301D77499449F82

Function 00212588 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(dsound,?,00214043,0038388C,0038389C), ref: 00212597
GetProcAddress.KERNEL32(00000000,DirectSoundEnumerateW), ref: 002125B0
GetProcAddress.KERNEL32(00000000,DirectSoundCaptureEnumerateW), ref: 002125BD
GetProcAddress.KERNEL32(00000000,DirectSoundCreate8), ref: 002125CA

Strings

dsound, xrefs: 00212592
DirectSoundEnumerateW, xrefs: 002125AA
DirectSoundCaptureEnumerateW, xrefs: 002125B2
DirectSoundCreate8, xrefs: 002125BF

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: DirectSoundCaptureEnumerateW$DirectSoundCreate8$DirectSoundEnumerateW$dsound
API String ID: 2238633743-2705328528
Opcode ID: d93dacc85890811040b04b07c7cb4ad202dc344ebd42491db60de76dd9598865
Instruction ID: ea1137182575f0aa1ca69160cddb26b951e97fecb2d9926b1ac00a69513ce9de
Opcode Fuzzy Hash: d93dacc85890811040b04b07c7cb4ad202dc344ebd42491db60de76dd9598865
Instruction Fuzzy Hash: 5EE0657191031CAAC7125F79AD49AAA7AFCA795712F04015BF000D3270DBF45481CF94

Function 00200140 Relevance: 13.8, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0020015C
free.MSVCRT ref: 00200197

Strings

write, xrefs: 0020022C, 002004BF, 00200605
read, xrefs: 00200177, 002001D9, 002001FD, 00200249, 0020028E, 00200366, 00200407

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: freemalloc
String ID: read$write
API String ID: 3061335427-1125055369
Opcode ID: ae02aee0a3798f5a7ad56022646c4ad9163d618da48a4e1f630feaad41c88f34
Instruction ID: 7641478d529f2f057833125987b0624e5e02c16984a245de8ace4218aab5f5e8
Opcode Fuzzy Hash: ae02aee0a3798f5a7ad56022646c4ad9163d618da48a4e1f630feaad41c88f34
Instruction Fuzzy Hash: 4CE1FEB4A183028FD710DF69C48061EFBE1BF89354F14892EE998D3392E774E9558F92

Function 0023B15B Relevance: 13.8, APIs: 9, Instructions: 280stringCOMMON

Download Yara Rule

APIs

mixerGetNumDevs.WINMM ref: 0023B239
mixerGetDevCapsA.WINMM(?,?,00000030), ref: 0023B25F
strchr.MSVCRT ref: 0023B277
strstr.MSVCRT ref: 0023B29F
mixerOpen.WINMM(?,?,00000000,00000000,00000000), ref: 0023B2CB
mixerClose.WINMM(?), ref: 0023B2F4
mixerClose.WINMM(?), ref: 0023B304
__alloca_probe_16.LIBCMT ref: 0023B414
mixerGetControlDetailsA.WINMM(?,?,80000001,?), ref: 0023B42D

Part of subcall function 00213386: mixerGetLineInfoW.WINMM ref: 002133CC
Part of subcall function 00213386: strncpy.MSVCRT ref: 002133F8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: mixer$Close$CapsControlDetailsDevsInfoLineOpen__alloca_probe_16strchrstrncpystrstr
String ID:
API String ID: 4019791043-0
Opcode ID: 4c07e94e10fdb73283103a4756e7a9e9aa33d0b753670dd4fd8726d36db860e7
Instruction ID: 84f84d4254cca2fe2c3e475ea40394e415eaa16fe069be165320f5bb9e26e89d
Opcode Fuzzy Hash: 4c07e94e10fdb73283103a4756e7a9e9aa33d0b753670dd4fd8726d36db860e7
Instruction Fuzzy Hash: 7DA19AB1A20255DBDF22DF64C885ADD7BB9EF09300F20416AFE19DB246D770D8A1CB90

Function 00300FF0 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 212COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00301096
memcpy.MSVCRT(?), ref: 003010C0
memmove.MSVCRT(?), ref: 00301118
memmove.MSVCRT ref: 00301153
memcpy.MSVCRT(?), ref: 003011A6

Strings

basic_string::_M_replace, xrefs: 003012F4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: memmove$memcpy
String ID: basic_string::_M_replace
API String ID: 3033661859-2323331477
Opcode ID: 0267b2c806dc77ca3bf30b9e7f388879d929537b2ac5e3ebde3f5056a1146b63
Instruction ID: ec40b22a5d856d814165c4950f3a455716a3d882227187c1e2aead2ae8afa585
Opcode Fuzzy Hash: 0267b2c806dc77ca3bf30b9e7f388879d929537b2ac5e3ebde3f5056a1146b63
Instruction Fuzzy Hash: 77814434A0A3918FC316DF68C4A012AFBE4BF89744F158D1EE8C897391D631E984DF42

Function 00260560 Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00260080: strlen.MSVCRT ref: 0026008D

abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033297C
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332981
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332986
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033298B
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332990
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 00332995
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 0033299C
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 003329A1
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,00000004,774CDF20,002776AD), ref: 003329A6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: abort$strlen
String ID:
API String ID: 2656325428-0
Opcode ID: adc7bdab510be5c3e84a51a28912c3c886dfb9e73630cda4aa0ccb8e40a2afd5
Instruction ID: fc2f19efad9fb9c36bf3236b3b84872a50a2f8c1342ba965a6a0dc5890baf032
Opcode Fuzzy Hash: adc7bdab510be5c3e84a51a28912c3c886dfb9e73630cda4aa0ccb8e40a2afd5
Instruction Fuzzy Hash: 1661AE715263068FDB21CF28C4C176BF7E5AF84300F04891AE8959B355D374EDAAEB92

Function 001F4A90 Relevance: 13.6, APIs: 9, Instructions: 99COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 001F4AD0
_dup2.MSVCRT ref: 001F4B07
_close.MSVCRT ref: 001F4B12
_dup2.MSVCRT ref: 001F4BA5
_close.MSVCRT ref: 001F4BB0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: _close_dup2$CriticalLeaveSection
String ID:
API String ID: 2623722825-0
Opcode ID: 6933a971744f11d8ea88d90deee7f5ea8855ae6cd5d16ea38f03d51da2ad82ab
Instruction ID: 07222a9d29b9007830069b7b74720eac9c1cb3e729089d622f44616c3985c420
Opcode Fuzzy Hash: 6933a971744f11d8ea88d90deee7f5ea8855ae6cd5d16ea38f03d51da2ad82ab
Instruction Fuzzy Hash: 1841FCB49083489FDB25EF75C0C576A7BE4AF04304F15899EEE898B247E334D890DB46

Function 0024AB10 Relevance: 13.6, APIs: 9, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475D9
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475F5
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 00247611

GetWindowLongW.USER32 ref: 0024AB60
SetWindowLongW.USER32 ref: 0024AB7F
RedrawWindow.USER32 ref: 0024ABA5
CreateRectRgn.GDI32 ref: 0024ABD3
DeleteObject.GDI32 ref: 0024AC17

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ConditionMaskWindow$Long$CreateDeleteObjectRectRedraw
String ID:
API String ID: 2142193855-0
Opcode ID: 0c643444a070b63de82bd4291ef370024f20074257b7882566e72a06d59f4425
Instruction ID: fb79b504c348300bd3e1dac15893d2033086761485875d57603ba7e015dd8bf8
Opcode Fuzzy Hash: 0c643444a070b63de82bd4291ef370024f20074257b7882566e72a06d59f4425
Instruction Fuzzy Hash: E741A1B18097019FD700AF78DA8931EBBF0FB85315F008A2DE4998B295E7B5D459CB87

Function 001DECC8 Relevance: 13.6, APIs: 9, Instructions: 75fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 001DECEB
fseek.MSVCRT ref: 001DED09
ftell.MSVCRT ref: 001DED11
fseek.MSVCRT ref: 001DED2B
malloc.MSVCRT ref: 001DED33
fread.MSVCRT ref: 001DED51
fclose.MSVCRT ref: 001DED5D
free.MSVCRT ref: 001DED6B
fclose.MSVCRT ref: 001DEDB3

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: fclosefseek$fopenfreadfreeftellmalloc
String ID:
API String ID: 2780582224-0
Opcode ID: 8930a4ed8d50d79c876c20360106582e3d163206f07f3aaa208ed187d31cccc9
Instruction ID: ccccca25232754dc5f9c6231ab937303cf544494395383f4ff7726bb57a13cb7
Opcode Fuzzy Hash: 8930a4ed8d50d79c876c20360106582e3d163206f07f3aaa208ed187d31cccc9
Instruction Fuzzy Hash: 9E2114B1619700ABC710BF69D88525EFBE4EF84364F018D2EF88C8B341EB7599549F82

Function 001C6A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32 ref: 001C6A7C
GetDC.USER32 ref: 001C6A9F
GetObjectW.GDI32 ref: 001C6AC1
GetDIBits.GDI32 ref: 001C6B84
DeleteObject.GDI32 ref: 001C6BF5
DeleteObject.GDI32 ref: 001C6C01

Strings

(, xrefs: 001C6AEE

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Object$Delete$BitsIconInfo
String ID: (
API String ID: 180008473-3887548279
Opcode ID: 537772e6d33ba4026d546e7d74b2832f96c60e0ab14b7d552749b34aa3b873db
Instruction ID: 0344d232bf8de050717f992cfa46bb52089e63b106bd75d1a296c5cb69ed8e6f
Opcode Fuzzy Hash: 537772e6d33ba4026d546e7d74b2832f96c60e0ab14b7d552749b34aa3b873db
Instruction Fuzzy Hash: 9A41BFB19087408FD310EF68D58975FBBF0BF95705F11892EE9888B251E7B5D848CB92

Function 00246C09 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 0024EC1C
GetClientRect.USER32 ref: 0024EC4F
ClientToScreen.USER32 ref: 0024ECCB
ClientToScreen.USER32 ref: 0024ECE1
SetWindowLongW.USER32 ref: 0024ECFB
SetWindowPos.USER32 ref: 0024ED41
GetWindowLongW.USER32 ref: 0024EDDC
GetClientRect.USER32 ref: 0024EE0F
ClientToScreen.USER32 ref: 0024EE8B
ClientToScreen.USER32 ref: 0024EEA1
SetWindowLongW.USER32 ref: 0024EEBB
SetWindowPos.USER32 ref: 0024EF01

Strings

4, xrefs: 0024EED0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ClientWindow$LongScreen$Rect
String ID: 4
API String ID: 911421538-4088798008
Opcode ID: e28bf4902851a12743601c1d446cb2ddd2f8fd9a53e514a0925a448cb56ef633
Instruction ID: 0444550582a8db056369edfd68d48009af2bab34a5c81851e30d75132eac55fa
Opcode Fuzzy Hash: e28bf4902851a12743601c1d446cb2ddd2f8fd9a53e514a0925a448cb56ef633
Instruction Fuzzy Hash: 254107749083018FCB04EF28D68861ABBF4BF89311F158A2DEC889B315E770D954CF82

Function 00284040 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

N2, xrefs: 003308C4
what(): , xrefs: 00330918

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: what(): $N2
API String ID: 0-1011025255
Opcode ID: 633b84686ef66dbc8edb159b5c32baf31abeadad87cfe877ca22712fe5889196
Instruction ID: 95d8675887d42a975d587bbfd32a84dcedf8d61b538f8acf7a25b316a4883129
Opcode Fuzzy Hash: 633b84686ef66dbc8edb159b5c32baf31abeadad87cfe877ca22712fe5889196
Instruction Fuzzy Hash: D1314DB45153119BC706BFB4D48622EBAE0AF84704F128C2CE1C99F343DBB888909F97

Function 0024EBF9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 0024EC1C
GetClientRect.USER32 ref: 0024EC4F
ClientToScreen.USER32 ref: 0024ECCB
ClientToScreen.USER32 ref: 0024ECE1
SetWindowLongW.USER32 ref: 0024ECFB
SetWindowPos.USER32 ref: 0024ED41

Strings

4, xrefs: 0024ED10

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ClientWindow$LongScreen$Rect
String ID: 4
API String ID: 911421538-4088798008
Opcode ID: 64ebf6d4184ca594d74869307c0680b4e052fcafff163bb897bf8f712b4bd2d2
Instruction ID: af780876e6c9c985afda935bbab330a767a2d7a4217f7fb5648d83b6ed090ffc
Opcode Fuzzy Hash: 64ebf6d4184ca594d74869307c0680b4e052fcafff163bb897bf8f712b4bd2d2
Instruction Fuzzy Hash: 0841C5759083018FD700EF28D68861ABBF4BF89311F058A2DEC989B355E774D958CF92

Function 0024EDB9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 0024EDDC
GetClientRect.USER32 ref: 0024EE0F
ClientToScreen.USER32 ref: 0024EE8B
ClientToScreen.USER32 ref: 0024EEA1
SetWindowLongW.USER32 ref: 0024EEBB
SetWindowPos.USER32 ref: 0024EF01

Strings

4, xrefs: 0024EED0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ClientWindow$LongScreen$Rect
String ID: 4
API String ID: 911421538-4088798008
Opcode ID: 1c9b4540fbc2260dd8e295a88072e57926b4600c6be6bd2a1ba8b022c380d02c
Instruction ID: 44f68223cef4fc9a5682e97237d3e98b507093afd60ba1c656cc471563bd5294
Opcode Fuzzy Hash: 1c9b4540fbc2260dd8e295a88072e57926b4600c6be6bd2a1ba8b022c380d02c
Instruction Fuzzy Hash: 9F41E6755083018FDB00EF68D68861ABBF4BF89311F05892DEC989B355E774D958CF92

Function 0032E2E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 0033091F
fputs.MSVCRT ref: 00330934
fputc.MSVCRT ref: 0033094D
abort.MSVCRT(?,?,?,?,?,?,0033084F), ref: 00330957
free.MSVCRT ref: 0033095F

Strings

N2, xrefs: 003308C4
what(): , xrefs: 00330918

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: abortfputcfputsfreefwrite
String ID: what(): $N2
API String ID: 2053421089-1011025255
Opcode ID: dabdbef624ce0654cde8358326ca6e926fd718117da705743228a170d6858cd5
Instruction ID: e24ee57621da551e69aa57ea94b613d42b6d10968b3e71dead1e877f75688e00
Opcode Fuzzy Hash: dabdbef624ce0654cde8358326ca6e926fd718117da705743228a170d6858cd5
Instruction Fuzzy Hash: C1312BB45183219FD716BF74D48632EBAE4AF44304F028C5DE4C88F252EBB488909F93

Function 0023C48E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00215731: EnterCriticalSection.KERNEL32(00357D30,0023BDFF,?,00000000,00000000,?,?,0023C461,0023C74F,00000003,00000010,0023C74F,00000010,BASS/2.4,00000000), ref: 00215736

LoadLibraryW.KERNEL32(?), ref: 0023C4AD
LoadLibraryA.KERNEL32(?), ref: 0023C4B5
GetLastError.KERNEL32 ref: 0023C4C3
GetProcAddress.KERNEL32(00000000,BASSplugin), ref: 0023C4E6
FreeLibrary.KERNEL32(00000000), ref: 0023C565

Strings

+, xrefs: 0023C55D
BASSplugin, xrefs: 0023C4E0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Library$Load$AddressCriticalEnterErrorFreeLastProcSection
String ID: +$BASSplugin
API String ID: 757004937-3870098477
Opcode ID: 9b39d88af1d9305065d2dfc1b548d71c3b64e472254749b9ccc20e9d98b4ad2f
Instruction ID: 57af3e875204c6fd8976baf3741076566bdb20a51b971b6382a199edd11d6645
Opcode Fuzzy Hash: 9b39d88af1d9305065d2dfc1b548d71c3b64e472254749b9ccc20e9d98b4ad2f
Instruction Fuzzy Hash: 8F2125B1521311DBC725EF64D94566EB7F8EB41712F304029E502F3221CBB4EC619F50

Function 00244CC9 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00244CD7
GetProcAddress.KERNEL32 ref: 00244CF8
FreeLibrary.KERNEL32 ref: 00244D7F
calloc.MSVCRT ref: 00244DEF
free.MSVCRT ref: 00244EA6

Part of subcall function 0023F1D0: strcpy.MSVCRT ref: 0023F235

Strings

Vulkan: Failed to query instance extension count: %s, xrefs: 00244D5B
vulkan-1.dll, xrefs: 00244CD0
vkGetInstanceProcAddr, xrefs: 00244CED
vkEnumerateInstanceExtensionProperties, xrefs: 00244D0E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProccallocfreestrcpy
String ID: Vulkan: Failed to query instance extension count: %s$vkEnumerateInstanceExtensionProperties$vkGetInstanceProcAddr$vulkan-1.dll
API String ID: 1216305380-2158378352
Opcode ID: f9838768b1d0ced33d766381344d8f3f705f4018dbf97f4ea0c4b40588b3b096
Instruction ID: e8afff3199d22c75994bdbe8a28b707a46fba6b9fb5dd1f920c0740d395d7527
Opcode Fuzzy Hash: f9838768b1d0ced33d766381344d8f3f705f4018dbf97f4ea0c4b40588b3b096
Instruction Fuzzy Hash: 5A112AB59143018ED700BF78EA0931BBBE0EB45345F05483DEC88C7264E774D459CB96

Function 00318470 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 286stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0031862B

Strings

Invalid special open parenthesis., xrefs: 0031897F
Unexpected end of regex when in an open parenthesis., xrefs: 00318993
Unexpected end of regex when escaping., xrefs: 003189A7
Unexpected end of character class., xrefs: 00318593, 003185A7
, xrefs: 00318812
p, xrefs: 0031895C
:, xrefs: 0031858C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strchr
String ID: $:$Invalid special open parenthesis.$Unexpected end of character class.$Unexpected end of regex when escaping.$Unexpected end of regex when in an open parenthesis.$p
API String ID: 2830005266-1388832302
Opcode ID: 84e32503f2c87581e7cb73e23c86f0a732aa34301a6b4327d7cea000ec4f96c1
Instruction ID: 0d765865af5fde48c07f198f17cef144307aaee88909f783af2823a3fab55645
Opcode Fuzzy Hash: 84e32503f2c87581e7cb73e23c86f0a732aa34301a6b4327d7cea000ec4f96c1
Instruction Fuzzy Hash: E8C192706093448FDB19CF28C0847E57BE1AF8A304F5984B9D9C88F347DB758889CB66

Function 001EEAD4 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 001EEAF2
GetProcAddress.KERNEL32 ref: 001EEB06
GlobalMemoryStatus.KERNEL32 ref: 001EEB32

Strings

, xrefs: 001EEB27
kernel32.dll, xrefs: 001EEAEB
GlobalMemoryStatusEx, xrefs: 001EEAFB
@, xrefs: 001EEAE3

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressGlobalHandleMemoryModuleProcStatus
String ID: $@$GlobalMemoryStatusEx$kernel32.dll
API String ID: 2450578220-802862622
Opcode ID: 9c40d710fb7f5d45cbd84917239faff81d59239d1ec87db104bbb3d7ecf8138c
Instruction ID: 66995c295238b0c44a6120bef0b3134219e93883084eb0e595c8393068d49251
Opcode Fuzzy Hash: 9c40d710fb7f5d45cbd84917239faff81d59239d1ec87db104bbb3d7ecf8138c
Instruction Fuzzy Hash: 54F0F2B49087428BDB00EF38DA4821ABBF0BF85306F84892CE88587204E774E51DDB87

Function 001EEA60 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 001EEA72
GetProcAddress.KERNEL32 ref: 001EEA86
GlobalMemoryStatus.KERNEL32 ref: 001EEAB2

Strings

kernel32.dll, xrefs: 001EEA6B
GlobalMemoryStatusEx, xrefs: 001EEA7B
@, xrefs: 001EEA63
, xrefs: 001EEAA7

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressGlobalHandleMemoryModuleProcStatus
String ID: $@$GlobalMemoryStatusEx$kernel32.dll
API String ID: 2450578220-802862622
Opcode ID: 2b5bdac99d92d62e7f8d6a00a3483ea120ca3789d99b4cafd4ee4ebf2c8db601
Instruction ID: 2dbd5820aaa5c5ab2fa9b76a61643dcb38799af42b9d5d79501a87f9893559ee
Opcode Fuzzy Hash: 2b5bdac99d92d62e7f8d6a00a3483ea120ca3789d99b4cafd4ee4ebf2c8db601
Instruction Fuzzy Hash: 6EF01FB45083418BDB00EF38DA4822EBBE0BF84346F80893CE88187215E774E12D8B87

Function 00260800 Relevance: 12.2, APIs: 8, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c989c7af11a403c5d0111f2e25aad101572a1ad2b5a642d14abb7de709c084
Instruction ID: 9023f4d4c60c94245847a41f193088e31bd97627b14d1ba533f5041ce75bea74
Opcode Fuzzy Hash: 98c989c7af11a403c5d0111f2e25aad101572a1ad2b5a642d14abb7de709c084
Instruction Fuzzy Hash: 5071B271A293068FD710DF28C4C176FB7D2AFC4704F18892AE99597206D370DD99EB92

Function 00246220 Relevance: 12.2, APIs: 8, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0024D508
GetSystemMetrics.USER32 ref: 0024D516
GetClassLongW.USER32 ref: 0024D617
GetClassLongW.USER32 ref: 0024D62F
SendMessageW.USER32 ref: 0024D659
SendMessageW.USER32 ref: 0024D67B
DestroyIcon.USER32 ref: 0024D68D
DestroyIcon.USER32 ref: 0024D6A3

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ClassDestroyIconLongMessageMetricsSendSystem
String ID:
API String ID: 2716883340-0
Opcode ID: cd169fb5f591a62869551b124a149699408fff3be02288dc28fe00b5f096b392
Instruction ID: 8da4d663faee093aefb81b8224ece2295af819f6338db34ed2a79647941f6a6b
Opcode Fuzzy Hash: cd169fb5f591a62869551b124a149699408fff3be02288dc28fe00b5f096b392
Instruction Fuzzy Hash: 3E511EB0A143018FD708EF78D58431ABBF4AF85750F01892DE8D98B395DBB4E8598BC2

Function 001F4C10 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 001F4C87
strstr.MSVCRT ref: 001F4CA2

Strings

MemoryBarrierCompression?, xrefs: 001F4C66
external?, xrefs: 001F4C19
<stdin>, xrefs: 001F4C7C
MemoryBarrierDecompression?, xrefs: 001F4CF5
<stdout>, xrefs: 001F4C97
nosolid?, xrefs: 001F4C4E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strstr
String ID: <stdin>$ <stdout>$MemoryBarrierCompression?$MemoryBarrierDecompression?$external?$nosolid?
API String ID: 1392478783-1920293649
Opcode ID: b3dde93d58d9ae6286d8a590fa1cb82135c3d983062e36557744260abf6656db
Instruction ID: 6fbdea63e23527498feb06f4224c6a8385c4d3465e48b8649def9cd307b97f60
Opcode Fuzzy Hash: b3dde93d58d9ae6286d8a590fa1cb82135c3d983062e36557744260abf6656db
Instruction Fuzzy Hash: 0A212936B053084BE3158E6AE5C03BBB7E1EBC4361F14853EEB4887341E3368C549B51

Function 001EE7F0 Relevance: 12.1, APIs: 8, Instructions: 66COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001EE800
CharToOemW.USER32 ref: 001EE822
free.MSVCRT ref: 001EE82E
longjmp.MSVCRT(?,?,00040000,00000000,0020B171,?,?,00000000,0020D4F8,?,?,?,?,?,00000000,?), ref: 001EE853
malloc.MSVCRT ref: 001EE880
OemToCharW.USER32 ref: 001EE896
free.MSVCRT ref: 001EE8AE

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Charfreemalloc$longjmp
String ID:
API String ID: 1744327547-0
Opcode ID: 17f032bf109b550af1c42398ca46906e98141c0fdd1a0cafcf805ff0553c3eaa
Instruction ID: b648b73c75e80aa4439a56e7496561f479d1ce11665f5f4658aa7c8f5241992b
Opcode Fuzzy Hash: 17f032bf109b550af1c42398ca46906e98141c0fdd1a0cafcf805ff0553c3eaa
Instruction Fuzzy Hash: 03213AB19087149FCB10BF69E94539EBBE0FF08309F02486DE5C9A7202E774A844CB92

Function 00274C60 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 190synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00277B60: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,7763E820), ref: 00277B79

Part of subcall function 00275C00: GetTickCount64.KERNEL32 ref: 00275C1D
Part of subcall function 00275C00: WaitForMultipleObjects.KERNEL32 ref: 00275C57

ResetEvent.KERNEL32 ref: 00274CCC

Part of subcall function 00277F00: TlsGetValue.KERNEL32 ref: 00277F1B

WaitForSingleObject.KERNEL32 ref: 00274D4F

Strings

(, xrefs: 00274DDD

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ValueWait$Count64EventMultipleObjectObjectsResetSingleTick
String ID: (
API String ID: 3964425290-3887548279
Opcode ID: c655119f9f21e14274e7f3d99ff9f5eddbc9df4e36316328649345474cbb8dc6
Instruction ID: cbe58811cfe8dfcbe906472af173d823f6da715e3942b47563ebd695d680e5b4
Opcode Fuzzy Hash: c655119f9f21e14274e7f3d99ff9f5eddbc9df4e36316328649345474cbb8dc6
Instruction Fuzzy Hash: 4D518B316283068BE7307E65AA8532FB6E4AF41355F10C83EEE8C86281E775C8649B53

Function 001EE240 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 128stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 001EE286
strchr.MSVCRT ref: 001EE2AB
strchr.MSVCRT ref: 001EE2FE

Strings

:/\, xrefs: 001EE2A0, 001EE324, 001EE3DC

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strchr
String ID: :/\
API String ID: 2830005266-2793184486
Opcode ID: 98d31227aa4cb107d2a483d8bf560bd602cdbe2eefb03e1a203d8f960e0b88e4
Instruction ID: 919aa39ef0daaf506e1df0a9bcffaf91447692f05cd746e28834051f029395ec
Opcode Fuzzy Hash: 98d31227aa4cb107d2a483d8bf560bd602cdbe2eefb03e1a203d8f960e0b88e4
Instruction Fuzzy Hash: C8418EB46087918FD724DF29C04436EBBE5BB84740F59892EE5C98B381D37AC949DF82

Function 00230906 Relevance: 10.6, APIs: 7, Instructions: 125sleeptimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00215719: EnterCriticalSection.KERNEL32(00359260,0023BF27,?,00000000,00000000,?,?,0023C461,0023C74F,00000003,00000010,0023C74F,00000010,BASS/2.4,00000000), ref: 0021571E

SetEvent.KERNEL32(?,00000000,00000000,00000000,?,00000000,00230B5A,?,00000000,00000000,?,002370C5,00000000,00000000,774D3050,002371B4), ref: 0023094F
memmove.MSVCRT(00000000,00000008,?,00000000,00000000,00000000,?,00000000,00230B5A,?,00000000,00000000,?,002370C5,00000000,00000000), ref: 002309D9
timeGetTime.WINMM(002371B4,774D30D0,001C7C8E), ref: 002309F4
Sleep.KERNEL32(?), ref: 00230A1C
DeleteCriticalSection.KERNEL32(000012B0,00000000,002371B4,774D30D0,001C7C8E), ref: 00230A60
DeleteCriticalSection.KERNEL32(000012C8), ref: 00230A69
DeleteCriticalSection.KERNEL32(000012E0), ref: 00230A72

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$Delete$EnterEventSleepTimememmovetime
String ID:
API String ID: 2815438310-0
Opcode ID: 52ca9c1e1386cd33020ceab1277d2b1c79dfea5d90495cd215641e81c4387565
Instruction ID: 1b6b07dc7d3326429f7f6e0a715696f0cf6be268c5c90a31728e598cbc393656
Opcode Fuzzy Hash: 52ca9c1e1386cd33020ceab1277d2b1c79dfea5d90495cd215641e81c4387565
Instruction Fuzzy Hash: B54103B5620712DFCB20AFB8E8D59AA73E9BB45305B04452DF146C7213DB31E862CF61

Function 00245240 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0025006B

Part of subcall function 0023F1D0: strcpy.MSVCRT ref: 0023F235

Strings

vkCreateWin32SurfaceKHR, xrefs: 0025001A
Vulkan: Window surface creation requires the window to have the client API set to GLFW_NO_API, xrefs: 002452D0
Vulkan: Window surface creation extensions not found, xrefs: 00245306
Win32: Vulkan instance missing VK_KHR_win32_surface extension, xrefs: 002500D1
Win32: Failed to create Vulkan surface: %s, xrefs: 002500B0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: HandleModulestrcpy
String ID: Vulkan: Window surface creation extensions not found$Vulkan: Window surface creation requires the window to have the client API set to GLFW_NO_API$Win32: Failed to create Vulkan surface: %s$Win32: Vulkan instance missing VK_KHR_win32_surface extension$vkCreateWin32SurfaceKHR
API String ID: 122033455-433542675
Opcode ID: 00e773cee9254d145b5fa15f4dbed01aa86db5ce1744e00cf6367097bfc3adca
Instruction ID: 4681542e2c196ecdc995010d630e08f1d112e54c63147481a0c18099a7613977
Opcode Fuzzy Hash: 00e773cee9254d145b5fa15f4dbed01aa86db5ce1744e00cf6367097bfc3adca
Instruction Fuzzy Hash: 6B4137B56193009FD340AF29E98472BBBE0FF89354F444A2EF8C887355D3B598548F96

Function 0024E389 Relevance: 10.6, APIs: 7, Instructions: 87threadCOMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32 ref: 0024E333
SetWindowPos.USER32 ref: 0024E375
GetWindowLongW.USER32 ref: 0024E3A1
SetWindowLongW.USER32 ref: 0024E3DB
SetThreadExecutionState.KERNEL32 ref: 0024E4A7
SystemParametersInfoW.USER32 ref: 0024E4F9
SystemParametersInfoW.USER32 ref: 0024E51D

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: InfoWindow$LongParametersSystem$ExecutionMonitorStateThread
String ID:
API String ID: 1635594411-0
Opcode ID: f56b611a0d44493700e05970e17bd0525526dba8921ce2f8c416d873d5ebc8a8
Instruction ID: d055c312637c54e5de8499e6c187847e74be2329e50671ce1a502c1646f987fd
Opcode Fuzzy Hash: f56b611a0d44493700e05970e17bd0525526dba8921ce2f8c416d873d5ebc8a8
Instruction Fuzzy Hash: B641F2B55187019FD714EF68D68831ABBF0BF85310F11892DE8998B356D7B4D848CF82

Function 00246690 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 0024F085
SetWindowLongW.USER32 ref: 0024F0A8

Strings

Invalid window opacity %f, xrefs: 002466B8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: LongWindow
String ID: Invalid window opacity %f
API String ID: 1378638983-3510817985
Opcode ID: 9aff7c4a7f2e4eb7bc4422eb204717b89fc612d1433858d34c81accc878bfc7f
Instruction ID: 02378a899290b9295aa2fd64aea815c9f6ddf849e2251929d2b3ea1808bea60d
Opcode Fuzzy Hash: 9aff7c4a7f2e4eb7bc4422eb204717b89fc612d1433858d34c81accc878bfc7f
Instruction Fuzzy Hash: 28318BB19083029FC701BF28DA8921ABBF4FB85741F504D2DF8C48A299E7758868CB57

Function 0024D04C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71threadCOMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32 ref: 0024CED6
SetWindowPos.USER32 ref: 0024CF1C
SetThreadExecutionState.KERNEL32 ref: 0024D057

Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475D9
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475F5
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 00247611

SystemParametersInfoW.USER32 ref: 0024D0A9
SystemParametersInfoW.USER32 ref: 0024D0CD

Strings

(, xrefs: 0024CEC4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ConditionInfoMask$ParametersSystem$ExecutionMonitorStateThreadWindow
String ID: (
API String ID: 346400206-3887548279
Opcode ID: 85dace093160a458e3ce95bd8141bff586bdcf693ecd709605e6c76c5047f66d
Instruction ID: 6b776a06c2df0ae06383b1a3df1f4eaebad797b3bc39f52f136afc46cc0668f5
Opcode Fuzzy Hash: 85dace093160a458e3ce95bd8141bff586bdcf693ecd709605e6c76c5047f66d
Instruction Fuzzy Hash: F131E5B55097018FD704EF28D58831ABBE0FF84311F10892EE8988B351D779D848CF82

Function 00210578 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0032DDA0: malloc.MSVCRT ref: 0032DDB5

Part of subcall function 0020F4E0: malloc.MSVCRT ref: 0020F52B
Part of subcall function 0020F4E0: malloc.MSVCRT ref: 0020F544
Part of subcall function 0020F4E0: malloc.MSVCRT ref: 0020F55B
Part of subcall function 0020F4E0: CharToOemW.USER32 ref: 0020F590
Part of subcall function 0020F4E0: malloc.MSVCRT ref: 0020F5D5
Part of subcall function 0020F4E0: malloc.MSVCRT ref: 0020F5F1
Part of subcall function 0020F4E0: malloc.MSVCRT ref: 0020F60B
Part of subcall function 0020F4E0: CharToOemW.USER32 ref: 0020F646
Part of subcall function 0020F4E0: malloc.MSVCRT ref: 0020F66D
Part of subcall function 0020F4E0: malloc.MSVCRT ref: 0020F689
Part of subcall function 0020F4E0: malloc.MSVCRT ref: 0020F6A3

_wremove.MSVCRT ref: 002105FF

Part of subcall function 001EF270: memmove.MSVCRT(?,?,?,?,00000000,0020F8C4), ref: 001EF2CE

free.MSVCRT ref: 00210624
free.MSVCRT ref: 00210632
free.MSVCRT ref: 00210640
free.MSVCRT ref: 00210685
_close.MSVCRT ref: 002107F3
malloc.MSVCRT ref: 00210814
malloc.MSVCRT ref: 0021082A
exit.MSVCRT ref: 00210876
_close.MSVCRT ref: 00210883
malloc.MSVCRT ref: 002108A5
malloc.MSVCRT ref: 002108BB
exit.MSVCRT ref: 00210907
_close.MSVCRT ref: 00210913
malloc.MSVCRT ref: 00210934
malloc.MSVCRT ref: 0021094A
exit.MSVCRT ref: 00210996
_close.MSVCRT ref: 002109A3

Strings

@q(, xrefs: 002105BD

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$_closefree$exit$Char$_wremovememmove
String ID: @q(
API String ID: 3138620770-2353706143
Opcode ID: 80bfe0504b8bf882c1188fd45276c5a68b4eb95c9fffa23e9002d7824133fa60
Instruction ID: ef9edbc700ca9b8cbe2696a19f1b133f81d1de61fa0463eb886fa33f1f9e6fec
Opcode Fuzzy Hash: 80bfe0504b8bf882c1188fd45276c5a68b4eb95c9fffa23e9002d7824133fa60
Instruction Fuzzy Hash: 603112B4A14B418FD721EF38C5857AABBE0BF44300F408C2DE4DA97642E774A890CF42

Function 0024AF19 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

ClipCursor.USER32 ref: 0024AE4A
ClientToScreen.USER32 ref: 0024AEB1
SetCursorPos.USER32 ref: 0024AEC9
SetCursor.USER32 ref: 0024AEEC

Part of subcall function 002470E0: GetLastError.KERNEL32 ref: 0024712B
Part of subcall function 002470E0: FormatMessageW.KERNEL32 ref: 00247163
Part of subcall function 002470E0: WideCharToMultiByte.KERNEL32 ref: 002471A7

RegisterRawInputDevices.USER32 ref: 0024AF4B

Strings

Win32: Failed to remove raw input device, xrefs: 0024AF5C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Cursor$ByteCharClientClipDevicesErrorFormatInputLastMessageMultiRegisterScreenWide
String ID: Win32: Failed to remove raw input device
API String ID: 1206734558-53561655
Opcode ID: c78a76fd8afb1bfe1e97a66309c5e43cb7e2402031782472e96736540686bbf1
Instruction ID: 61f2436d015740a286082724b552acb35207eee81ec72730fcbd6caa8a938dea
Opcode Fuzzy Hash: c78a76fd8afb1bfe1e97a66309c5e43cb7e2402031782472e96736540686bbf1
Instruction Fuzzy Hash: F631D5B4509301CFD740EF25D64835EBBF0BF8870AF01892DE8888A266D7B5D998CB57

Function 001EE8F0 Relevance: 10.6, APIs: 7, Instructions: 60COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 001EE90D
free.MSVCRT ref: 001EE922
free.MSVCRT ref: 001EE977

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$wcscmp
String ID:
API String ID: 4021281200-0
Opcode ID: 1b1820efcd8424702f1305edd38d8da020ae0cb2e5c464b76a96b3bf64bd91df
Instruction ID: 9f561f5d37d31f464dceb508c0cdee4031883b23429843bf145920a1c3db5c61
Opcode Fuzzy Hash: 1b1820efcd8424702f1305edd38d8da020ae0cb2e5c464b76a96b3bf64bd91df
Instruction Fuzzy Hash: C41182B1508B408BDBA0BF25E98575EB7E0BF00318F46586CE8C887252EB34DA45DB92

Function 0024ED77 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ClientToScreen.USER32 ref: 0024ECCB
ClientToScreen.USER32 ref: 0024ECE1
SetWindowLongW.USER32 ref: 0024ECFB
SetWindowPos.USER32 ref: 0024ED41
AdjustWindowRectEx.USER32 ref: 0024EDAB

Strings

4, xrefs: 0024ED10

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Window$ClientScreen$AdjustLongRect
String ID: 4
API String ID: 1989598117-4088798008
Opcode ID: f141a77b092ccd637ece6868cd959f3b52fcc9d40d77bbf3ac7d2e7605794410
Instruction ID: fe39489d729ea3a554e361d61c6cb243fb1b5084b77a8cb3402a90f5fd8d8aca
Opcode Fuzzy Hash: f141a77b092ccd637ece6868cd959f3b52fcc9d40d77bbf3ac7d2e7605794410
Instruction Fuzzy Hash: BC21D5B5A083019FDB04EF28D68821ABBF4BF89315F05892EE8889B355D774D954CF82

Function 0024EF37 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ClientToScreen.USER32 ref: 0024EE8B
ClientToScreen.USER32 ref: 0024EEA1
SetWindowLongW.USER32 ref: 0024EEBB
SetWindowPos.USER32 ref: 0024EF01
AdjustWindowRectEx.USER32 ref: 0024EF6B

Strings

4, xrefs: 0024EED0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Window$ClientScreen$AdjustLongRect
String ID: 4
API String ID: 1989598117-4088798008
Opcode ID: f141a77b092ccd637ece6868cd959f3b52fcc9d40d77bbf3ac7d2e7605794410
Instruction ID: 2610d46d3d5290c20eb2fd364614d4eeaf43019f312f02f18658d728f920de5a
Opcode Fuzzy Hash: f141a77b092ccd637ece6868cd959f3b52fcc9d40d77bbf3ac7d2e7605794410
Instruction Fuzzy Hash: 0B21A8756083018FDB04EF28D68821ABBF4BF89315F15892EE8989B355D774D954CF82

Function 00214158 Relevance: 10.6, APIs: 7, Instructions: 56synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,002150E7,00000001,?,00231BA6,?,FFE7FFFF), ref: 0021417E
WaitForSingleObject.KERNEL32(?,000003E8,?,00231BA6,?,FFE7FFFF), ref: 002141AD
CloseHandle.KERNEL32(?,?,00231BA6,?,FFE7FFFF), ref: 002141B9
CoTaskMemFree.OLE32(?,?,00231BA6,?,FFE7FFFF), ref: 002141D5
CoTaskMemFree.OLE32(?,?,00231BA6,?,FFE7FFFF), ref: 002141DF
DeleteCriticalSection.KERNEL32(00000070,?,?,00231BA6,?,FFE7FFFF), ref: 00214201
DeleteCriticalSection.KERNEL32(-00000088,?,00231BA6,?,FFE7FFFF), ref: 0021420A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalDeleteFreeSectionTask$CloseCreateEventHandleObjectSingleWait
String ID:
API String ID: 3595854655-0
Opcode ID: 13005136af9fbf4f402a953e28157428462cd2d837ec85e6538895616e302d3e
Instruction ID: 5f5e058e8a7a88738f33f7cf89f49e81fafaae5c7d7a0d39e1eb4e861e071c70
Opcode Fuzzy Hash: 13005136af9fbf4f402a953e28157428462cd2d837ec85e6538895616e302d3e
Instruction Fuzzy Hash: FB116D75610B05AFD721BF65CC84A9ABBE8FF14311B004A2DF58993621C7B1ECA98F50

Function 001C21B1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 001C21D6
strncmp.MSVCRT ref: 001C21FB
strlen.MSVCRT ref: 001C220B
WriteFile.KERNEL32 ref: 001C2276
CloseHandle.KERNEL32 ref: 001C2299

Strings

\, xrefs: 001C224F

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: FileWrite$CloseHandlestrlenstrncmp
String ID: \
API String ID: 3830564244-2967466578
Opcode ID: 26e5ce1639bea64ce5d53fb5f11feebfd1404771b58432802d09952710501c37
Instruction ID: 2e4c0a4a0074efe9223dc53b29e4a3d5d496aa42f1012b67b74c4df173b66a0b
Opcode Fuzzy Hash: 26e5ce1639bea64ce5d53fb5f11feebfd1404771b58432802d09952710501c37
Instruction Fuzzy Hash: C5116AB14087419FD721AF64D98875EBBF0FF90304F05882EE98886251E7B9D548CF83

Function 0020F271 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

_lseeki64.MSVCRT ref: 0020F2B7
malloc.MSVCRT ref: 0020F2DD
malloc.MSVCRT ref: 0020F2F3

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

exit.MSVCRT ref: 0020F335
longjmp.MSVCRT ref: 0020F356
malloc.MSVCRT ref: 0020F3F2
malloc.MSVCRT ref: 0020F408
malloc.MSVCRT ref: 0020F435
malloc.MSVCRT ref: 0020F447

Strings

%s, xrefs: 0020F322
ERROR: file seek operation failed, xrefs: 0020F302

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$Char_lseeki64exitfreelongjmp
String ID: %s$ERROR: file seek operation failed
API String ID: 2964819914-4263853135
Opcode ID: 23fc8cd126808550d572706caa0a262311e244b04046d9cb17c5fe3039027f0c
Instruction ID: 956f5f941534d4ac20453332ed96785c5cc08cffbb475cd45c69148c166ec9dd
Opcode Fuzzy Hash: 23fc8cd126808550d572706caa0a262311e244b04046d9cb17c5fe3039027f0c
Instruction Fuzzy Hash: 3C21F6B05187069FC760EF29C18072EF7E0BF48700F41882CE9889B342DB74A955CF96

Function 002089F9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 0020899E
longjmp.MSVCRT ref: 00208A18
malloc.MSVCRT ref: 00208A27
malloc.MSVCRT ref: 00208A39

Strings

Fatal error: DataTables::shift() called when list of tables contains more than one entry, xrefs: 00208A44
%s, xrefs: 0020898B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$exitlongjmp
String ID: %s$Fatal error: DataTables::shift() called when list of tables contains more than one entry
API String ID: 2151770896-651730184
Opcode ID: 5e55ad82bf06497e3f71e3c7859c163bb19bea3e14eca2629acbba3198b2e281
Instruction ID: 75e58e2360f13c95e9fe46a86301dd6de9d9b281023dce4e3e5e4d0105747671
Opcode Fuzzy Hash: 5e55ad82bf06497e3f71e3c7859c163bb19bea3e14eca2629acbba3198b2e281
Instruction Fuzzy Hash: 471179B12283059BC310BF24D44122FB7E0BF04300F55882EE9CC97242DBB5D995DB97

Function 001E0160 Relevance: 10.1, APIs: 8, Instructions: 75COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001E01A7
free.MSVCRT ref: 001E01BC
free.MSVCRT ref: 001E01C4
free.MSVCRT ref: 001E01E2
free.MSVCRT ref: 001E01EA
free.MSVCRT ref: 001E01F9
free.MSVCRT ref: 001E0208
free.MSVCRT ref: 001E021A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a0c26d57960b8352c544134b0dad2ce27c0431b2e417a09140af1ab2c88c8581
Instruction ID: 525f9e3d379dd177c25afe2b6dcf422996c52f80c1f2a0649a8b5909880b3af9
Opcode Fuzzy Hash: a0c26d57960b8352c544134b0dad2ce27c0431b2e417a09140af1ab2c88c8581
Instruction Fuzzy Hash: E7212A71714B819BDB21BF7AC8C5A6EB7E4BF48700F45492CE9889B202D770E991CB91

Function 00242BE0 Relevance: 10.0, APIs: 8, Instructions: 38COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00242BFA
free.MSVCRT ref: 00242C05
free.MSVCRT ref: 00242C10
free.MSVCRT ref: 00242C1B
free.MSVCRT ref: 00242C26
free.MSVCRT ref: 00242C31
free.MSVCRT ref: 00242C3C
free.MSVCRT ref: 00242C46

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 320fb337dfdba228b40e1d7ec017b016568a09fbb96a5d4d6953dc0efa3fad17
Instruction ID: 31622db74b2827169da5f12386f91aabb940b6e10c7f571f4b4e923b4a8ab0c6
Opcode Fuzzy Hash: 320fb337dfdba228b40e1d7ec017b016568a09fbb96a5d4d6953dc0efa3fad17
Instruction Fuzzy Hash: FC0142B49257009BCB54FF78C4C645DBBE4AF05700F81489DE9889B306E739EAA19F82

Function 0021EFDC Relevance: 9.2, APIs: 6, Instructions: 243COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0021F013
__alloca_probe_16.LIBCMT ref: 0021F01D
__alloca_probe_16.LIBCMT ref: 0021F027
__alloca_probe_16.LIBCMT ref: 0021F030
memset.MSVCRT ref: 0021F0AB

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: __alloca_probe_16$memset
String ID:
API String ID: 4228662490-0
Opcode ID: 2840889f8334f8beb5554eba2324cd33ed6affebb9260fcbb50aec4ac43df908
Instruction ID: 3e450a8d707ac53b6b3ea48adf91c16ef768ed43c862f3faff1a9984ba874d04
Opcode Fuzzy Hash: 2840889f8334f8beb5554eba2324cd33ed6affebb9260fcbb50aec4ac43df908
Instruction Fuzzy Hash: 03A116B4A0050ADFCB15CF98C9809AEB7F6FF89304F2481A9D915AB355D731AD62CF90

Function 0021297D Relevance: 9.2, APIs: 6, Instructions: 217COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(?), ref: 00212A0D

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: FreeTask
String ID:
API String ID: 734271698-0
Opcode ID: 4caf5e29d4c44ac636cf8d0984502308bcd508df80a6e8eff82d957932ba593a
Instruction ID: acd87db7993d53de0a853adc08ce93cbd889d47c2e10532eb9baab33763e2fb9
Opcode Fuzzy Hash: 4caf5e29d4c44ac636cf8d0984502308bcd508df80a6e8eff82d957932ba593a
Instruction Fuzzy Hash: 09912570A10B05DFD715DF65C988BAABBF8FF19700F11895DE486D7211EB70AA64CB20

Function 002802F0 Relevance: 9.2, APIs: 6, Instructions: 178COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,002801AF), ref: 00330710
abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330718
abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330720
abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330728

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 41ed1319450678a319586cf18b498c64b3f7dfa2f67a3af3ba3c25384a39a5b2
Instruction ID: 37a93a12df12f087b1a746636fa235566ac2cfc53abd9a9902b2b27c0c4c8173
Opcode Fuzzy Hash: 41ed1319450678a319586cf18b498c64b3f7dfa2f67a3af3ba3c25384a39a5b2
Instruction Fuzzy Hash: 425164346262158BC705BF74D0D227EB7E0EF82308F29886CE5889F346DB359859CF92

Function 00244089 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0024410D
free.MSVCRT ref: 00244118
free.MSVCRT ref: 00244123
calloc.MSVCRT ref: 00244162

Strings

Invalid gamma value %f, xrefs: 002440C5
Invalid gamma ramp size %i, xrefs: 0024427C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$calloc
String ID: Invalid gamma ramp size %i$Invalid gamma value %f
API String ID: 3095843317-3225988985
Opcode ID: 4989739d76c5e465ecca90bc99919ef8acdb99e2be726877dd9d3e36715b3f8b
Instruction ID: ea7263efd146d797397bde47ba45801d8df11e4e335749d564482c08c10686d8
Opcode Fuzzy Hash: 4989739d76c5e465ecca90bc99919ef8acdb99e2be726877dd9d3e36715b3f8b
Instruction Fuzzy Hash: E05143B1919301DBD704AF15E18436ABBE0FF84744F01491DF8C897265E3B288A4CF82

Function 001EC189 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 148stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0032DDA0: malloc.MSVCRT ref: 0032DDB5

strlen.MSVCRT ref: 001EC25B

Strings

tor:, xrefs: 001EC1EB
^, xrefs: 001EC360
4x4, xrefs: 001EC197
3:1m, xrefs: 001EC1F2
:, xrefs: 001EC39C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: mallocstrlen
String ID: 3:1m$4x4$:$^$tor:
API String ID: 770973918-666033680
Opcode ID: 09dc2d112d91b8006a97a6c39b3e2144ffd4c7f4caa8540bf2b56bf94c5f26ea
Instruction ID: b53f9cd03c935e5d37bb3b9984839658009eab805b705d94a8037be7059ae302
Opcode Fuzzy Hash: 09dc2d112d91b8006a97a6c39b3e2144ffd4c7f4caa8540bf2b56bf94c5f26ea
Instruction Fuzzy Hash: 78518A71508B458FD724AF66D4842AEBBE1FF90304F048A1EE99A8B351C774DA06CBC2

Function 0023E6C0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 107stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0024A7A0: TlsGetValue.KERNEL32 ref: 0024A7AD

strcmp.MSVCRT ref: 0023E737
strstr.MSVCRT ref: 0023E7C7
strlen.MSVCRT ref: 0023E7D5

Strings

Extension name cannot be an empty string, xrefs: 0023E820
Cannot query extension without a current OpenGL or OpenGL ES context, xrefs: 0023E800
Extension string retrieval is broken, xrefs: 0023E769

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Valuestrcmpstrlenstrstr
String ID: Cannot query extension without a current OpenGL or OpenGL ES context$Extension name cannot be an empty string$Extension string retrieval is useren
API String ID: 1614321880-2334120326
Opcode ID: 70cf47ded1fa71b13428a618d422011af5ff69e885e8d88518b09c52227f2ddc
Instruction ID: af7625c4c813c2e2703a0f84cf11f1dab08bea7ad39679992efa65c492288630
Opcode Fuzzy Hash: 70cf47ded1fa71b13428a618d422011af5ff69e885e8d88518b09c52227f2ddc
Instruction Fuzzy Hash: 773192B59283468FDB10AF74D94936EFBE0AF54355F064C2EE8C887281E77484A9CB53

Function 001F2DEC Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001F2EE4
free.MSVCRT ref: 001F2EF0
free.MSVCRT ref: 001F2EFC
free.MSVCRT ref: 001F2F08
free.MSVCRT ref: 001F2F14

Strings

write, xrefs: 001F2EB1

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID: write
API String ID: 1294909896-2104195679
Opcode ID: e97a261aeb0e3656cbe50aa4f5303f06f4e7259b75b9c31beb57fae11837cefa
Instruction ID: 6d7bb7867e50154459e8d7fcce8c506db33d8d696ee264220888daf9abd6b816
Opcode Fuzzy Hash: e97a261aeb0e3656cbe50aa4f5303f06f4e7259b75b9c31beb57fae11837cefa
Instruction Fuzzy Hash: 1D313471A083868FCB20DF28C480A6EBBE0AF95758F454C2DF9C897202E735ED45DB42

Function 00200A10 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00200B13

Strings

:m%d, xrefs: 00200A59
tta%s%s%s, xrefs: 00200AAF
:o%d, xrefs: 00200B1E
:%d*%d%s, xrefs: 00200AE7
:r%d, xrefs: 00200A7B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strlen
String ID: :%d*%d%s$:m%d$:o%d$:r%d$tta%s%s%s
API String ID: 39653677-250652949
Opcode ID: c6a10edd06fdc0fd9ae2df811c51e1cdd2e010c0b1a63a56b141c8a15d91b857
Instruction ID: 075bb1184f0de1ba43d84418b5a6f90eb909ce55810ed3b03f36a6d56e01d469
Opcode Fuzzy Hash: c6a10edd06fdc0fd9ae2df811c51e1cdd2e010c0b1a63a56b141c8a15d91b857
Instruction Fuzzy Hash: B53104B5A1D750DBCB10AF19C98165EBBE4BFC8740F61C82EE88C8B305D771D8558B82

Function 001F0BAB Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 0032F9A7
DeleteCriticalSection.KERNEL32(00000000), ref: 0032F9E3
DeleteCriticalSection.KERNEL32(?), ref: 0032FA0F
DeleteCriticalSection.KERNEL32 ref: 0032FA6A
LeaveCriticalSection.KERNEL32(00000000), ref: 0032F9BD

Part of subcall function 003306E0: abort.MSVCRT(?,?,?,?,?,?,002801AF), ref: 00330710
Part of subcall function 003306E0: abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330718
Part of subcall function 003306E0: abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330720
Part of subcall function 003306E0: abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330728

DeleteCriticalSection.KERNEL32(00000000), ref: 0032FA85

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$Deleteabort$Leave
String ID:
API String ID: 2046026691-0
Opcode ID: 822378b4e43e102482ce67b15edede86e5ec910f9dbbad5064726bcc7b0ec285
Instruction ID: b3cfdc4907ab88f6abf596dc8755416b872f083446202a599a6ee231f1412ff5
Opcode Fuzzy Hash: 822378b4e43e102482ce67b15edede86e5ec910f9dbbad5064726bcc7b0ec285
Instruction Fuzzy Hash: 9B21D4B55187159FC761AFB4D98855EBBF8BF84340F420D3DE88987602EB34A584CF92

Function 001C4A19 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001C49E1
free.MSVCRT ref: 001C49F1
strlen.MSVCRT ref: 001C4A79
malloc.MSVCRT ref: 001C4A84
memcpy.MSVCRT ref: 001C4A9A
malloc.MSVCRT ref: 001C4AC6

Strings

PYA, xrefs: 001C4A2A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: freemalloc$memcpystrlen
String ID: PYA
API String ID: 3194779595-4183777465
Opcode ID: 89c826ca386bb0fc02e1fe5e0e019d65dac986caccadb7a5a1695eefc94faba5
Instruction ID: ce1f6433bf754cc3c104751ea9f58362dd77ddf7c6e0b334fb6b1934d2186613
Opcode Fuzzy Hash: 89c826ca386bb0fc02e1fe5e0e019d65dac986caccadb7a5a1695eefc94faba5
Instruction Fuzzy Hash: D32195B2525B11DFC710AF68D9457DEBBE0FB84320F45842DD88997210D734E954CF4A

Function 00200ACC Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 56stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00200B13

Strings

:m%d, xrefs: 00200A59
tta%s%s%s, xrefs: 00200AAF
:o%d, xrefs: 00200B1E
:%d*%d%s, xrefs: 00200AE7
:r%d, xrefs: 00200A7B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strlen
String ID: :%d*%d%s$:m%d$:o%d$:r%d$tta%s%s%s
API String ID: 39653677-250652949
Opcode ID: 26ad8d28d1891913b6d6019ae5e89c06ffe4848c4f11c6b939b57a402ca57003
Instruction ID: a6460a72bed59fe3b306ee7cf55c4f96ef4a09a1f6bfad9be7d4ae5abf366a0a
Opcode Fuzzy Hash: 26ad8d28d1891913b6d6019ae5e89c06ffe4848c4f11c6b939b57a402ca57003
Instruction Fuzzy Hash: EA21CDB9A1D750DBCB01AF28C58215EBBE4BF84750F62C82EE88C97315C771D8549B82

Function 0020AC95 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 232timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32 ref: 0020A6D4
GetProcessWorkingSetSize.KERNEL32 ref: 0020A7CA
GetStartupInfoW.KERNEL32 ref: 0020A845
QueryPerformanceCounter.KERNEL32 ref: 0020A882

Strings

D, xrefs: 0020A83A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Process$CounterInfoPerformanceQuerySizeStartupTimesWorking
String ID: D
API String ID: 2512491238-2746444292
Opcode ID: 0b69eb58ffcc9a70460a88ab4b3a5be580b5b4427aa79dca7526aceda2b025cd
Instruction ID: 9c6d88bd55bbace7d12dfdfbe268e82a09895a9a8b6988eea8b04ca56d9b345e
Opcode Fuzzy Hash: 0b69eb58ffcc9a70460a88ab4b3a5be580b5b4427aa79dca7526aceda2b025cd
Instruction Fuzzy Hash: 8A8183B56183418FDB158F29C89022ABBE1AFDA354F588E3DE8DAD7391D630D9458F03

Function 0023107C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

acmStreamOpen.MSACM32(00000000,00000000,?,?,00000000,00000000,00000000,00000004,?,0000000C), ref: 00231112
acmStreamSize.MSACM32(000000A0,?,000000A0,00000001,000000B0), ref: 0023120E
acmStreamSize.MSACM32(?,?,?,00000000), ref: 00231231
acmStreamPrepareHeader.MSACM32(00000055,0000004C,00000000,?,?,?,?,?,?,?,0000000C,?), ref: 00231279

Strings

U, xrefs: 0023123B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Stream$Size$HeaderOpenPrepare
String ID: U
API String ID: 1309305768-3372436214
Opcode ID: 3aebec9da2091f8da5c1a7a5190f69e28fe4ea25f3959c53b583840ff3cce49d
Instruction ID: 64dece05cca0bca8849c67cbc4e38efd268dacf3e2c6c04a771bf4cb902b5c59
Opcode Fuzzy Hash: 3aebec9da2091f8da5c1a7a5190f69e28fe4ea25f3959c53b583840ff3cce49d
Instruction Fuzzy Hash: 71617BB15147129FD320DF65C88566BF7E4FF88710F10492EF999C6290E3B4D9A4CB92

Function 00250E09 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00250E82
DescribePixelFormat.GDI32 ref: 00250EB3
SetPixelFormat.GDI32 ref: 00250EDC

Strings

(, xrefs: 00250E9A
WGL: Unknown pixel format attribute requested, xrefs: 00250E27

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: FormatPixel$Describefree
String ID: ($WGL: Unknown pixel format attribute requested
API String ID: 4256426571-180673898
Opcode ID: d5e787716a895fbbbde66642e93ca89f35213849aa81fdc7ba8dba07fa64c9dc
Instruction ID: 763c5d50e8324e30c53ecef06cf62dd4e6d9c2c186bc9b616c3cd8fa8465ec7a
Opcode Fuzzy Hash: d5e787716a895fbbbde66642e93ca89f35213849aa81fdc7ba8dba07fa64c9dc
Instruction Fuzzy Hash: EA718C702183018FD721DF18D588B9AB7E5FF88309F19896CDD888B351D7B5E8A8CB46

Function 001E0240 Relevance: 8.9, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 001E025A
malloc.MSVCRT ref: 001E02A4
malloc.MSVCRT ref: 001E02E7
calloc.MSVCRT ref: 001E030A
calloc.MSVCRT ref: 001E033E
calloc.MSVCRT ref: 001E0388
free.MSVCRT ref: 001E0407

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: calloc$malloc$free
String ID:
API String ID: 1178156143-0
Opcode ID: 0bbcf80c210b8c1a5f049748df53499054b1d52d4d637ef5761c06872b20d621
Instruction ID: f49cc3cdd7a63c678ad2557afafb78e45948dc4754640d9a88b47058383a89a6
Opcode Fuzzy Hash: 0bbcf80c210b8c1a5f049748df53499054b1d52d4d637ef5761c06872b20d621
Instruction Fuzzy Hash: 4D5104B0604B01CFDB21DF2AC58465ABBE0FF48304F0589ADE9888B356D7B5D894CF91

Function 001C6333 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 001C6358
ReleaseMutex.KERNEL32 ref: 001C6404

Strings

9, xrefs: 001C63D3
Start, xrefs: 001C639B
Install succeeded! Press Start to play or escape to quit., xrefs: 001C63DB

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait
String ID: 9$Install succeeded! Press Start to play or escape to quit.$Start
API String ID: 2017088797-1226081799
Opcode ID: 29785e8b7bd81b62a3eb70cb13d18bdccebeceb584c10c04fa88ae9b90b7dc1c
Instruction ID: cf3600a4a8b7dd307d49c5e096a4b7d751c6cc5fe8aa1373b274cd44f59f0632
Opcode Fuzzy Hash: 29785e8b7bd81b62a3eb70cb13d18bdccebeceb584c10c04fa88ae9b90b7dc1c
Instruction Fuzzy Hash: 4F412FB4608344DFD304EF28D584B9A7BF1BB58314F52896DE8898B362D774E884CF5A

Function 00206C30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00206C3C
longjmp.MSVCRT ref: 00206C63
exit.MSVCRT ref: 00206CB2

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 00206C7D
%s, xrefs: 00206C9F

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exitlongjmpmalloc
String ID: %s$ERROR: can't alloc %lu memory bytes
API String ID: 2723687207-701587655
Opcode ID: 15ed0f343d24ce60afebc05c4713b5d4110d6c9af7f412ad6c76cafbb86a4e48
Instruction ID: 8aedc367751e3888e079bba45787bceccb9c784542903b7103de6a25fe939667
Opcode Fuzzy Hash: 15ed0f343d24ce60afebc05c4713b5d4110d6c9af7f412ad6c76cafbb86a4e48
Instruction Fuzzy Hash: F3210BB16183159BD720BF25E44826EBBE0FF45315F55486EE0C88B243C3719CB5DBA2

Function 001C61EC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64synchronizationwindowprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 001EBCC0: mbstowcs.MSVCRT ref: 001EBCDE

Part of subcall function 001C27C0: GetFullPathNameW.KERNEL32 ref: 001C27F2
Part of subcall function 001C27C0: wcslen.MSVCRT ref: 001C2806
Part of subcall function 001C27C0: wcslen.MSVCRT ref: 001C281C
Part of subcall function 001C27C0: wcsncmp.MSVCRT ref: 001C2831

MessageBoxW.USER32 ref: 001C61C7
ReleaseMutex.KERNEL32 ref: 001C61D8
CreateProcessW.KERNEL32 ref: 001C62A1
CloseHandle.KERNEL32 ref: 001C62B7
CloseHandle.KERNEL32 ref: 001C62C3
ReleaseMutex.KERNEL32 ref: 001C62E5
MessageBoxW.USER32 ref: 001C631F

Strings

%ls\%ls, xrefs: 001C622A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CloseHandleMessageMutexReleasewcslen$CreateFullNamePathProcessmbstowcswcsncmp
String ID: %ls\%ls
API String ID: 2636176469-2125769799
Opcode ID: 76a3c9c1fde40c0b35b9a9997d7c8ad9503024dfcb49cb8f963c01f8619e4016
Instruction ID: f7d29537861a1ddd6de8de516b0e3d73b656757d6d5e910ebb468ad7eee1a2d4
Opcode Fuzzy Hash: 76a3c9c1fde40c0b35b9a9997d7c8ad9503024dfcb49cb8f963c01f8619e4016
Instruction Fuzzy Hash: AC21EFB06097059FD700EF29DA8864EBBF0BB88704F01892DE98887311E775E948CF86

Function 00276B30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002764C0: calloc.MSVCRT ref: 0027654E

TlsAlloc.KERNEL32(?,00000000,00000004,00277612), ref: 00276B57
fprintf.MSVCRT ref: 00276BC1
abort.MSVCRT(?,?,00000009,?,?,00000001,00260144), ref: 003329A1
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,00000004,774CDF20,002776AD), ref: 003329A6

Strings

once %p is %d, xrefs: 00276BB6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: abort$Alloccallocfprintf
String ID: once %p is %d
API String ID: 4948393-95064319
Opcode ID: c401bfa2a02bb2c3ae7617f498b3ba7ad5a591dc992875e3c72cb3501a4522d3
Instruction ID: 0bd7e643d8ee1a3e1bfb7a9233c4c3560fabd57a49ea4059881f11eed7dea063
Opcode Fuzzy Hash: c401bfa2a02bb2c3ae7617f498b3ba7ad5a591dc992875e3c72cb3501a4522d3
Instruction Fuzzy Hash: 591170B11147019FD311EF2CE88975DBBE4FB81315F01852EE599D3322E77898198F52

Function 002472B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 002472FC
calloc.MSVCRT ref: 00247312
WideCharToMultiByte.KERNEL32 ref: 0024734C
free.MSVCRT ref: 00247399

Strings

Win32: Failed to convert string to UTF-8, xrefs: 00247360, 00247380

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ByteCharMultiWide$callocfree
String ID: Win32: Failed to convert string to UTF-8
API String ID: 1064854850-2776438994
Opcode ID: 2f21c855c6cc5ca111365b9f8d6fff62995433f34f4b626f832e6b11ecc17796
Instruction ID: 73a71d7fc5e2103d7ca20d936a8598cdc02e353d8dd9e03e86fd3b54d3a157d6
Opcode Fuzzy Hash: 2f21c855c6cc5ca111365b9f8d6fff62995433f34f4b626f832e6b11ecc17796
Instruction Fuzzy Hash: 9A11F6B04193029BD314AF66C55831FBFE0AF84754F118A1DE8E84B280D7B99998DFD3

Function 001EEC70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53processsynchronizationCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 001EED04
CloseHandle.KERNEL32 ref: 001EED29
CloseHandle.KERNEL32 ref: 001EED35
WaitForSingleObject.KERNEL32 ref: 001EED53

Strings

D, xrefs: 001EEC87

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait
String ID: D
API String ID: 2059082233-2746444292
Opcode ID: 626525c870e5180b9ea32186996e9b65e74fa43f734ac220bcbf5765efdfada3
Instruction ID: 700427c3f70957dc1c1aef8bbcfe8d7a3be1421a4f866378e17d5d07ff55463b
Opcode Fuzzy Hash: 626525c870e5180b9ea32186996e9b65e74fa43f734ac220bcbf5765efdfada3
Instruction Fuzzy Hash: 1F21A0B05083419FE710EF69D59870FBBF0BB85304F408A2CE59887290E7BAD9498B83

Function 0024A530 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 0024A5CA
SetDeviceGammaRamp.GDI32 ref: 0024A5DC
DeleteDC.GDI32 ref: 0024A5E8

Part of subcall function 0023F1D0: strcpy.MSVCRT ref: 0023F235

Strings

Win32: Gamma ramp size must be 256, xrefs: 0024A549
DISPLAY, xrefs: 0024A5C3

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CreateDeleteDeviceGammaRampstrcpy
String ID: DISPLAY$Win32: Gamma ramp size must be 256
API String ID: 3777951602-1165277357
Opcode ID: c9476641a28ccae6650e2325df8d43797524065a9fae8460754f1bcdc247d753
Instruction ID: 4a64d68de564d53278e5bbb043ac85850e982d2023cea6edac316a86ae5b689e
Opcode Fuzzy Hash: c9476641a28ccae6650e2325df8d43797524065a9fae8460754f1bcdc247d753
Instruction Fuzzy Hash: AF114CB28047048FE710EF68E54879ABBE1FFC5320F45892DE88857254D7B59898CB82

Function 002021A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 002021DC
exit.MSVCRT ref: 00202214

Strings

------------------------------------------------------------, xrefs: 002021BD, 002021F5
Error: insufficient memory available%s, xrefs: 002021FD
Error: file is corrupted%s, xrefs: 002021C5

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exit
String ID: Error: file is corrupted%s$Error: insufficient memory available%s$------------------------------------------------------------
API String ID: 2483651598-137132821
Opcode ID: 939c83617f767e330ce6827f38b681f36a2cf45a148e32ac0e43fa1bb23e0ae1
Instruction ID: 246d3e6d22d21109745c3af15de9debf8eb11b0b27250f05073da846dd46bb2a
Opcode Fuzzy Hash: 939c83617f767e330ce6827f38b681f36a2cf45a148e32ac0e43fa1bb23e0ae1
Instruction Fuzzy Hash: BE014BB56197009BD711AF62D80A36EBBE0BF41345F01C82DD8CC97252CB74A4588F92

Function 001F67A3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 001F657F
free.MSVCRT ref: 001F664F
free.MSVCRT ref: 001F665D
free.MSVCRT ref: 001F666B
free.MSVCRT ref: 001F66C1
free.MSVCRT ref: 001F66CF
free.MSVCRT ref: 001F66DD
_close.MSVCRT ref: 001F67AB
malloc.MSVCRT ref: 001F67CD
malloc.MSVCRT ref: 001F67E3

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

Strings

ERROR: can't close file %s, xrefs: 001F67F8
%s, xrefs: 001F681C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$malloc$Char_closelongjmp
String ID: %s$ERROR: can't close file %s
API String ID: 4226686182-2251370396
Opcode ID: cfe2d3ad812f8137ff44ada194b1899f85b7ff13d7a72690560a9a8106f7bbeb
Instruction ID: df59f3bbf26e8d175c8954f85e610659358261ccdad10badd6b61da60a6ca4d3
Opcode Fuzzy Hash: cfe2d3ad812f8137ff44ada194b1899f85b7ff13d7a72690560a9a8106f7bbeb
Instruction Fuzzy Hash: 82F0F9B490CB159BC711AF25C58122EB7E1BF45340F12C82CE9C89B205DB74C8809F86

Function 001F0BB2 Relevance: 7.9, APIs: 3, Strings: 2, Instructions: 400COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 001F0BE9
EnterCriticalSection.KERNEL32 ref: 001F0D6F
LeaveCriticalSection.KERNEL32 ref: 001F0D8B

Strings

seek_input, xrefs: 001F0DF9, 001F0EA6
read, xrefs: 001F0CFF, 001F0D33, 001F0EE7, 001F0FD1, 001F1097

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: read$seek_input
API String ID: 2801635615-1189155391
Opcode ID: 5eaad6bdffea39b0d0c432aaee941e13be53b3b28f5f0792f64f1548367a007c
Instruction ID: 3f114dc2432241c8ec042fce47419cce4c68bf1f96a515e65118668fd99acd1b
Opcode Fuzzy Hash: 5eaad6bdffea39b0d0c432aaee941e13be53b3b28f5f0792f64f1548367a007c
Instruction Fuzzy Hash: AB020A75908355DFD710CF28C48065ABBE1BF88368F1A8A6DF9A8A7351D335E845CF81

Function 00224C19 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00221D09: memset.MSVCRT ref: 00221D27
Part of subcall function 00221D09: memcpy.MSVCRT(-00000006,?,?,?,0000F000,00225512,-00000006,?,?,?,00000000), ref: 00221D54

memset.MSVCRT ref: 00224F49

Strings

@, xrefs: 00224CB4
@, xrefs: 00224FDB
@, xrefs: 0022502A
SCRS, xrefs: 00224E5A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: memset$memcpy
String ID: @$@$@$SCRS
API String ID: 368790112-1523600638
Opcode ID: 94e573370c584e89c1c08a60917127d9655999b617a89648cb50d4d4746e132f
Instruction ID: fdc2cfacfcc58ffc06cd7e1cc949fc4f6b550f127748530f7d445162f8e7916e
Opcode Fuzzy Hash: 94e573370c584e89c1c08a60917127d9655999b617a89648cb50d4d4746e132f
Instruction Fuzzy Hash: 37D147704287A2AFD330EFA8E441726BBF0BF95304F048A2EE9D586592D774E525CF52

Function 00225269 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002252EB
memcpy.MSVCRT(00000000,?,?,?,?,?,00000000), ref: 0022534B
memcpy.MSVCRT(?,00000000,?,?,?,?,?,?,00000000), ref: 00225360
memset.MSVCRT ref: 00225404

Strings

OggS, xrefs: 00225304

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: memcpymemset
String ID: OggS
API String ID: 1297977491-2004203516
Opcode ID: b9bca6b851bab3e5cf7448ff428d45c06dbc2eb0d6a06bcff3bc5244b7277f43
Instruction ID: f6cd0d5c33cf7ee9a3d2fc253ef508d4f28317f40097df2d7fa0c83f68c7e82a
Opcode Fuzzy Hash: b9bca6b851bab3e5cf7448ff428d45c06dbc2eb0d6a06bcff3bc5244b7277f43
Instruction Fuzzy Hash: C1810A71930A31BBD724EFA8EC41BA9B3A5BF04310F148265E905E7691D774EDB0DB50

Function 00252439 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0025269D
free.MSVCRT ref: 002526A5

Strings

EGL: Failed to bind OpenGL: %s, xrefs: 002526F6
@0, xrefs: 0025263C
ERROR: UNKNOWN EGL ERROR, xrefs: 002526E1

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID: @0$EGL: Failed to bind OpenGL: %s$ERROR: UNKNOWN EGL ERROR
API String ID: 1294909896-704385317
Opcode ID: e3b1eafed7c7ade2f5efbf26b03e93be669113c41e2397721520ae8b88a5b98a
Instruction ID: f318ec5b700054cf40ea953226ffbfdac3765ed9ad946570f5c30538e1dd7be0
Opcode Fuzzy Hash: e3b1eafed7c7ade2f5efbf26b03e93be669113c41e2397721520ae8b88a5b98a
Instruction Fuzzy Hash: E381E0B4918305DFD310EF28D58812ABBF4FB89305F40882DE99887351E775E998CF86

Function 0024A0D0 Relevance: 7.7, APIs: 5, Instructions: 161COMMON

Download Yara Rule

APIs

EnumDisplaySettingsW.USER32 ref: 0024A13D
calloc.MSVCRT ref: 0024A25D
EnumDisplaySettingsW.USER32 ref: 0024A295

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: DisplayEnumSettings$calloc
String ID:
API String ID: 1478160765-0
Opcode ID: e245a2d291e65c4c5358778b32a194b4750a0cecc24ffec4948669c2da434cd7
Instruction ID: 082297914236d7143529d211148730086a593e9b615a3701e0fa6b25ba2cd6e4
Opcode Fuzzy Hash: e245a2d291e65c4c5358778b32a194b4750a0cecc24ffec4948669c2da434cd7
Instruction Fuzzy Hash: CF71AFB45083458FD724DF68C584A5ABBF0FF88314F11892EE88897311E3B5E999CF82

Function 001C2DA0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

basic_string::_M_construct null not valid, xrefs: 001C2F98
BlackHole, xrefs: 001C2F12
ddA, xrefs: 0032ED2D
ddA, xrefs: 0032ED23

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: BlackHole$basic_string::_M_construct null not valid$ddA$ddA
API String ID: 0-586649475
Opcode ID: 40565694111e16278f31a6c960f86d63ee1d380ff7cff7c0dd3bba72c4c09378
Instruction ID: 7fb323bc92d53da9bf78ac3baa6b524aac2af821814a88264b0170b63024d88f
Opcode Fuzzy Hash: 40565694111e16278f31a6c960f86d63ee1d380ff7cff7c0dd3bba72c4c09378
Instruction Fuzzy Hash: E5518AB0915218CBDB05EF68D581B9DBBF4BF55300F04446DEC88AF34ADB349948CBA2

Function 00240030 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134stringCOMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00240154
calloc.MSVCRT ref: 0024016A
calloc.MSVCRT ref: 0024017D
strncpy.MSVCRT ref: 002401A4

Strings

, xrefs: 00240192

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: calloc$strncpy
String ID:
API String ID: 3831826497-3916222277
Opcode ID: a5a7a48f2f01bebb11bc21fd48b6f3c7a2b9f66713a43ae8baeeb06833e1af57
Instruction ID: cdc4d0fa8d5389ef68c7648cec49c6435f80bb2d477cd825354cfb513d445abd
Opcode Fuzzy Hash: a5a7a48f2f01bebb11bc21fd48b6f3c7a2b9f66713a43ae8baeeb06833e1af57
Instruction Fuzzy Hash: 56415A38325241CBEB18CF59E8C4B6777E4AB44704F14843EAA0DCF282D6B4D8A4DF92

Function 001D4082 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

Strings

N2, xrefs: 0032F4E0, 0032F50A, 0032F534, 0032F55E
basic_string::_M_construct null not valid, xrefs: 001D415D
}(, xrefs: 001D40AF
N2d6;, xrefs: 0032F57E, 0032F5AD

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: }($basic_string::_M_construct null not valid$N2$N2d6;
API String ID: 0-3348822851
Opcode ID: c9ce8801f16a50a29a02223b04c6b9df49c689ad5f924194ce09fc2e59a4afc8
Instruction ID: 07e1d2327693a23e3fb19710dedbc0498e5c6422466a1152c8c8b0d5a6ea3999
Opcode Fuzzy Hash: c9ce8801f16a50a29a02223b04c6b9df49c689ad5f924194ce09fc2e59a4afc8
Instruction Fuzzy Hash: 7C5148B48053219BCB02BF70D58279EBBF0BF50704F02886EEA995F306DB749944CB92

Function 001F0241 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

atoi.MSVCRT ref: 001F0332

Strings

progress, xrefs: 001F02D8
read, xrefs: 001F0257
write, xrefs: 001F02BD

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: atoi
String ID: progress$read$write
API String ID: 657269090-2066358310
Opcode ID: ed4c41bc92bc079e53386402286304dbc7fd8dd45d97196cad563e119d6f573b
Instruction ID: d709afa87d7b87f783c86ffda602dea7fc8509133b6571a0aefb86ddf3ab1810
Opcode Fuzzy Hash: ed4c41bc92bc079e53386402286304dbc7fd8dd45d97196cad563e119d6f573b
Instruction Fuzzy Hash: C0319E75A08708CFCB29CF29C49473ABBE0FB89325F15856EEA458B352D731D840CB51

Function 0021460D Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00214619
LeaveCriticalSection.KERNEL32(?), ref: 002146E8

Strings

R[!, xrefs: 002146AB
Ha!, xrefs: 0021464D, 00214680

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Ha!$R[!
API String ID: 3168844106-2161076317
Opcode ID: 37c95e2f220714ca54c3e8f44f01dd3975e28160667e59148d3eb174a23a4dd1
Instruction ID: ef2042408174c98440bc815f9bb7a09b8188df1a82b89ff27feb4206afcec2a8
Opcode Fuzzy Hash: 37c95e2f220714ca54c3e8f44f01dd3975e28160667e59148d3eb174a23a4dd1
Instruction Fuzzy Hash: 5B310775610B419FD720EF76D844BA3B7EABF9630AF10482DE59A86620C771B860CB21

Function 002002C4 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00200197
free.MSVCRT ref: 002002CF
calloc.MSVCRT ref: 00200321
free.MSVCRT ref: 00200392

Strings

read, xrefs: 00200366

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$calloc
String ID: read
API String ID: 3095843317-2555855207
Opcode ID: 528e04277cf530b18a12cf3af0724950ac0570cd5f3cfabed4147c6748146dd8
Instruction ID: 98036247d3d5a2e84d1b44bda5e7c148a72735786d45cddbd20d359a744fcfb3
Opcode Fuzzy Hash: 528e04277cf530b18a12cf3af0724950ac0570cd5f3cfabed4147c6748146dd8
Instruction Fuzzy Hash: CA2119B1A183028FD714DF79C58122EFBE1AFC8704F148A6EE498D7282D770D9548F46

Function 00274760 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00275502), ref: 00274777
ReleaseSemaphore.KERNEL32 ref: 002747CE
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00275502), ref: 002747DE
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00275502), ref: 002747FB
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00275502), ref: 00274824

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: 8850c3842cf0e9de4c552d343202eaf54c599255da7d35cbb564fee0da2542e2
Instruction ID: 4bff65d531390b8ecc1bcdd7bee7c6f3594de1640fb636c1d561c05099058763
Opcode Fuzzy Hash: 8850c3842cf0e9de4c552d343202eaf54c599255da7d35cbb564fee0da2542e2
Instruction Fuzzy Hash: AF214FB26093018FD704AF39E98961AFBE4FB8A212F05453EE949C3351D671D9588B92

Function 0024E49C Relevance: 7.6, APIs: 5, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32 ref: 0024E333
SetWindowPos.USER32 ref: 0024E375
SetThreadExecutionState.KERNEL32 ref: 0024E4A7

Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475D9
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 002475F5
Part of subcall function 00247570: VerSetConditionMask.KERNEL32 ref: 00247611

SystemParametersInfoW.USER32 ref: 0024E4F9
SystemParametersInfoW.USER32 ref: 0024E51D

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ConditionInfoMask$ParametersSystem$ExecutionMonitorStateThreadWindow
String ID:
API String ID: 346400206-0
Opcode ID: 437fd5c219e297005686341c609553758e0120938a067895a5c409ee12c65cf7
Instruction ID: a68f719928f388a1f122e78c4c68410b50d5c7d5aa6e97cc3ca10ee2011471b3
Opcode Fuzzy Hash: 437fd5c219e297005686341c609553758e0120938a067895a5c409ee12c65cf7
Instruction Fuzzy Hash: AF31ADB55197019FD704EF68D68831ABBE0BF88311F01896EE8998B355D7B5D888CF82

Function 002227F1 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 63COMMON

Download Yara Rule

Strings

XTPM, xrefs: 0022282A
STPM, xrefs: 00222821
AUTH, xrefs: 00222869
.FSM, xrefs: 00222853

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: .FSM$AUTH$STPM$XTPM
API String ID: 0-3563634139
Opcode ID: 8950c3b489525491c3e4e5b7dcefee575f5288a1221e40b25e17281109483490
Instruction ID: 825842324b92974e3ed2f74c88809d8235cc9decc79b819b94596d280e3a74f8
Opcode Fuzzy Hash: 8950c3b489525491c3e4e5b7dcefee575f5288a1221e40b25e17281109483490
Instruction Fuzzy Hash: 2A113B72920233FBC730CEA4E4846BAB3D9AB04315710892DD8A6D7251D773DC69CBB2

Function 001F117D Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000), ref: 0032F9E3
DeleteCriticalSection.KERNEL32(?), ref: 0032FA0F
DeleteCriticalSection.KERNEL32 ref: 0032FA6A
LeaveCriticalSection.KERNEL32(00000000), ref: 0032F9BD

Part of subcall function 003306E0: abort.MSVCRT(?,?,?,?,?,?,002801AF), ref: 00330710
Part of subcall function 003306E0: abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330718
Part of subcall function 003306E0: abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330720
Part of subcall function 003306E0: abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330728

DeleteCriticalSection.KERNEL32(00000000), ref: 0032FA85

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$Deleteabort$Leave
String ID:
API String ID: 2046026691-0
Opcode ID: 8387fc3e96c2276f3db2043a7668bb0b17c54c1d2380b5eba886791994a7b34b
Instruction ID: 8b40da466f1d2215478ba7c433fd6404d78f650ebc11a6438648fc473f2afab8
Opcode Fuzzy Hash: 8387fc3e96c2276f3db2043a7668bb0b17c54c1d2380b5eba886791994a7b34b
Instruction Fuzzy Hash: C021E5B55187159FC761AFB4D58859EBBF8BF84380F420D3DE48987602EB30A584CF92

Function 001EEB80 Relevance: 7.6, APIs: 5, Instructions: 56timefileCOMMON

Download Yara Rule

APIs

gmtime.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001EEBA0
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001EEBF2
CreateFileW.KERNEL32 ref: 001EEC32
SetFileTime.KERNEL32 ref: 001EEC54
CloseHandle.KERNEL32 ref: 001EEC60

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: FileTime$CloseCreateHandleSystemgmtime
String ID:
API String ID: 2587785350-0
Opcode ID: 3d061c4d25b6462712f973d6aa69a56a4bf9563ff0889290e46c7e9d96114b78
Instruction ID: 0a11dd8e72b293e71d2335e32d454f334f4afa7dcb9e1b7d79f296cbf416d33c
Opcode Fuzzy Hash: 3d061c4d25b6462712f973d6aa69a56a4bf9563ff0889290e46c7e9d96114b78
Instruction Fuzzy Hash: 4B21DFB05183009FC340EF64D68861BBBF0FF94714F559A2EE8898B365E3B9D549CB86

Function 002471E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0024721C
calloc.MSVCRT ref: 00247232
MultiByteToWideChar.KERNEL32 ref: 0024725C
free.MSVCRT ref: 002472A9

Strings

Win32: Failed to convert string from UTF-8, xrefs: 00247270, 00247290

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ByteCharMultiWide$callocfree
String ID: Win32: Failed to convert string from UTF-8
API String ID: 1064854850-64859510
Opcode ID: 7af09457593a78c3e1321b6bea3b8271419c09103f7540ebe36d528f9689f864
Instruction ID: 5e8ccb0054e5e1720e8da5549ff1ba004fb383a6e54f3aca0d76e9667f14207d
Opcode Fuzzy Hash: 7af09457593a78c3e1321b6bea3b8271419c09103f7540ebe36d528f9689f864
Instruction Fuzzy Hash: 8C1128B05193069BC310BF69D90831BBAE0BB80B50F018A1DE8E84B281D7B98954DB93

Function 001EE9C0 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001EE9DF
GetTempPathW.KERNEL32 ref: 001EE9F8
wcslen.MSVCRT ref: 001EEA09
realloc.MSVCRT ref: 001EEA1F

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: PathTempmallocreallocwcslen
String ID:
API String ID: 1347774481-0
Opcode ID: 41fcc3b8e96f7e168fbc4d439c60aac73f1970266f3d1ac8902ebbc9fc003ca9
Instruction ID: 73339e1613c371a83ab54d56da280a9c728e782df9f9780cc7f4085a3ae0e466
Opcode Fuzzy Hash: 41fcc3b8e96f7e168fbc4d439c60aac73f1970266f3d1ac8902ebbc9fc003ca9
Instruction Fuzzy Hash: DE017CB45097008FD760FF68E98534CBBF0BB04309F41483DE58893312EB7499589B66

Function 0024AD7C Relevance: 7.5, APIs: 5, Instructions: 35registryCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 0024AD27
ClientToScreen.USER32 ref: 0024AD43
ClientToScreen.USER32 ref: 0024AD59
ClipCursor.USER32 ref: 0024AD61
SetCursor.USER32 ref: 0024AD87
RegisterRawInputDevices.USER32 ref: 0024ADC2

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Client$CursorScreen$ClipDevicesInputRectRegister
String ID:
API String ID: 3910241791-0
Opcode ID: a44ab7959486de792cadd1e54affc13b8c0ac54c23a9c197e56ff31e29d992b9
Instruction ID: 7661993d25a9a8f5f063629323429fb23e12280775a32f401d56e5bedb62a070
Opcode Fuzzy Hash: a44ab7959486de792cadd1e54affc13b8c0ac54c23a9c197e56ff31e29d992b9
Instruction Fuzzy Hash: BC01DA719147008FD701BF78EA8915D7BF4AF49302F054939EC858B215E774D8588B93

Function 0020AF80 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 0020AF97
malloc.MSVCRT ref: 0020AFA6
strncpy.MSVCRT ref: 0020AFBC

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

free.MSVCRT ref: 0020AFE4

Strings

%s, xrefs: 0020AFD5

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: freemalloc$Charstrcpystrncpy
String ID: %s
API String ID: 3270163058-620797490
Opcode ID: 4792263de77d89e983a70aa74d2bc1d30385840b1dcf7f2807cc66852d501898
Instruction ID: 36f61abe3c5e368083b0606e6883ef342d7d5748ce697999ba9bd59f5f1e2692
Opcode Fuzzy Hash: 4792263de77d89e983a70aa74d2bc1d30385840b1dcf7f2807cc66852d501898
Instruction Fuzzy Hash: 1CF0B2B0819750ABC751FF69C58255EFBE0AF48704F82882EF8C997302D774D9909B92

Function 00246471 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

Invalid window aspect ratio %i:%i, xrefs: 00246508

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: Invalid window aspect ratio %i:%i
API String ID: 0-325947436
Opcode ID: 6ead20802facccf9c038a9b70ad36bbea5b2a74ad82ca05572bca98a687888f3
Instruction ID: 4ce7ef54291f4e63bcfdb346126b4c0c959ede07dcbc7b627957e82234eb0f6b
Opcode Fuzzy Hash: 6ead20802facccf9c038a9b70ad36bbea5b2a74ad82ca05572bca98a687888f3
Instruction Fuzzy Hash: C46156B5918301CFCB14AF29C64831ABBF0BF89718F148A2EF99887265E775D954CB43

Function 0020AE1A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32 ref: 0020A7CA
GetStartupInfoW.KERNEL32 ref: 0020A845
QueryPerformanceCounter.KERNEL32 ref: 0020A882

Strings

D, xrefs: 0020A83A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CounterInfoPerformanceProcessQuerySizeStartupWorking
String ID: D
API String ID: 2251184149-2746444292
Opcode ID: ef31e4104b61374f78a8ff5e37d509f9f3d0618bcdd2d8dbe3a21188b71461d8
Instruction ID: df3e0bbf6509d22ca6ea4bf40a821bf324361f0f1cb34d5aac2f95e42051f307
Opcode Fuzzy Hash: ef31e4104b61374f78a8ff5e37d509f9f3d0618bcdd2d8dbe3a21188b71461d8
Instruction Fuzzy Hash: 7351C2B57283428FDB114E29889032EBBE1AFDA354F58493DD8CAD3392D630D9458B17

Function 00266360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 002663C4
_errno.MSVCRT ref: 00266426
_errno.MSVCRT ref: 002664EC

Strings

exp, xrefs: 002663D5, 00266441, 002664FB

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: _errno
String ID: exp
API String ID: 2918714741-113136155
Opcode ID: b6a3e9b43918509c2acfc04b06b9b65e0585c758482a847c8df44ed1d2dac100
Instruction ID: a244aabe589908db75fe14874111dffd46b25120661961c78344fb003fc3e76a
Opcode Fuzzy Hash: b6a3e9b43918509c2acfc04b06b9b65e0585c758482a847c8df44ed1d2dac100
Instruction Fuzzy Hash: 7241C2F1D08746A6DB027F00E8093597FE0FB85744F514D89E4C8612B5FB368A788B86

Function 0020ADD9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32 ref: 0020A7CA
GetStartupInfoW.KERNEL32 ref: 0020A845
QueryPerformanceCounter.KERNEL32 ref: 0020A882

Strings

D, xrefs: 0020A83A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CounterInfoPerformanceProcessQuerySizeStartupWorking
String ID: D
API String ID: 2251184149-2746444292
Opcode ID: 51fd4d2d6c274d6f388c730a1d4fed95442578329178293669cf54f63f624f70
Instruction ID: b7c760772572d297690a83bb802fca423dc97057364ed9ab5af0ee532ffbd5fb
Opcode Fuzzy Hash: 51fd4d2d6c274d6f388c730a1d4fed95442578329178293669cf54f63f624f70
Instruction Fuzzy Hash: 4841B2B53183428FDB218F29C49432ABBE1AFDA350F58493ED9C6D3391D634D5458B53

Function 00246385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

Invalid window maximum size %ix%i, xrefs: 00246438
Invalid window minimum size %ix%i, xrefs: 00246418

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: Invalid window maximum size %ix%i$Invalid window minimum size %ix%i
API String ID: 0-3225111338
Opcode ID: 9f4cc3cfd6abe5043cee6d44b0cf6271b0350bfa3bbf8e04f8915906fc18b88c
Instruction ID: eb281dbc09a714d40843562dea6bd27757ae57346a5327d8017a176558300f93
Opcode Fuzzy Hash: 9f4cc3cfd6abe5043cee6d44b0cf6271b0350bfa3bbf8e04f8915906fc18b88c
Instruction Fuzzy Hash: 4F412175519312CFC728CF19D58825ABBE0BF85724F148B2EF5A857290D3B19899CF83

Function 0024A410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 0024A445
GetDeviceGammaRamp.GDI32 ref: 0024A45B
DeleteDC.GDI32 ref: 0024A467

Part of subcall function 00242C70: calloc.MSVCRT ref: 00242C88
Part of subcall function 00242C70: calloc.MSVCRT ref: 00242C9A
Part of subcall function 00242C70: calloc.MSVCRT ref: 00242CAD

Strings

DISPLAY, xrefs: 0024A437

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: calloc$CreateDeleteDeviceGammaRamp
String ID: DISPLAY
API String ID: 2482751880-865373369
Opcode ID: b31750d3b2a532fa32cd381d88984083c8b2bbea3beea53599993ee3c76fa4e0
Instruction ID: 96a0ecd1dd72fde9578e5f4a9e04f141eddccf51275fae4092a4171bd4c2de56
Opcode Fuzzy Hash: b31750d3b2a532fa32cd381d88984083c8b2bbea3beea53599993ee3c76fa4e0
Instruction Fuzzy Hash: 01318F720047448FD720EF38D58939ABBE1FB85314F158A6DE9599B381C375940ACF82

Function 0028AF70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strerror.MSVCRT ref: 0028AF83
strlen.MSVCRT ref: 0028AF93
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,?,?,00332727), ref: 0028AFFF

Strings

basic_string::_M_construct null not valid, xrefs: 0028B00C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: memcpystrerrorstrlen
String ID: basic_string::_M_construct null not valid
API String ID: 2955597728-3522614731
Opcode ID: 01de0189ff1e3779677d5391a8b93535e30b2aa92046938738ea45ba75093045
Instruction ID: b0a93f72d10c15536064cc7fa5834f9e2eb44ad60c4d7ae98579f7b5a8b93473
Opcode Fuzzy Hash: 01de0189ff1e3779677d5391a8b93535e30b2aa92046938738ea45ba75093045
Instruction Fuzzy Hash: BE1166B55193118FD711EF39C08021EFBE4AF9A340F04886EE988DB345EA31D859CBA2

Function 001C22F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?,001C744D), ref: 001C2340
CoTaskMemFree.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 001C2353
PathCchStripToRoot.API-MS-WIN-CORE-PATH-L1-1-0 ref: 001C2363

Strings

%ls, xrefs: 001C237C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Path$FolderFreeKnownRootStripTask
String ID: %ls
API String ID: 122202160-3246610740
Opcode ID: c09f3807b6376e7d6c721866e907c7fdda77f025ac88e97a99711c598b3f4332
Instruction ID: 1e10ccd4dc7a006a4affbe5c3fabfb81b05e3069e9edede2c2c222583bdc03b6
Opcode Fuzzy Hash: c09f3807b6376e7d6c721866e907c7fdda77f025ac88e97a99711c598b3f4332
Instruction Fuzzy Hash: 90119BB98093019FC701EF29D58960EBBF4FB89754F018A2EE89997312E735D944CF92

Function 001F0130 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 001F0177
GetProcAddress.KERNEL32 ref: 001F018F

Strings

SystemFunction036, xrefs: 001F0184
ADVAPI32.DLL, xrefs: 001F0170

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: ADVAPI32.DLL$SystemFunction036
API String ID: 2574300362-1064046199
Opcode ID: 4949548600e2e0ec8c0f46f18fcf73c089ddeee9e821db3bf3e2fe9b5963168e
Instruction ID: ccaf35a3ba330c88d4a3ead0f0896511fd03c6bb1dab66de1e9ff3fa125826ca
Opcode Fuzzy Hash: 4949548600e2e0ec8c0f46f18fcf73c089ddeee9e821db3bf3e2fe9b5963168e
Instruction Fuzzy Hash: 860162F560C3048BE711AF789EC522B3AE0AB49304F444578D9C487312E7B0DD44DB52

Function 0024A567 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CreateDCW.GDI32 ref: 0024A5CA
SetDeviceGammaRamp.GDI32 ref: 0024A5DC
DeleteDC.GDI32 ref: 0024A5E8

Strings

DISPLAY, xrefs: 0024A5C3

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CreateDeleteDeviceGammaRamp
String ID: DISPLAY
API String ID: 790129706-865373369
Opcode ID: ff9cae95c095b0e333f257773201fafe395c044be6819bd558e5a352d191e3a6
Instruction ID: 56d1edbc38f324fa8c23fda5aecc04170fdca4bf724937f454f317a305644450
Opcode Fuzzy Hash: ff9cae95c095b0e333f257773201fafe395c044be6819bd558e5a352d191e3a6
Instruction Fuzzy Hash: AE017CB28047048FD700EF68D44838EBBE1FFC5310F06896CE89997350DBB59948CB82

Function 001C2227 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 001C2242
WriteFile.KERNEL32 ref: 001C2276
CloseHandle.KERNEL32 ref: 001C2299

Strings

\, xrefs: 001C224F

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: FileWrite$CloseHandle
String ID: \
API String ID: 975693313-2967466578
Opcode ID: 4b1e1ebb68ae1880b4d85041dfe3d94199a3003ef07f53da49f1ad1208f9666e
Instruction ID: 9464be71e4ce1a39008dc2cfb4386e2775547dd80415e940abc9eb1b3c16fef8
Opcode Fuzzy Hash: 4b1e1ebb68ae1880b4d85041dfe3d94199a3003ef07f53da49f1ad1208f9666e
Instruction Fuzzy Hash: AC0181B18087009FD7217F54ED8835EBFE0EB51305F05442DE98806211D3B9D4898B87

Function 0020E869 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 0020E84F
longjmp.MSVCRT ref: 0020E87F

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 0020E8AE
%s, xrefs: 0020E8CE

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exitlongjmp
String ID: %s$ERROR: can't alloc %lu memory bytes
API String ID: 2266059207-701587655
Opcode ID: 2ed077ea7d12da4b5fbb4ee2b516217122d47b81c7c59760580bfc77d4f078df
Instruction ID: 5461c7fae73bc0dd77ef0068956a2351c07c163db206dc31963130995b67267c
Opcode Fuzzy Hash: 2ed077ea7d12da4b5fbb4ee2b516217122d47b81c7c59760580bfc77d4f078df
Instruction Fuzzy Hash: 33018CB5828318DBC710AF24D44636EBBE0FF44355F01C82EE5D857282C7B89895DF82

Function 001F122C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 001F123F
exit.MSVCRT ref: 001F1297

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 001F1262
%s, xrefs: 001F1284

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exitlongjmp
String ID: %s$ERROR: can't alloc %lu memory bytes
API String ID: 2266059207-701587655
Opcode ID: 05c8260f5090ff290e77bf33a4daf68348b8d0f0190ec543995ed4403ef68a6a
Instruction ID: 9c3ae1e01b01c24c79995c31b3ecdc776f2c19eaebcb3877b64f2c6b3c768069
Opcode Fuzzy Hash: 05c8260f5090ff290e77bf33a4daf68348b8d0f0190ec543995ed4403ef68a6a
Instruction Fuzzy Hash: DE01F2B0909B14DFD302AF65D98522EBBE0BB44701F41982CE5C897212C7B49880CF96

Function 0020EC04 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25stringCOMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,?,00000000,0020F11C,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0020EC17
exit.MSVCRT ref: 0020EC79
strcpy.MSVCRT ref: 0020ECFF
CharToOemW.USER32 ref: 0020ED35
_wmkdir.MSVCRT ref: 0020ED8B

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 0020EC44
%s, xrefs: 0020EC66

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Char_wmkdirexitlongjmpstrcpy
String ID: %s$ERROR: can't alloc %lu memory bytes
API String ID: 1924296003-701587655
Opcode ID: cc2e3341f5ee51c3eb5e8f045f80dcf2f37bdd16be13cd24f10186ec495e3453
Instruction ID: 4d83a97522242e5d3c7e7d8f32b305b3791dc3dc19de62c70e852ef301780586
Opcode Fuzzy Hash: cc2e3341f5ee51c3eb5e8f045f80dcf2f37bdd16be13cd24f10186ec495e3453
Instruction Fuzzy Hash: 5BF0D4B05297189BD351BF64D54A31EBAE0BF45705F41C82DE5CC67242C7B988908F86

Function 001F1366 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,?,00000000,001ED421), ref: 001F137F
exit.MSVCRT ref: 001F13D7

Strings

ERROR: can't alloc %lu memory bytes, xrefs: 001F13A2
%s, xrefs: 001F13C4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exitlongjmp
String ID: %s$ERROR: can't alloc %lu memory bytes
API String ID: 2266059207-701587655
Opcode ID: 3be7228b3e541f74a369731dc520b1e5910d12d8aa4e3a8e0e39872677363a88
Instruction ID: b414148bd8258957aa21576877d4a02188829cbd16856c83519944982b6d59d9
Opcode Fuzzy Hash: 3be7228b3e541f74a369731dc520b1e5910d12d8aa4e3a8e0e39872677363a88
Instruction Fuzzy Hash: 5AF0B2B0809B14DBD711BF60C54636EBBE0BF44705F42CC2CE5C857202C7B868858F86

Function 001C2871 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 001C28BE

Strings

MakeValidInstallPath: swprintfInvalid path., xrefs: 001C28AF
%ls, xrefs: 001C2883
Error, xrefs: 001C28A7

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Message
String ID: %ls$Error$MakeValidInstallPath: swprintfInvalid path.
API String ID: 2030045667-4245211409
Opcode ID: a2155821caeaebd0dbcd3420ace4899b215ebe6db604a69c5d010a1809247af0
Instruction ID: a8c653be6662703c22bd6fbbcc35f8dfffdcdec3ec0d8289afac807abf595cdc
Opcode Fuzzy Hash: a2155821caeaebd0dbcd3420ace4899b215ebe6db604a69c5d010a1809247af0
Instruction Fuzzy Hash: 3CF015B550C3009BEB14AF18D58939BBBE0FB80344F00C81DE9C887244D3B9C4889B82

Function 001C6067 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20synchronizationwindowCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 001C6056
MessageBoxW.USER32 ref: 001C608F

Strings

SelectPathFinishCallback: swprintfInvalid path., xrefs: 001C6080
Error, xrefs: 001C6078

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: MessageMutexRelease
String ID: Error$SelectPathFinishCallback: swprintfInvalid path.
API String ID: 408918528-1918625331
Opcode ID: 1ca1b8beec1c4bcc149fd51c6d2d307ee96a3e3c3e9eb0131930565d8654eff0
Instruction ID: d5febd86d3e3ae34f4fd5b94afd92255e35a6588ac97b4eba1529ee747f45b28
Opcode Fuzzy Hash: 1ca1b8beec1c4bcc149fd51c6d2d307ee96a3e3c3e9eb0131930565d8654eff0
Instruction Fuzzy Hash: 0AE0C9B14097009FE310AF68D54976F7BB1BB41301F02882CE59657265DBB8A498DB97

Function 001C61A1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17synchronizationwindowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 001C61C7
ReleaseMutex.KERNEL32 ref: 001C61D8

Strings

Error, xrefs: 001C61B0
InstallCallback: MakeValidInstallpathInvalid path., xrefs: 001C61B8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: MessageMutexRelease
String ID: Error$InstallCallback: MakeValidInstallpathInvalid path.
API String ID: 408918528-617575558
Opcode ID: dbb7c7980174ace0a177220059ad5fa3040435ad6b83bbbfe075f1624aeb30e5
Instruction ID: a013340988c4325ed583541666014edd2b496ec59aa1e3328847ddbb535f72e5
Opcode Fuzzy Hash: dbb7c7980174ace0a177220059ad5fa3040435ad6b83bbbfe075f1624aeb30e5
Instruction Fuzzy Hash: 23E0BFB65097009FD300AF68E54835EBBF0FB81316F02882DD5D957265D7B59058DF47

Function 001CE75B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-00000010,00000001,0139290C), ref: 001CE767
GetProcAddress.KERNEL32 ref: 001CE77F

Strings

GetDpiForMonitor, xrefs: 001CE774
shcore, xrefs: 001CE760

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetDpiForMonitor$shcore
API String ID: 2574300362-1062703863
Opcode ID: cfb961b6f421f17b80e70ab5a2ab5dc72317517b583fada251418ce7f2539225
Instruction ID: 04a4055c4f0c5397a004d7aeec002bf10ac17d005fa0817fa1707698fe33cb9a
Opcode Fuzzy Hash: cfb961b6f421f17b80e70ab5a2ab5dc72317517b583fada251418ce7f2539225
Instruction Fuzzy Hash: 98E012B48053008FC7046F34AA0C21A7EF0BB02305F01893DD4C597215D770E058CB9B

Function 0023033A Relevance: 6.7, APIs: 5, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919077542e773ac6c856cb74ec1d318708b43bf17e87647416562b96156719d9
Instruction ID: 4401e6f6c96b100b1a421bcd4c7bb47135faace0f6eb77665e17181b8ab060af
Opcode Fuzzy Hash: 919077542e773ac6c856cb74ec1d318708b43bf17e87647416562b96156719d9
Instruction Fuzzy Hash: 500247B1628702AFC714DF28C9D5A6AF7E4BF88304F144629F89987651D730E875CFA1

Function 00230C3A Relevance: 6.6, APIs: 5, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8278265a7ac343f9718b9308e83935aa72483fa4fb957b7f5f470517c8870da
Instruction ID: d2006f1b2f99b67d2c62a8add79ab62aea62c6f1e6f06ea2a9a3be4a3c67dc2e
Opcode Fuzzy Hash: a8278265a7ac343f9718b9308e83935aa72483fa4fb957b7f5f470517c8870da
Instruction Fuzzy Hash: 4EC1EFB0224302DFD325DF28D9D5B6AB7E8FF44744F00492DE895872A1DB70E9A5CBA1

Function 001E0470 Relevance: 6.4, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001E04E3
memcpy.MSVCRT ref: 001E0552
memset.MSVCRT ref: 001E0578
free.MSVCRT ref: 001E05A4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: freemallocmemcpymemset
String ID:
API String ID: 603710549-0
Opcode ID: 846ebec30aa6856e0e34e935024d18f37fdcebbf18794cb1d1b82f1b89289d01
Instruction ID: b5c384f6b6df8f8d50332ea26afeefbfb01a8deb7871e75b1cd83d3f2913b5c5
Opcode Fuzzy Hash: 846ebec30aa6856e0e34e935024d18f37fdcebbf18794cb1d1b82f1b89289d01
Instruction Fuzzy Hash: 19612475A087458FCB05DF29C58065EBBE1BFCC744F16892EE888AB311D770E9818F82

Function 0025C270 Relevance: 6.3, APIs: 5, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0025C2F5
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00289C0C), ref: 0025C310
free.MSVCRT ref: 0025C31A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: db1fde1054ab01750a98cd8570a36ae871b8f03499647bf41f514dc8539149f2
Instruction ID: 9baf2eaa57f877a5c13f85adb01d5af24bc9668a9cec4357e25eddbf09f706f0
Opcode Fuzzy Hash: db1fde1054ab01750a98cd8570a36ae871b8f03499647bf41f514dc8539149f2
Instruction Fuzzy Hash: A0319C716283069FC320DF25C48032FBBE0AFC5752F25896CEC9587340E331D8698B8A

Function 001CA1D9 Relevance: 6.3, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001CA2B8
free.MSVCRT ref: 001CA2C3
free.MSVCRT ref: 001CA2CE
free.MSVCRT ref: 001CA2D9
free.MSVCRT ref: 001CA2E4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9db41762daa94644aedc5f6f3b4e0c88c2b6fac592911a734ec6758cbbac5cb1
Instruction ID: 5da8ad74285945e22b8f0729416b54bab4528189a3d6ac29ed3816b039356707
Opcode Fuzzy Hash: 9db41762daa94644aedc5f6f3b4e0c88c2b6fac592911a734ec6758cbbac5cb1
Instruction Fuzzy Hash: 74310871A05B14CFDB20FF78D589A9ABBE0BF10704F85492DE88697601E735F894CB82

Function 001CA2F7 Relevance: 6.3, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001CA2B8
free.MSVCRT ref: 001CA2C3
free.MSVCRT ref: 001CA2CE
free.MSVCRT ref: 001CA2D9
free.MSVCRT ref: 001CA2E4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 021b6f9110a7ebc5c05cb74207f2f5587e00c03ef1ebd527ae271b0fcd08ec24
Instruction ID: 8848059b26d59ef9dc81b659181e7028f9ac7c3e9d7b1952446f6d260433f42a
Opcode Fuzzy Hash: 021b6f9110a7ebc5c05cb74207f2f5587e00c03ef1ebd527ae271b0fcd08ec24
Instruction Fuzzy Hash: B6111675904B048FCB20FF68C586A9AB7E0BF04708F418D2DE8CA97611D775F9999B82

Function 0021CB58 Relevance: 6.3, APIs: 4, Instructions: 295COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0021CB6B
__alloca_probe_16.LIBCMT ref: 0021CBB4
qsort.MSVCRT ref: 0021CBF5
__alloca_probe_16.LIBCMT ref: 0021CC03

Part of subcall function 00211012: memset.MSVCRT ref: 00211029

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: __alloca_probe_16memset$qsort
String ID:
API String ID: 67108361-0
Opcode ID: 2c962206c5e84be67075d493e75ca477334f597fa2bbff4fc36c600258a8175a
Instruction ID: 1dece8db79abc4740717c061cd277e083822b201a0b06b45e55282ead937056e
Opcode Fuzzy Hash: 2c962206c5e84be67075d493e75ca477334f597fa2bbff4fc36c600258a8175a
Instruction Fuzzy Hash: 5EC18B78A5060AAFCB14DFA8C5919ADBBF1FF19304B20426ED556D7B41D730EAA1CF80

Function 002490C0 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 261COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00249329

Strings

P, xrefs: 00249138
, xrefs: 002492CC
@, xrefs: 002492DB

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID: $@$P
API String ID: 1294909896-3265977826
Opcode ID: 8bc6d6db64fda5ebeadfc1a4a3aec7cbc47f59689aeb3d1abf27226e4e36b791
Instruction ID: 1e30dd976e6388ceaa6b4dedb3ea7d7de80fc610940e67f12080901c7fb4f6a9
Opcode Fuzzy Hash: 8bc6d6db64fda5ebeadfc1a4a3aec7cbc47f59689aeb3d1abf27226e4e36b791
Instruction Fuzzy Hash: 0DB115B0A08701DFD704EF29D58871BBBE0FF85304F51886DE8898B2A5D775D898DB82

Function 001F3173 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 190stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0032DDA0: malloc.MSVCRT ref: 0032DDB5

strlen.MSVCRT ref: 001F3213

Strings

dict, xrefs: 001F3187
^, xrefs: 001F3438

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: mallocstrlen
String ID: ^$dict
API String ID: 770973918-1509776474
Opcode ID: 4b5b34413fe8d3be8e227fcaeedfca08ab9dfedfc78d2a61e984fc69d3568bea
Instruction ID: 567475537822c3ba2ed93249c0390d1e0e0324c46c1da7c336041e1bbd81ef9f
Opcode Fuzzy Hash: 4b5b34413fe8d3be8e227fcaeedfca08ab9dfedfc78d2a61e984fc69d3568bea
Instruction Fuzzy Hash: 198139B0508308CFDB14DF18D48476ABBE0FF94318F15896EEA985B352D3B5DA45DB81

Function 001FF38B Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 164stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0032DDA0: malloc.MSVCRT ref: 0032DDB5

strlen.MSVCRT ref: 001FF43B

Strings

lzp, xrefs: 001FF397
^, xrefs: 001FF5B0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: mallocstrlen
String ID: ^$lzp
API String ID: 770973918-2856938714
Opcode ID: 5afd63195c424f20f1475d55ba9295ca7fcaf0065349b4900e6e2646c25674e7
Instruction ID: b4f689fb3e09f2a4373d08336d402a1b62fcc3f954f0881e2871d38934f3d041
Opcode Fuzzy Hash: 5afd63195c424f20f1475d55ba9295ca7fcaf0065349b4900e6e2646c25674e7
Instruction Fuzzy Hash: 9E517BB16083058FD710DF28D88472BBBE0FF84358F15892EEA889B352D7B5D945DB82

Function 00258116 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 118COMMON

Download Yara Rule

Strings

parm#, xrefs: 00258131
this, xrefs: 0025969C
}, xrefs: 00259690

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: parm#$this$}
API String ID: 0-728413427
Opcode ID: 1d9a11555bca75bcdafbb9e682b500e68f1b9281210f1d314406902d5e6985a0
Instruction ID: d981bd4f589150825b42869c0eca21b4436c6686fc71073c59dd3b013d47f574
Opcode Fuzzy Hash: 1d9a11555bca75bcdafbb9e682b500e68f1b9281210f1d314406902d5e6985a0
Instruction Fuzzy Hash: EB515E7151D392CBCB118F28C0C43A97BE0AF65305F1988BDDCC98F346D7B988999B65

Function 0023A2B6 Relevance: 6.1, APIs: 4, Instructions: 110sleepsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00210FF1: malloc.MSVCRT ref: 00210FF5

ceil.MSVCRT ref: 0023A3BE
Sleep.KERNEL32(00000000), ref: 0023A3CC
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0023A3E0

Part of subcall function 00211B93: GetCurrentThread.KERNEL32 ref: 00211BBE
Part of subcall function 00211B93: SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 00211BCA
Part of subcall function 00211B93: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,0023C6AC), ref: 00211BD2
Part of subcall function 00211B93: SetThreadAffinityMask.KERNEL32(0023C6AC,00000000), ref: 00211BE0

free.MSVCRT ref: 0023A403

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Thread$AffinityMask$CounterCurrentObjectPerformanceQuerySingleSleepWaitceilfreemalloc
String ID:
API String ID: 1740532293-0
Opcode ID: f87c65072e10caa7db4c4c7a53c88135ff8fa53cb04d2d407a53a90de059f452
Instruction ID: 8b54c3f9932f655bbe8359097410159245b63673cbe831bb2dd041b673515fe0
Opcode Fuzzy Hash: f87c65072e10caa7db4c4c7a53c88135ff8fa53cb04d2d407a53a90de059f452
Instruction Fuzzy Hash: 1631C5B1918702EBD7117F20D90939A7BE8FF50350F104DADF1D6A01E2EB7199758B86

Function 00217288 Relevance: 6.1, APIs: 4, Instructions: 105synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00215749: EnterCriticalSection.KERNEL32(-0000013C,002160B3,?,00000000,0022CD3D,-000000B8,?,00216164,?,00000000,?,0021676F,0022CD3D,00000000,00000000,?), ref: 0021574F

__aullrem.LIBCMT ref: 0021733A
SetEvent.KERNEL32(?,?,00001000,?,?,?,00000000), ref: 00217392
SetEvent.KERNEL32(?,?,00001000,?,?,?,00000000), ref: 002173AB
WaitForSingleObject.KERNEL32(?,000000FF), ref: 002173C0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Event$CriticalEnterObjectSectionSingleWait__aullrem
String ID:
API String ID: 3926123277-0
Opcode ID: 86ca176c12a838fb221ecf60925ce24f512ef180e64ceae19b0cdaf2a7b98086
Instruction ID: c9d54285e7265d7b86d421b3e7fda90ec6944c1028a1904245e5c31a8dd5dce4
Opcode Fuzzy Hash: 86ca176c12a838fb221ecf60925ce24f512ef180e64ceae19b0cdaf2a7b98086
Instruction Fuzzy Hash: CA417872624B019FC7249F38C885BDBB7F6AFD4310F14896DE9AA87241DB70B895CB01

Function 002165A8 Relevance: 6.1, APIs: 4, Instructions: 99fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,00000000,00000002,00000000,00217561,00000000,?), ref: 0021660C
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000002,00000000), ref: 002166A3
DeleteCriticalSection.KERNEL32(0017152A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001C7E86), ref: 002166CE
VirtualUnlock.KERNEL32(?,?), ref: 002166E1

Part of subcall function 0021128A: GetCurrentThreadId.KERNEL32 ref: 0021128A
Part of subcall function 0021128A: WaitForSingleObject.KERNEL32(0035BD14,000000FF,?,?,0023C461,0023C74F,00000003,00000010,0023C74F,00000010,BASS/2.4,00000000), ref: 00211299
Part of subcall function 0021128A: CloseHandle.KERNEL32(0035BD14,?,?,0023C461,0023C74F,00000003,00000010,0023C74F,00000010,BASS/2.4,00000000), ref: 002112A1

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CloseCriticalCurrentDeleteEventFileHandleObjectSectionSingleThreadUnlockUnmapViewVirtualWait
String ID:
API String ID: 2068595648-0
Opcode ID: 0f33093fd9540eb8967d18cd8a252a9e74ddbc23bba4e562318d98f392d13759
Instruction ID: 95b3bafa06d039d7e22beb3f1d02b3d4e6fd504ab20ca8dad3a1c17fddc7d904
Opcode Fuzzy Hash: 0f33093fd9540eb8967d18cd8a252a9e74ddbc23bba4e562318d98f392d13759
Instruction Fuzzy Hash: 6931DE71A20566BBCB556F74DE45AD9F7EABF24310B408020FA4052462CB76ACF1DF90

Function 001E7280 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001E729F
free.MSVCRT ref: 001E73A7
free.MSVCRT ref: 001E73BF

Strings

outofmem, xrefs: 001E73C4

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$malloc
String ID: outofmem
API String ID: 2190258309-748900114
Opcode ID: 17e77bab24c9a7501767020985c109a3839f3b1d6d9963df3f5a9df48b305a13
Instruction ID: 5f7c1270bcde3ee6ddab70819377706265b25b480537d3e14aed92b13733c921
Opcode Fuzzy Hash: 17e77bab24c9a7501767020985c109a3839f3b1d6d9963df3f5a9df48b305a13
Instruction Fuzzy Hash: 5541FF70A087408BD3609F29D48561EBBF1FFC5344F51892DFAE586261D732D8659F82

Function 0023EFC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0023F050
free.MSVCRT ref: 0023F071
free.MSVCRT ref: 0023F0BB

Strings

`D, xrefs: 0023F019

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID: `D
API String ID: 1294909896-1070873967
Opcode ID: 7919d9e611f17c78f1a8f3da3ddbc695046e9b2304c4fd92ddf5401092744702
Instruction ID: 826244cede11f3ffdef73b6b5b83a1177624ffcfb9ba7b07ffbd7bf933a0cebb
Opcode Fuzzy Hash: 7919d9e611f17c78f1a8f3da3ddbc695046e9b2304c4fd92ddf5401092744702
Instruction Fuzzy Hash: 743156B86247019FE714EF3AE98571AB7E0FB45304F41483DE84087326D775A859CF96

Function 0020EDE8 Relevance: 6.1, APIs: 4, Instructions: 87stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0020D060: strcpy.MSVCRT(00000000,?,?,0020EE04), ref: 0020D083
Part of subcall function 0020D060: strcat.MSVCRT(00000000,?,?,0020EE04), ref: 0020D09A

strcpy.MSVCRT ref: 0020ECFF
CharToOemW.USER32 ref: 0020ED35
_wmkdir.MSVCRT ref: 0020ED8B
strlen.MSVCRT ref: 0020EE1B

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strcpy$Char_wmkdirstrcatstrlen
String ID:
API String ID: 3043065097-0
Opcode ID: 6884d3a2761db872b8b1dd8be9d80b07eb2fddb66611fdd93295451d94537d16
Instruction ID: 2c41a8392ef221156d1887c6e6100b8831864fb7bd73fd1d56e30714c193139f
Opcode Fuzzy Hash: 6884d3a2761db872b8b1dd8be9d80b07eb2fddb66611fdd93295451d94537d16
Instruction Fuzzy Hash: 0D313975A147158FCB14DF28C18476AB7E2BF85310F19886DDD889B34AD731E8A6CB82

Function 001F0385 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 001F03F4
memcpy.MSVCRT ref: 001F044A

Strings

read, xrefs: 001F0397
write, xrefs: 001F03CA

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: memcpy
String ID: read$write
API String ID: 3510742995-1125055369
Opcode ID: 19234e62956efd4edfbf08e30b0ae567fde6ac051d2b5c69381b52a6a551e7b9
Instruction ID: 529a4f481c7b3f0f6466d279ccee06bcd36b6aa7be1bf2065f4a8d53a20b5827
Opcode Fuzzy Hash: 19234e62956efd4edfbf08e30b0ae567fde6ac051d2b5c69381b52a6a551e7b9
Instruction Fuzzy Hash: 6A21D131A053089FCB159F29D98022AF7E0FF84721F48846EEE588B346E330E850CF62

Function 00240AB0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00240ADD

Part of subcall function 0024FB10: LoadImageW.USER32 ref: 0024FB90

free.MSVCRT ref: 00240BC5

Strings

Invalid standard cursor 0x%08X, xrefs: 00240B14
$D, xrefs: 00240BE5

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ImageLoadcallocfree
String ID: $D$Invalid standard cursor 0x%08X
API String ID: 4237563563-2996776654
Opcode ID: 8ef5963794bca3decf4e5b4459837268a701932a8ae805c74a54cd50dd3da887
Instruction ID: a729e0da8db63b357733ca6c252a0d02ef8f92fe500ebe09e86994fa049b0bc0
Opcode Fuzzy Hash: 8ef5963794bca3decf4e5b4459837268a701932a8ae805c74a54cd50dd3da887
Instruction Fuzzy Hash: 16316774638B11CBD728EF25D5D072ABBE0FB4474CF11886DE5894B201C7B5A8E49F8A

Function 001F20A5 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 0032FA0F
DeleteCriticalSection.KERNEL32 ref: 0032FA6A
DeleteCriticalSection.KERNEL32(00000000), ref: 0032FA85
DeleteCriticalSection.KERNEL32 ref: 0032FAD9

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: 89d50c73ba8d4411755ac8305afe704418a691df41e778725f8fc455be3091c2
Instruction ID: 0219552b55e00a6d288cee5845a63879f9d4145ff196532fb1dbfa9744307284
Opcode Fuzzy Hash: 89d50c73ba8d4411755ac8305afe704418a691df41e778725f8fc455be3091c2
Instruction Fuzzy Hash: E521F8B55187558FC721AFB4E5846AEBBF8BF44340F420D3DD48887602EB30A584CF92

Function 001ED0F6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64stringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 001ED165
strcpy.MSVCRT ref: 001ED19D

Strings

write, xrefs: 001ED13D

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: freestrcpy
String ID: write
API String ID: 2886119151-2104195679
Opcode ID: 1579e5c17d4a0e2745e7cf72423098ccc6cda58b4e25031e0f3262eefa06d5d3
Instruction ID: 73161d67abddd64106efb1aa107eed291233d883f34de6bd4ba2838b45bb73e9
Opcode Fuzzy Hash: 1579e5c17d4a0e2745e7cf72423098ccc6cda58b4e25031e0f3262eefa06d5d3
Instruction Fuzzy Hash: 6E2190B08087458BC714DF29D88115EB7E0BB48328F648F6DF498DB341C334DA90CB86

Function 003306E0 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0032DE40: malloc.MSVCRT ref: 0032DE4E

abort.MSVCRT(?,?,?,?,?,?,002801AF), ref: 00330710
abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330718
abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330720
abort.MSVCRT(?,?,?,?,?,?,002800FC,?,?,?,?,?,?,00330760), ref: 00330728

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: abort$malloc
String ID:
API String ID: 990937270-0
Opcode ID: c9eed0d3e6a9d6e368dfdc4db91f25ab840e2b99a8b03cab46906a49dbd618c1
Instruction ID: c2d41ae790a3a8ef0a13c1e176d17a06c40881adc548e201a59702019eadde71
Opcode Fuzzy Hash: c9eed0d3e6a9d6e368dfdc4db91f25ab840e2b99a8b03cab46906a49dbd618c1
Instruction Fuzzy Hash: 3D116DB48283168BCB02BF64D0D626EFBE0AF43344F525C2CA6946F256DF749448CF56

Function 001C1001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 001C1075
__p__fmode.MSVCRT ref: 001C107A
__p__commode.MSVCRT ref: 001C1087

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: __p__commode__p__fmode__set_app_type
String ID:
API String ID: 3338496922-0
Opcode ID: 730b4f10deb8fc520d64398120327fd09955d67289f88d4815eb13be90b293c8
Instruction ID: e615974c14409f10cd2456576ba2b86a6ff98fe46367328089c6353bef4b711d
Opcode Fuzzy Hash: 730b4f10deb8fc520d64398120327fd09955d67289f88d4815eb13be90b293c8
Instruction Fuzzy Hash: 0321DEF0980301DFD314EF20C451BA637E0BB55349F69886CE8084B25BE77AD8E6DB92

Function 002473E9 Relevance: 6.0, APIs: 4, Instructions: 50keyboardCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00247432
MapVirtualKeyW.USER32 ref: 0024746C
ToUnicode.USER32 ref: 0024749E
ToUnicode.USER32 ref: 002474D3

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Unicode$ByteCharMultiVirtualWide
String ID:
API String ID: 4148918737-0
Opcode ID: 9b5ad486b14d93b0d1eca43a768e4daffac9eff9bb7306bdf57f32ba0cf97458
Instruction ID: 3f3f332451408e60535c6d92a11343530d9efa2320077aa7ccfa3b5d8a5c0aee
Opcode Fuzzy Hash: 9b5ad486b14d93b0d1eca43a768e4daffac9eff9bb7306bdf57f32ba0cf97458
Instruction Fuzzy Hash: 3621C4B04183069FD314EF29D58836EBFF0BF81705F508A1EE89987252D3B989589F83

Function 001EF1E0 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 001EF1F5
wcschr.MSVCRT ref: 001EF20E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: wcschr
String ID:
API String ID: 1497570035-0
Opcode ID: 78b2a7791b26fde8304c1b6544e93fcd3c4d7fb565e058ea338a66821c544262
Instruction ID: c51ce66920f38f097df48bd00fbb3c72e4039bbaef5599864024a1b2d6334b33
Opcode Fuzzy Hash: 78b2a7791b26fde8304c1b6544e93fcd3c4d7fb565e058ea338a66821c544262
Instruction Fuzzy Hash: DF01A279108B618ADB107F29A98422FBBF0FF84744F01496EE9C48B205E3748941DB87

Function 001EE273 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 001EE286
strchr.MSVCRT ref: 001EE2AB
strchr.MSVCRT ref: 001EE2FE

Strings

:/\, xrefs: 001EE2A0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strchr
String ID: :/\
API String ID: 2830005266-2793184486
Opcode ID: 872394bb5905f8e8daf418f175133769138509a6b87185b046b68c8328b374ee
Instruction ID: 00171ae99696693c757a03c557d1d64a1cdccf6636d59dea2e93849f0ef96578
Opcode Fuzzy Hash: 872394bb5905f8e8daf418f175133769138509a6b87185b046b68c8328b374ee
Instruction Fuzzy Hash: 5F016975A49762CFD311DF29844422EBBE1AB94340F5A882EA8C597302D334C949DF82

Function 001EE3A9 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 001EE286
strchr.MSVCRT ref: 001EE2AB
strchr.MSVCRT ref: 001EE2FE
strchr.MSVCRT ref: 001EE3BB

Strings

:/\, xrefs: 001EE2A0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: strchr
String ID: :/\
API String ID: 2830005266-2793184486
Opcode ID: fd5a8b388320814173b99e97218bb2b00bd9b90984405e6c507596132186d1b2
Instruction ID: 1b7de98175cecdfd9c4d98b99df37a214705d2b313a21bace8d655519f8ae0ed
Opcode Fuzzy Hash: fd5a8b388320814173b99e97218bb2b00bd9b90984405e6c507596132186d1b2
Instruction Fuzzy Hash: 7D0157B5A48752CFD314DF29844432EBBE5AB94340F5A882EE8C597342D335D949DF82

Function 002173E4 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000084,00000008,00000000,00217639), ref: 002173ED
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 002173FF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0021740B

Part of subcall function 00211239: CreateThread.KERNEL32(00000000,00000000,00000010,00000010,00000004,0035BD18), ref: 0021124B
Part of subcall function 00211239: SetThreadAffinityMask.KERNEL32(00000000,?), ref: 00211263
Part of subcall function 00211239: SetThreadPriority.KERNEL32(0035BD14,00000000,?,?,0023C461,0023C74F,00000003,00000010), ref: 00211276
Part of subcall function 00211239: ResumeThread.KERNEL32(0035BD14,?,?,0023C461,0023C74F,00000003,00000010), ref: 0021127E

VirtualLock.KERNEL32(00000000,?,00217288,00000000,00000000), ref: 0021742F

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Thread$Create$Event$AffinityCriticalInitializeLockMaskPriorityResumeSectionVirtual
String ID:
API String ID: 2172739642-0
Opcode ID: 991f6d745d421c2e2d905a45cd19943bdb5e7c1aa692bf59f91110645985cff3
Instruction ID: 8f1afbe25ffb64980b4f710806641b14b595a15440f1fb28b5c661177a9a85d6
Opcode Fuzzy Hash: 991f6d745d421c2e2d905a45cd19943bdb5e7c1aa692bf59f91110645985cff3
Instruction Fuzzy Hash: 99F0AC71612635BAD6209BB29D8CED7BEACFF4B2A5F000216B51892101C774A961CAF5

Function 0024AC29 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 0024AC3D
SetWindowLongW.USER32 ref: 0024AC5C
SetLayeredWindowAttributes.USER32 ref: 0024AC82
DeleteObject.GDI32 ref: 0024AC8E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Window$Long$AttributesDeleteLayeredObject
String ID:
API String ID: 3455228723-0
Opcode ID: 6427368849981803eae64fc7adcbd5b39063b667b115e7b77b08a08f35b04b52
Instruction ID: 07859ca3978e3b59d2b87c24cc68ff341a228270a087a73dd413114692ff47ed
Opcode Fuzzy Hash: 6427368849981803eae64fc7adcbd5b39063b667b115e7b77b08a08f35b04b52
Instruction Fuzzy Hash: 32F0C4B1408B019FC700BF78E68921EBBF0FB85311F008A2DE4958B265D7B59459CB87

Function 0020CBDB Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 0020C567
malloc.MSVCRT ref: 0020CC01
malloc.MSVCRT ref: 0020CC17

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

Strings

ERROR: archive structure corrupted (bad string), xrefs: 0020CC26
%s, xrefs: 0020CC46

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$Charfreelongjmp
String ID: %s$ERROR: archive structure corrupted (bad string)
API String ID: 706110111-1936029760
Opcode ID: 51d8d8ec812b84132368a5e46ef953cf94c34a4383f5f7b268ff3b82592548d4
Instruction ID: e6c653bf4fcf1dac8cfddb5d9d83a26f1a5e66be7d029e6fdc23755a911a41ba
Opcode Fuzzy Hash: 51d8d8ec812b84132368a5e46ef953cf94c34a4383f5f7b268ff3b82592548d4
Instruction Fuzzy Hash: C9F03AB48287168BC721AF24C44122EBAE1BF45340F66C42DE8C867346DB74D8509F83

Function 00211239 Relevance: 6.0, APIs: 4, Instructions: 27threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00000010,00000010,00000004,0035BD18), ref: 0021124B
SetThreadAffinityMask.KERNEL32(00000000,?), ref: 00211263
SetThreadPriority.KERNEL32(0035BD14,00000000,?,?,0023C461,0023C74F,00000003,00000010), ref: 00211276
ResumeThread.KERNEL32(0035BD14,?,?,0023C461,0023C74F,00000003,00000010), ref: 0021127E

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Thread$AffinityCreateMaskPriorityResume
String ID:
API String ID: 3930227737-0
Opcode ID: e2cd92fec488b47265d3b93c8f2f6d81a7fbc2b396c5dffe3cb864e00859a2c4
Instruction ID: 6554aa6294f7b6293ba4903aa87170cc8dac006cce5b0f730af684130f6be2f2
Opcode Fuzzy Hash: e2cd92fec488b47265d3b93c8f2f6d81a7fbc2b396c5dffe3cb864e00859a2c4
Instruction Fuzzy Hash: 5EF0F8B5215302EFEB159FA0DC08B6ABBE9BF59302F00882DF691C11A0DBB1C860DB14

Function 0020C1B3 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 0020BF0F
memchr.MSVCRT ref: 0020C023
malloc.MSVCRT ref: 0020C1CC
malloc.MSVCRT ref: 0020C1E2

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

Strings

ERROR: archive structure corrupted (bad string), xrefs: 0020C1F1
%s, xrefs: 0020C1A2

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$Charfreelongjmpmemchr
String ID: %s$ERROR: archive structure corrupted (bad string)
API String ID: 2346886604-1936029760
Opcode ID: de4d611d226597265bd38ee71c14afe2d50e959a434aaa4f93ddf9e8cf10fa07
Instruction ID: d411c1c6c1754035267f7f000bb7afc32b8d2a2809a5c27681cdb9c5bdbbec80
Opcode Fuzzy Hash: de4d611d226597265bd38ee71c14afe2d50e959a434aaa4f93ddf9e8cf10fa07
Instruction Fuzzy Hash: 44F0F8B052C7169BC321BF25C44122EB6E0BF05B40F92C82CE5C8A7282DB74C8509B97

Function 0020CA84 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 0020C567
malloc.MSVCRT ref: 0020CA9D
malloc.MSVCRT ref: 0020CAB3

Part of subcall function 001EE7F0: malloc.MSVCRT ref: 001EE800
Part of subcall function 001EE7F0: CharToOemW.USER32 ref: 001EE822
Part of subcall function 001EE7F0: free.MSVCRT ref: 001EE82E

Strings

ERROR: archive structure corrupted (bad string), xrefs: 0020CAC2
%s, xrefs: 0020CAE2

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: malloc$Charfreelongjmp
String ID: %s$ERROR: archive structure corrupted (bad string)
API String ID: 706110111-1936029760
Opcode ID: 72d83252aa141f99275eb754e26c58d7d50ef0728c1d6d1ecb7658c423c74404
Instruction ID: 81dfa4fa9d3bf652eb5fbbb0aa1f55608b8e92846991843f2a19436cf0ed155f
Opcode Fuzzy Hash: 72d83252aa141f99275eb754e26c58d7d50ef0728c1d6d1ecb7658c423c74404
Instruction Fuzzy Hash: 30F030F442CB129BC721BF24840121EFAE0AF41740F52891DE8C86B342CB74DC509F87

Function 001EF161 Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 001EF17B
GetThreadPriority.KERNEL32 ref: 001EF180
GetCurrentThread.KERNEL32 ref: 001EF18B
SetThreadPriority.KERNEL32 ref: 001EF198

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Thread$CurrentPriority
String ID:
API String ID: 1343868529-0
Opcode ID: 8f9056632ab55460ae1907c140841d29cbb4bef297ff313935ddabdf73af0d15
Instruction ID: 0ae8439004ee8ef3eb80e29c5bd904911397de5dc60a0dbf628e72e7aa8b3646
Opcode Fuzzy Hash: 8f9056632ab55460ae1907c140841d29cbb4bef297ff313935ddabdf73af0d15
Instruction Fuzzy Hash: B3E01AF1D157148BCF107F7CAD4928A7BA4BB05221F020A3AE89597251E670A8498B92

Function 001DC560 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 498COMMON

Download Yara Rule

Strings

N2, xrefs: 0032F4E0, 0032F50A, 0032F534, 0032F55E
N2d6;, xrefs: 0032F57E, 0032F5AD

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: N2$N2d6;
API String ID: 0-892837438
Opcode ID: 2941d3da19da98c8e415e8972f075a945efb93331106d871071bd98d6267c11d
Instruction ID: e4c9e24b9ec0423e37089729863c8e6dc117316913a082de948dab57aafcb195
Opcode Fuzzy Hash: 2941d3da19da98c8e415e8972f075a945efb93331106d871071bd98d6267c11d
Instruction Fuzzy Hash: 30220F74608352CFCB18DF28C58066ABBF1FF88700F11892EE9998B365E775D855CB82

Function 002221C0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 385COMMON

Download Yara Rule

APIs

Part of subcall function 00210FF1: malloc.MSVCRT ref: 00210FF5

_CIexp.MSVCRT(00000029,00000004,?,?,000001A6,?), ref: 002225ED

Strings

MIDI, xrefs: 002226DA, 002226DD
L, xrefs: 0022262D

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Iexpmalloc
String ID: L$MIDI
API String ID: 316122613-1882826730
Opcode ID: 4f2414f9516fdcf4836c799665d6ea31f2e115b98330c9f5911923c073da9a04
Instruction ID: 44ac1dccf170ebfb62e67bcccf4d82e3f13a90a04c768a22aa9ea95f32758867
Opcode Fuzzy Hash: 4f2414f9516fdcf4836c799665d6ea31f2e115b98330c9f5911923c073da9a04
Instruction Fuzzy Hash: D302BEB1914261EFCB19CFA4E494AB9BBF4BF08300F0941AEE8496B362D735DA54CF50

Function 0025C830 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0025CA9D
Unknown pseudo relocation bit size %d., xrefs: 0025C93C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: a110f6bec4508fc87c0783796f3d9ce3fd359e4e475c423c228efc1b2078048c
Instruction ID: 70fcc99f68625edd6388d1f7671c4bbca88899d905c378cc4c91cdaa376eb85a
Opcode Fuzzy Hash: a110f6bec4508fc87c0783796f3d9ce3fd359e4e475c423c228efc1b2078048c
Instruction Fuzzy Hash: C551B4769203058FCB11CF68D88069EB7B5FB85319F35852ADD84AB316E330E919CB98

Function 0024E527 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69threadCOMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32 ref: 0024E333
SetWindowPos.USER32 ref: 0024E375
GetWindowLongW.USER32 ref: 0024E3A1
SetWindowLongW.USER32 ref: 0024E3DB
SetThreadExecutionState.KERNEL32 ref: 0024E4A7
SystemParametersInfoW.USER32 ref: 0024E4F9
SystemParametersInfoW.USER32 ref: 0024E51D
SetThreadExecutionState.KERNEL32 ref: 0024E88C

Part of subcall function 00249D60: ChangeDisplaySettingsExW.USER32 ref: 00249D98

GetWindowLongW.USER32 ref: 0024E5E0
SetWindowLongW.USER32 ref: 0024E621
SetWindowPos.USER32 ref: 0024E6E5

Strings

(, xrefs: 0024E2D8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Window$Long$Info$ExecutionParametersStateSystemThread$ChangeDisplayMonitorSettings
String ID: (
API String ID: 628194763-3887548279
Opcode ID: e859597548f303d03dbba318134e9136bc067c7a69b9ac2194959bda1821bdbc
Instruction ID: f5eb09d5484a7743c0b72119e51befac544f6cc966489f38a4fc15288a612d3c
Opcode Fuzzy Hash: e859597548f303d03dbba318134e9136bc067c7a69b9ac2194959bda1821bdbc
Instruction Fuzzy Hash: 2631FF75919B018FC748EF28D58421ABBF4FF88720F42896DE8898B315E770D894CF82

Function 002767F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0027689C

Strings

%p not found?!?!, xrefs: 00276891

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: fprintf
String ID: %p not found?!?!
API String ID: 383729395-11085004
Opcode ID: c8341e5852dba081ee2bb50deba1e1a4c139d834e691df946392f80500342a01
Instruction ID: a1d391adc432bb4457107eb288dd9192bb4e7c822d98e36278c64790dfa60147
Opcode Fuzzy Hash: c8341e5852dba081ee2bb50deba1e1a4c139d834e691df946392f80500342a01
Instruction Fuzzy Hash: 0A1165B1524B118FC720AF76848D66ABBE0AF04700F19C42DD88D8B212D770D8A8CB53

Function 00250009 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0025006B

Part of subcall function 0023F1D0: strcpy.MSVCRT ref: 0023F235

Strings

vkCreateWin32SurfaceKHR, xrefs: 0025001A
Win32: Failed to create Vulkan surface: %s, xrefs: 002500B0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: HandleModulestrcpy
String ID: Win32: Failed to create Vulkan surface: %s$vkCreateWin32SurfaceKHR
API String ID: 122033455-2197241564
Opcode ID: a396d04cc907c668330b7fa38c7ee1ff20ff4bd2f7d9ffab8908740af538c383
Instruction ID: a956820ba28c3c37e6594fddc5cc1eae38a3c3c7712557c0dd6c012885217707
Opcode Fuzzy Hash: a396d04cc907c668330b7fa38c7ee1ff20ff4bd2f7d9ffab8908740af538c383
Instruction Fuzzy Hash: 3311BFB59183008FD740AF69E58831ABBF0EF89344F00892DF8C8A7251D775A9498F96

Function 001C71D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 001C5100: CreateMutexW.KERNEL32(?,?,?,?,?,?,001C71ED), ref: 001C5136

Part of subcall function 001E6B10: CloseHandle.KERNEL32 ref: 001E6B21
Part of subcall function 001E6B10: CreateThread.KERNEL32 ref: 001E6B55

Part of subcall function 001E6AE0: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,001C7228), ref: 001E6AF8

WaitForSingleObject.KERNEL32 ref: 001C7238
ReleaseMutex.KERNEL32 ref: 001C724C

Strings

aA, xrefs: 001C7276

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CreateMutexObjectSingleWait$CloseHandleReleaseThread
String ID: aA
API String ID: 3302886564-2567749500
Opcode ID: 8e7b43f372419e653ec6cebcac326830b360fa503b37531d067f573911a17a79
Instruction ID: 03717ecfd28755ae2b4605ca999f3684b792cc91a4586f045c017d6b94f87735
Opcode Fuzzy Hash: 8e7b43f372419e653ec6cebcac326830b360fa503b37531d067f573911a17a79
Instruction Fuzzy Hash: A1112EB1509B04DFC300BF68E98459EBBE0ABA0350F81C91EE4C447251C778E4C4CB96

Function 001FB418 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 0020B680: CloseHandle.KERNEL32 ref: 0020B691

DeleteCriticalSection.KERNEL32 ref: 0032FE1C

Part of subcall function 00288490: free.MSVCRT ref: 002884A0
Part of subcall function 00288490: DeleteCriticalSection.KERNEL32 ref: 002884BA

Part of subcall function 00282C30: free.MSVCRT ref: 00282C51
Part of subcall function 00282C30: DeleteCriticalSection.KERNEL32 ref: 00282C7D
Part of subcall function 00282C30: free.MSVCRT ref: 00282C8F
Part of subcall function 00282C30: DeleteCriticalSection.KERNEL32 ref: 00282CB2
Part of subcall function 00282C30: free.MSVCRT ref: 00282CC4
Part of subcall function 00282C30: DeleteCriticalSection.KERNEL32 ref: 00282CE7
Part of subcall function 00282C30: free.MSVCRT ref: 00282CF6
Part of subcall function 00282C30: DeleteCriticalSection.KERNEL32 ref: 00282D13
Part of subcall function 00282C30: free.MSVCRT ref: 00282D22
Part of subcall function 00282C30: DeleteCriticalSection.KERNEL32 ref: 00282D3F

DeleteCriticalSection.KERNEL32(00000000), ref: 0032FDFA

Part of subcall function 00288510: free.MSVCRT ref: 00288520
Part of subcall function 00288510: DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,0032F7A3), ref: 0028853A

Strings

Pr;, xrefs: 0032FDC8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalDeleteSection$free$CloseHandle
String ID: Pr;
API String ID: 291953313-1073677810
Opcode ID: 2258fe61475b57e854126f16c4c81e7a02893adac2d44ebfe47b86a8cbc3773f
Instruction ID: 86a5c66a3123c73750422be1006cbd5bdcca3515f5ffceab8d8798f75352e38d
Opcode Fuzzy Hash: 2258fe61475b57e854126f16c4c81e7a02893adac2d44ebfe47b86a8cbc3773f
Instruction Fuzzy Hash: E30104790287458FC764FFB0C5856AEB7E8BF84341F810C3DA58683662EB749158CF22

Function 001ED1F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 001ED22A
FreeLibrary.KERNEL32 ref: 001ED25B

Strings

ClsMain, xrefs: 001ED213

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: ClsMain
API String ID: 3013587201-395663586
Opcode ID: d29157fd8c08c1fb6baba3f5bb747aabb5f069544de9900c8d5dfb4fcf122c78
Instruction ID: c31a3ef0b29280715249256709c81e53cea1ae357ab8c236a969433825cacaeb
Opcode Fuzzy Hash: d29157fd8c08c1fb6baba3f5bb747aabb5f069544de9900c8d5dfb4fcf122c78
Instruction Fuzzy Hash: F70114B5908611CFDB00AF7DFE8879ABBF4BB04315F068538D88487261E731E804CB5A

Function 001C23A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 001C23E6
CoTaskMemFree.OLE32 ref: 001C23F9

Strings

%ls, xrefs: 001C2414

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID: %ls
API String ID: 969438705-3246610740
Opcode ID: c1bfeffe4abddc0f28721261cb6c5fbce43567c97ff76b771942c8b77d2c392e
Instruction ID: 2fd11db68b99e62b33bab10b7fe40ac335e3892fce4c27e752a8729cbebff461
Opcode Fuzzy Hash: c1bfeffe4abddc0f28721261cb6c5fbce43567c97ff76b771942c8b77d2c392e
Instruction Fuzzy Hash: 2B015AB49083009FC341EF28D599A1ABBF4BB99344F408A2EE898C3311E739D9498F46

Function 00200BC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 001ED7A0: VirtualAlloc.KERNEL32 ref: 001ED817

exit.MSVCRT ref: 00200C2C

Strings

------------------------------------------------------------, xrefs: 00200C0D
Error: insufficient memory available%s, xrefs: 00200C15

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AllocVirtualexit
String ID: Error: insufficient memory available%s$------------------------------------------------------------
API String ID: 1690354023-2956387463
Opcode ID: 69ef18ce12177e30f40e81b69b2dbaae7da2e1bc2cd6ae8481c49af48ee3d3a4
Instruction ID: e8cbb9eb924f258bb34461d415fbb2c3e0df1d2bee58257148003819cffb3e30
Opcode Fuzzy Hash: 69ef18ce12177e30f40e81b69b2dbaae7da2e1bc2cd6ae8481c49af48ee3d3a4
Instruction Fuzzy Hash: 77F0F9F48097029FE700FF26D84935ABBE0FB45304F85C82DE48897255D7789599DF52

Function 00200B33 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 001ED7A0: VirtualAlloc.KERNEL32 ref: 001ED817

exit.MSVCRT ref: 00200BAC

Strings

------------------------------------------------------------, xrefs: 00200B8D
Error: insufficient memory available%s, xrefs: 00200B95

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: AllocVirtualexit
String ID: Error: insufficient memory available%s$------------------------------------------------------------
API String ID: 1690354023-2956387463
Opcode ID: f45e4b7728f4c4168f2c7e41790de16c35a5ef1b980c5d47101467a3aa5ff590
Instruction ID: f43249d3de3cdb995758829e5ee15279d728cba5d2ddaa874db02624174d3ffb
Opcode Fuzzy Hash: f45e4b7728f4c4168f2c7e41790de16c35a5ef1b980c5d47101467a3aa5ff590
Instruction Fuzzy Hash: 95F0F4B18197129FDB10AF22D88935ABBE0FB05348F418C1CE9D867292D774A459CF92

Function 0024CB59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27registryCOMMON

Download Yara Rule

APIs

RegisterClassExW.USER32 ref: 0024CB27

Part of subcall function 002470E0: GetLastError.KERNEL32 ref: 0024712B
Part of subcall function 002470E0: FormatMessageW.KERNEL32 ref: 00247163
Part of subcall function 002470E0: WideCharToMultiByte.KERNEL32 ref: 002471A7

LoadImageW.USER32 ref: 0024CB8F

Strings

Win32: Failed to register window class, xrefs: 0024CB3A

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ByteCharClassErrorFormatImageLastLoadMessageMultiRegisterWide
String ID: Win32: Failed to register window class
API String ID: 2904516539-2994954080
Opcode ID: b4644bc921cf514881bf3da824e5fde57055b1cf2778a56ae369259fb7610aa9
Instruction ID: b7deb36fc735c510c25c48b599d1438bab7f4637cf0683c2a105634d1b56520b
Opcode Fuzzy Hash: b4644bc921cf514881bf3da824e5fde57055b1cf2778a56ae369259fb7610aa9
Instruction Fuzzy Hash: 63F012B040D3018FE780AF28E54935BBBE0FB80348F10892CE4C95B244CBB995998B83

Function 00200BFB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 00200C2C

Strings

------------------------------------------------------------, xrefs: 00200C0D
Error: insufficient memory available%s, xrefs: 00200C15

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: exit
String ID: Error: insufficient memory available%s$------------------------------------------------------------
API String ID: 2483651598-2956387463
Opcode ID: ecdd6042e1588dbd8748794b8f8710bc537e1313cda1f49d7944366031de0436
Instruction ID: 7701efd8f488ebc8ba6b4dcbba3944039ea4b002cd821433d2bfe86c49ecc80c
Opcode Fuzzy Hash: ecdd6042e1588dbd8748794b8f8710bc537e1313cda1f49d7944366031de0436
Instruction Fuzzy Hash: 13E012B14197129FDB11AF25C80538ABBE0FF46305F82C81CE4C8A3205CB74B58ADB82

Function 001C502B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 001C504F

Strings

Error, xrefs: 001C5038
InstallerThread: swprintfInvalid path., xrefs: 001C5040

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Message
String ID: Error$InstallerThread: swprintfInvalid path.
API String ID: 2030045667-3505464976
Opcode ID: a27f43772b538f68d189aac1bd7f6616fbccaf0fdc89f094005540330a509443
Instruction ID: f47db89398117c5c1af081386c3fb97cc152db4f763586c1eecad39870a1dbf5
Opcode Fuzzy Hash: a27f43772b538f68d189aac1bd7f6616fbccaf0fdc89f094005540330a509443
Instruction Fuzzy Hash: D8E046B210C300CFE304AF64E50832BBBE0FB40312F02C82ED6998B200C3BA9008DB96

Function 001C62F9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 001C631F

Strings

Error, xrefs: 001C6308
InstallCallback: swprintfInvalid path., xrefs: 001C6310

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Message
String ID: Error$InstallCallback: swprintfInvalid path.
API String ID: 2030045667-762969645
Opcode ID: 6605f90963ed52005f9cce4497b362a9671aef7971829cc9d0ca74b73b602935
Instruction ID: 3b7f7701b12e9b25fec39c393966a1a585454d35274538bec7949b4da6cff0df
Opcode Fuzzy Hash: 6605f90963ed52005f9cce4497b362a9671aef7971829cc9d0ca74b73b602935
Instruction Fuzzy Hash: 42D017B65083008ED300AF54E90835ABBA0EB80329F01C819D5D817214C3B540588B42

Function 001C53C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 12windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 001C53EF

Strings

ApplyCrack: swprintfInvalid path., xrefs: 001C53E0
Error, xrefs: 001C53D8

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Message
String ID: ApplyCrack: swprintfInvalid path.$Error
API String ID: 2030045667-2879015136
Opcode ID: c0c50e309d349cf027e34fb3a1a32925b66b2045e334118c15fdea5c8e4eab1d
Instruction ID: 053afbdc3d84f6f8797fb43bd357ccf6e0cc455b8ceb8bc3e5661f1c87011c04
Opcode Fuzzy Hash: c0c50e309d349cf027e34fb3a1a32925b66b2045e334118c15fdea5c8e4eab1d
Instruction Fuzzy Hash: A5D05E714093009FD340AF14F50835ABBE0BB41305F41CD0DD09817204C3B64048CF47

Function 001C5067 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 001C509B

Strings

regedit, xrefs: 001C5084
open, xrefs: 001C508C

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: ExecuteShell
String ID: open$regedit
API String ID: 587946157-2848943099
Opcode ID: 21cc656678175cb9d0a5f3b72862665b926e9ff1a062e149b308d3764b3ee2d1
Instruction ID: 525819ad4b9f1f1a43e3e8972d5aeef80420e1ff1273f7c7736382d35c775b8a
Opcode Fuzzy Hash: 21cc656678175cb9d0a5f3b72862665b926e9ff1a062e149b308d3764b3ee2d1
Instruction Fuzzy Hash: B8D06CB540C7029FD301AF24C91830BBBF0BB82706F02C90DE5991B285C7B899489F9B

Function 001C5294 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 001C52B7

Strings

Install: swprintfInvalid path., xrefs: 001C52A8
Error, xrefs: 001C52A0

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: Message
String ID: Error$Install: swprintfInvalid path.
API String ID: 2030045667-3780951377
Opcode ID: 53b2588e350661daa23667fd37b614c9df7a8efd4753d4b2fb54b7f0370d1558
Instruction ID: 95c9edf8bd500bf3aeb5447b972846e792625a651ad3e3fc861ed2bd3107bcb6
Opcode Fuzzy Hash: 53b2588e350661daa23667fd37b614c9df7a8efd4753d4b2fb54b7f0370d1558
Instruction Fuzzy Hash: B1D092B54097059BD708AF54D94821ABBE0BB41345F82CC0DE9991B205D3B694999F42

Function 0021C33A Relevance: 5.2, APIs: 4, Instructions: 210COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,00000000,000001B8,0022538C,?,0022538C,?,?,?,002217FF,00000000,00000000,000002B0,?), ref: 0021C3B0
memmove.MSVCRT(?,?,?,00000000,000001B8,0022538C,?,0022538C,?,?,?,002217FF,00000000,00000000,000002B0,?), ref: 0021C3D4
memmove.MSVCRT(?,?,?,?,?,?,002217FF,00000000,00000000,000002B0,?,00000000), ref: 0021C3EB
memcpy.MSVCRT(?,00000000,00000000,00000000,000001B8,0022538C,?,0022538C), ref: 0021C4DA

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: memmove$memcpy
String ID:
API String ID: 3033661859-0
Opcode ID: 58841b17599f082980e85bf957d52859da1ce0780f058f333de7f5cfe29eadd6
Instruction ID: 1efb62b1aba4e0f5c3b5eb5cd49257c3ca7f137ecac8eac6741c2315c01f78ab
Opcode Fuzzy Hash: 58841b17599f082980e85bf957d52859da1ce0780f058f333de7f5cfe29eadd6
Instruction Fuzzy Hash: 55913874A10A06DFCB24CF68C494AAAB7F1FF08314F208A6DD4A6A7691D730F995CF50

Function 00214904 Relevance: 5.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000088,?,00000000,00000000,?,?,002155D7,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000), ref: 0021494C
memcpy.MSVCRT(00000000,?,?,?,?,002155D7,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0021496C
memmove.MSVCRT(?,?,?,?,?,002155D7,00000000,00000000,00000000,00000000,?,00000000,?), ref: 0021498E
LeaveCriticalSection.KERNEL32(00000088), ref: 00214998

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpymemmove
String ID:
API String ID: 3567025700-0
Opcode ID: fb1f2c65e5fa79c155f9b77513e27449955b9917a09c073506170fb9515ec88a
Instruction ID: 2091f7aac749f03318e3ba3e2306fd203fe4f5582637d88ba7deefa2ed26f8e0
Opcode Fuzzy Hash: fb1f2c65e5fa79c155f9b77513e27449955b9917a09c073506170fb9515ec88a
Instruction Fuzzy Hash: EE415231524706DFCB24EF79D84499BB3E5BF64325F148A2EE49A83640D770E8A0CF15

Function 00275300 Relevance: 5.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0027533E
LeaveCriticalSection.KERNEL32 ref: 00275368

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 72dcd5734cfc743b77a60cb2cb0ff259c5f6d2a4c1adf19392ee46d81fdcb4ce
Instruction ID: 9a081d3e965b1aa012c7ba3d1d852ca13267ae14e3b10f51235438f9718bec69
Opcode Fuzzy Hash: 72dcd5734cfc743b77a60cb2cb0ff259c5f6d2a4c1adf19392ee46d81fdcb4ce
Instruction Fuzzy Hash: D83194B16147118FDB10EF29E8C465AB7E0EF84354F5482A9EC198F259E3B0D855CB92

Function 00274F70 Relevance: 5.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,002754C5), ref: 00274F90
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,002754C5), ref: 00274FAC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,002754C5), ref: 00274FE9
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,002754C5), ref: 00274FF5

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c9ae9c15f03b7275aa2b50e78a0674d73586282b83ff477b8400f95bc96d5bd6
Instruction ID: 349cdd4eeb76e69fe7d78761cac98e7a450de26b591d0de49c36fa5137c5ca28
Opcode Fuzzy Hash: c9ae9c15f03b7275aa2b50e78a0674d73586282b83ff477b8400f95bc96d5bd6
Instruction Fuzzy Hash: 331106B5A093118FC300EF39E98551AFBF0EF89751F02492EE98897311D231E858CB93

Function 00210AA4 Relevance: 5.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

_wremove.MSVCRT ref: 002105FF
free.MSVCRT ref: 00210624
free.MSVCRT ref: 00210632
free.MSVCRT ref: 00210640
free.MSVCRT ref: 00210685

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free$_wremove
String ID:
API String ID: 3704146391-0
Opcode ID: 968a2ca1267a1335e1e34d1faf5fd38b8429e5626e73923ef765c35faa87e370
Instruction ID: 77c180fb34a16ee34a2532fcbc393a8502ccce534bd458255c469ed574a490ad
Opcode Fuzzy Hash: 968a2ca1267a1335e1e34d1faf5fd38b8429e5626e73923ef765c35faa87e370
Instruction Fuzzy Hash: F0110370524B418AD730EF74C185BAAB7E4AF50700F514C1CA4EA8B692D774F8E1CB42

Function 002402B0 Relevance: 5.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 002402C5
free.MSVCRT ref: 002402D0
free.MSVCRT ref: 002402DB
free.MSVCRT ref: 002402E6

Memory Dump Source

Source File: 00000004.00000002.1463576034.00000000001C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000004.00000002.1463550952.00000000001C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463703532.000000000033B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000033D000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463725765.000000000035C000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463767689.000000000035D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463787977.000000000035F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463806968.0000000000360000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000415000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.000000000043F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000444000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000449000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463872673.0000000000452000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000453000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.0000000000458000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1463989536.00000000004B2000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1464107027.00000000004EB000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1c0000_setup.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6a8f2e749d9ccbe2553dda811cc2d74b2231cbf7fbb19294df4c9f64758da771
Instruction ID: eeb0a867aafccdc3d68ed89cd513c69f0754dabc35c5c5b02f2a75497695c163
Opcode Fuzzy Hash: 6a8f2e749d9ccbe2553dda811cc2d74b2231cbf7fbb19294df4c9f64758da771
Instruction Fuzzy Hash: 76F0DAB15146009BCB10FF38D4C665ABBE4AF45710F458A9CEC859F34AD334EA61CF91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PQwHxAiBGt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Rhadamanthys

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Temp\422648\Ai.com

C:\Users\user\AppData\Local\Temp\422648\B

C:\Users\user\AppData\Local\Temp\422648\RegAsm.exe

C:\Users\user\AppData\Local\Temp\7576.tmp

C:\Users\user\AppData\Local\Temp\Atm

C:\Users\user\AppData\Local\Temp\Bahamas

C:\Users\user\AppData\Local\Temp\Beef

C:\Users\user\AppData\Local\Temp\Biology

C:\Users\user\AppData\Local\Temp\Busy

Windows Analysis Report
PQwHxAiBGt.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre