Create Interactive Tour

Analysis Report acrotray.exe

Overview

General Information

Sample Name:	acrotray.exe
Analysis ID:	416537
MD5:	0efd56703e827aa5a659757894edba29
SHA1:	961fc525a5f20787db5fd142142731f20b0aab89
SHA256:	ffec24790b71877c472fd59cb117935e894ea1de0ea1d9811a3d551e8339ddc5
Infos:
Most interesting Screenshot:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains strange resources

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

acrotray.exe (PID: 7056 cmdline: 'C:\Users\user\Desktop\acrotray.exe' MD5: 0EFD56703E827AA5A659757894EDBA29)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: acrotray.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Source: acrotray.exe

Static PE information: certificate valid

Source: acrotray.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: AcroTray.pdb source: acrotray.exe

Source: acrotray.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: acrotray.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: acrotray.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: acrotray.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: acrotray.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: acrotray.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: acrotray.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: acrotray.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: acrotray.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: acrotray.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: acrotray.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: acrotray.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: acrotray.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: acrotray.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: acrotray.exe	String found in binary or memory: http://ocsp.digicert.com0I
Source: acrotray.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: acrotray.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: acrotray.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: acrotray.exe	String found in binary or memory: https://ims-na1-stg1.adobelogin.com
Source: acrotray.exe	String found in binary or memory: https://ims-prod06.adobelogin.com
Source: acrotray.exe	String found in binary or memory: https://lcs-cops-dev.adobe.io
Source: acrotray.exe	String found in binary or memory: https://lcs-cops-dev.adobe.iohttps://lcs-cops-stage.adobe.iohttps://lcs-cops.adobe.iohttps://lcs-rob
Source: acrotray.exe	String found in binary or memory: https://lcs-cops-stage.adobe.io
Source: acrotray.exe	String found in binary or memory: https://lcs-cops.adobe.io
Source: acrotray.exe	String found in binary or memory: https://lcs-robs-dev.adobe.io
Source: acrotray.exe	String found in binary or memory: https://lcs-robs-stage.adobe.io
Source: acrotray.exe	String found in binary or memory: https://lcs-robs.adobe.io
Source: acrotray.exe	String found in binary or memory: https://lcs-ulecs-dev.adobe.io
Source: acrotray.exe	String found in binary or memory: https://lcs-ulecs-stage.adobe.io
Source: acrotray.exe	String found in binary or memory: https://lcs-ulecs.adobe.io
Source: acrotray.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_015FE3FF	0_2_015FE3FF
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_015E3B85	0_2_015E3B85
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_015F2D90	0_2_015F2D90
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_013205D0	0_2_013205D0
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_0160DF51	0_2_0160DF51
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_0160F783	0_2_0160F783
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_0160F663	0_2_0160F663
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_015E9EBF	0_2_015E9EBF

Source: acrotray.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: acrotray.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: acrotray.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Source: classification engine

Classification label: clean3.winEXE@1/0@0/0

Source: acrotray.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\acrotray.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: acrotray.exe

Static PE information: certificate valid

Source: acrotray.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: acrotray.exe

Static file information: File size 5237432 > 1048576

Source: acrotray.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x35d600
Source: acrotray.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x153a00

Source: acrotray.exe	Static PE information: More than 200 imports for KERNEL32.dll
Source: acrotray.exe	Static PE information: More than 200 imports for USER32.dll

Source: acrotray.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: acrotray.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: acrotray.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: acrotray.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: acrotray.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: acrotray.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: acrotray.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: acrotray.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: AcroTray.pdb source: acrotray.exe

Source: acrotray.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: acrotray.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: acrotray.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: acrotray.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: acrotray.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\acrotray.exe

Code function: 0_2_015CD6DA push ecx; ret

0_2_015CD6ED

Source: C:\Users\user\Desktop\acrotray.exe

API coverage: 8.7 %

Source: C:\Users\user\Desktop\acrotray.exe

Code function: 0_2_015E60A1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_015E60A1

Source: C:\Users\user\Desktop\acrotray.exe

Code function: 0_2_014715D0 OutputDebugStringA,GetLastError,

0_2_014715D0

Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_015FD2FF mov eax, dword ptr fs:[00000030h]	0_2_015FD2FF
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_01606564 mov eax, dword ptr fs:[00000030h]	0_2_01606564
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_016065A8 mov eax, dword ptr fs:[00000030h]	0_2_016065A8

Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_015E60A1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_015E60A1
Source: C:\Users\user\Desktop\acrotray.exe	Code function: 0_2_015CCD44 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_015CCD44

Source: acrotray.exe, 00000000.00000002.912298828.0000000005A20000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: acrotray.exe, 00000000.00000002.912298828.0000000005A20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: acrotray.exe, 00000000.00000002.912298828.0000000005A20000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: acrotray.exe, 00000000.00000002.912298828.0000000005A20000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\acrotray.exe	Code function: EnumSystemLocalesW,	0_2_0160194D
Source: C:\Users\user\Desktop\acrotray.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_0160B3FF
Source: C:\Users\user\Desktop\acrotray.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0160BBA6
Source: C:\Users\user\Desktop\acrotray.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0160BD7B
Source: C:\Users\user\Desktop\acrotray.exe	Code function: GetLocaleInfoW,	0_2_01601F06
Source: C:\Users\user\Desktop\acrotray.exe	Code function: EnumSystemLocalesW,	0_2_0160B78D
Source: C:\Users\user\Desktop\acrotray.exe	Code function: EnumSystemLocalesW,	0_2_0160B6F2
Source: C:\Users\user\Desktop\acrotray.exe	Code function: EnumSystemLocalesW,	0_2_0160B6A7

Source: C:\Users\user\Desktop\acrotray.exe

Code function: 0_2_015E13B2 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_015E13B2

Source: C:\Users\user\Desktop\acrotray.exe

Code function: 0_2_01606102 _free,GetTimeZoneInformation,_free,

0_2_01606102

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Process Injection1	OS Credential Dumping	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information1	LSASS Memory	Security Software Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery12	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
acrotray.exe	0%	Virustotal	Browse
acrotray.exe	0%	Metadefender	Browse
acrotray.exe	0%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ims-prod06.adobelogin.com	acrotray.exe	false		high
https://ims-na1-stg1.adobelogin.com	acrotray.exe	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	416537
Start date:	18.05.2021
Start time:	17:24:01
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	acrotray.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Simulations

Behavior and APIs

Time	Type	Description
17:24:48	API Interceptor	1x Sleep call for process: acrotray.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.543918593540032
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	acrotray.exe
File size:	5237432
MD5:	0efd56703e827aa5a659757894edba29
SHA1:	961fc525a5f20787db5fd142142731f20b0aab89
SHA256:	ffec24790b71877c472fd59cb117935e894ea1de0ea1d9811a3d551e8339ddc5
SHA512:	9fc352d50d696c06d6152d234602bdb258c38c09133c51dfbcbd2cc96a1b7fad24be224490aa04939aabcb0f4714a6d8056c43bc1b7b3f0e2839872877192604
SSDEEP:	98304:7p1b6LZnQMQqwF6ozbwInnsAY25FzvMEL5Up8oOvuwg8KX:7Pb6LZn9gwE1jMfp8oOvuw8X
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y.Z.y.Z.y.Z...[.y.Z...[.y.Z...[.y.Z...[.y.Z...[.x.Z.%.Z.y.Z...[.y.Z...[.y.Z...[.y.Z.y.Z.z.ZW..[oy.ZW..Z.y.Z.y{Z.y.ZW..[.y.

File Icon


Icon Hash:	52784ccccc6c7212

Static PE Info

General
Entrypoint:	0x6bd6d0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x608804EF [Tue Apr 27 12:34:55 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	fb9ac20eb92c6f6df3332aefc61ccf20

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	12/19/2020 1:00:00 AM 12/22/2022 12:59:59 AM
Subject Chain	CN=Adobe Inc., OU=Acrobat DC, O=Adobe Inc., L=San Jose, S=ca, C=US, SERIALNUMBER=2748129, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	1ED822CC08BA08413C4A60023E0D590C
Thumbprint SHA-1:	5DA6AD39FC524D0D2BEC6741DFDBF67DF5AF3ECA
Thumbprint SHA-256:	B184F0677143FFA39C7DABF083FB0B613015CEA696DFDEBA11D5CAFD4CF8B8D8
Serial:	011F39A2261A993DD15176DA6FE4FBEA

Entrypoint Preview

Instruction
call 00007F7E18846C7Bh
jmp 00007F7E1884668Dh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F7E188452DFh
jmp 00007F7E188467F0h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007F7E188452CEh
jmp 00007F7E188467DFh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [008B4BE4h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [008B4BE4h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [008B4BE4h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4ae92c	0x1b8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4c7000	0x2630	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4fce00	0x1cb8	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4ca000	0x3bd34	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x45d310	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x45d40c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x45d368	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x35f000	0xb84	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x35d4ca	0x35d600	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x35f000	0x15398c	0x153a00	False	0.296027471706	data	5.53628818198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4b3000	0x13324	0xd400	False	0.207068101415	data	5.08019243413	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x4c7000	0x2630	0x2800	False	0.2740234375	data	3.3791928479	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4ca000	0x3bd34	0x3be00	False	0.482752152923	data	6.5955535729	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x4c7908	0x2e8	data	English	United States
RT_ICON	0x4c7bf0	0x130	data	English	United States
RT_ICON	0x4c7d20	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x4c7e78	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x4c7fb8	0x2e8	data	English	United States
RT_ICON	0x4c82b8	0x2e8	data	English	United States
RT_ICON	0x4c85b8	0x2e8	data	English	United States
RT_ICON	0x4c88b8	0x2e8	data	English	United States
RT_MENU	0x4c7540	0xec	data	English	United States
RT_DIALOG	0x4c7630	0x2d6	data	English	United States
RT_STRING	0x4c8fa8	0x32	data	English	United States
RT_STRING	0x4c8fe0	0x32	data	English	United States
RT_STRING	0x4c9018	0xb6	data	English	United States
RT_STRING	0x4c90d0	0xf6	data	English	United States
RT_STRING	0x4c91c8	0x112	data	English	United States
RT_STRING	0x4c92e0	0x50	data	English	United States
RT_GROUP_ICON	0x4c7fa0	0x14	data	English	United States
RT_GROUP_ICON	0x4c7e48	0x30	data	English	United States
RT_GROUP_ICON	0x4c82a0	0x14	data	English	United States
RT_GROUP_ICON	0x4c85a0	0x14	data	English	United States
RT_GROUP_ICON	0x4c88a0	0x14	data	English	United States
RT_GROUP_ICON	0x4c8ba0	0x14	data	English	United States
RT_VERSION	0x4c8bb8	0x3ec	data	English	United States
RT_MANIFEST	0x4c9330	0x2fa	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	English	United States

Imports

DLL	Import
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA
WINHTTP.dll	WinHttpOpenRequest, WinHttpAddRequestHeaders, WinHttpSendRequest, WinHttpSetTimeouts, WinHttpReceiveResponse, WinHttpCrackUrl, WinHttpOpen, WinHttpCloseHandle, WinHttpConnect, WinHttpReadData, WinHttpQueryDataAvailable, WinHttpSetCredentials, WinHttpSetOption, WinHttpQueryHeaders, WinHttpGetProxyForUrl, WinHttpGetIEProxyConfigForCurrentUser, WinHttpQueryAuthSchemes
WININET.dll	InternetSetOptionW
KERNEL32.dll	GetFileInformationByHandle, GetFileType, PeekNamedPipe, GetTimeZoneInformation, HeapQueryInformation, GetCommandLineA, GetCommandLineW, VirtualAlloc, VirtualQuery, SetStdHandle, ExitProcess, GlobalFree, GlobalAlloc, GetShortPathNameW, GetFileAttributesA, GetUserDefaultLCID, FindResourceW, SizeofResource, LockResource, LoadResource, LoadLibraryA, GetSystemInfo, GetModuleFileNameA, HeapSize, HeapReAlloc, MulDiv, IsBadWritePtr, DecodePointer, FileTimeToSystemTime, LoadLibraryW, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameW, GetDriveTypeW, MoveFileExW, FreeLibraryAndExitThread, ExitThread, CreateThread, InterlockedFlushSList, InterlockedPushEntrySList, RtlUnwind, GetProcessAffinityMask, OutputDebugStringW, FreeLibrary, LCMapStringW, GetCPInfo, GetStringTypeW, GetNativeSystemInfo, GetVersionExW, GetComputerNameExW, GetWindowsDirectoryW, GetSystemDirectoryW, CreateProcessW, GetCurrentProcess, DeviceIoControl, SetLastError, RaiseException, OutputDebugStringA, GetTimeFormatW, GetDateFormatW, GetLocalTime, SetFileAttributesW, GetFileAttributesW, FindClose, DeleteFileW, ReadDirectoryChangesW, WaitForMultipleObjects, CreateEventW, ResetEvent, SetEvent, GetOverlappedResult, FindNextFileW, FindFirstFileW, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, GetCurrentProcessId, GetCurrentThreadId, CreateMutexW, WaitForSingleObject, ReleaseMutex, GetProcessHeap, HeapFree, HeapAlloc, FormatMessageW, LocalFree, lstrcpyA, WideCharToMultiByte, GetTempPathW, GetFileSizeEx, MultiByteToWideChar, GetCurrentDirectoryW, SetCurrentDirectoryW, lstrlenW, GetTickCount, Sleep, OpenMutexW, SetNamedPipeHandleState, GetLastError, CloseHandle, WriteFile, ReadFile, GetVolumeInformationW, CreateFileW, GetStdHandle, IsValidLocale, EnumSystemLocalesW, GetConsoleCP, GetConsoleMode, SetFilePointerEx, ReadConsoleW, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, SetEnvironmentVariableW, WriteConsoleW, CreateTimerQueue, SignalObjectAndWait, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, UnregisterWaitEx, QueryDepthSList, InterlockedPopEntrySList, ReleaseSemaphore, VirtualFree, GetModuleHandleExW, QueueUserWorkItem, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, FreeEnvironmentStringsW, GetThreadTimes, UnregisterWait, RegisterWaitForSingleObject, SetThreadAffinityMask, GlobalSize, GlobalLock, GlobalUnlock, CopyFileW, FlushFileBuffers, GetFileSize, GetFullPathNameW, LockFile, SetEndOfFile, SetFilePointer, UnlockFile, DuplicateHandle, LoadLibraryExW, lstrcmpiW, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GlobalReAlloc, GlobalHandle, LocalAlloc, LocalReAlloc, CompareStringW, lstrcmpA, GlobalGetAtomNameW, FileTimeToLocalFileTime, GetFileAttributesExW, GetFileTime, SystemTimeToTzSpecificLocalTime, SetThreadPriority, ResumeThread, GlobalAddAtomW, GlobalFlags, lstrcmpW, EncodePointer, GlobalDeleteAtom, GlobalFindAtomW, GetCurrentThread, GetLocaleInfoW, GetUserDefaultUILanguage, VirtualProtect, lstrcpyW, FindResourceExW, VerSetConditionMask, VerifyVersionInfoW, GetProfileIntW, SearchPathW, GetTempFileNameW, WaitForSingleObjectEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, TryEnterCriticalSection, QueryPerformanceFrequency, SwitchToThread
USER32.dll	GetWindow, RealChildWindowFromPoint, SetFocus, SetScrollPos, GetScrollPos, GetDlgItem, CheckDlgButton, IsDialogMessageW, DrawTextExW, GrayStringW, TabbedTextOutW, GetWindowDC, FillRect, EnableMenuItem, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, SetMenuItemInfoW, LoadBitmapW, GetMessagePos, GetMessageTime, CallWindowProcW, RegisterClassW, GetClassInfoW, IsMenu, IsChild, GetWindowPlacement, SetWindowPlacement, BeginDeferWindowPos, DeferWindowPos, EndDeferWindowPos, IsIconic, GetCapture, GetMenu, SetMenu, UpdateWindow, SetActiveWindow, RedrawWindow, ScrollWindow, SetScrollRange, GetScrollRange, ShowScrollBar, SetPropW, GetPropW, RemovePropW, MapWindowPoints, CopyRect, EqualRect, GetClassLongW, GetTopWindow, LoadIconW, SetScrollInfo, GetScrollInfo, WinHelpW, MonitorFromWindow, InflateRect, IntersectRect, GetMenuItemInfoW, CopyImage, SendDlgItemMessageA, SetRectEmpty, OffsetRect, CreateDialogIndirectParamW, EndDialog, GetNextDlgTabItem, MapDialogRect, ShowOwnedPopups, SetCursor, DeleteMenu, InvalidateRect, TrackMouseEvent, GetNextDlgGroupItem, SetCapture, ReleaseCapture, WindowFromPoint, DrawFocusRect, IsRectEmpty, DrawIconEx, GetIconInfo, SetWindowTextW, EnableScrollBar, HideCaret, InvertRect, NotifyWinEvent, CreatePopupMenu, GetMenuDefaultItem, MapVirtualKeyW, GetKeyNameTextW, SetLayeredWindowAttributes, EnumDisplayMonitors, OpenClipboard, CloseClipboard, AppendMenuW, GetDlgCtrlID, DrawStateW, SetWindowRgn, SetParent, DrawEdge, DrawFrameControl, IsZoomed, GetSystemMenu, BringWindowToTop, SetCursorPos, CopyIcon, FrameRect, DrawIcon, UnionRect, UpdateLayeredWindow, MonitorFromPoint, LoadAcceleratorsW, TranslateAcceleratorW, InsertMenuItemW, UnpackDDElParam, ReuseDDElParam, GetComboBoxInfo, PostThreadMessageW, WaitMessage, GetKeyboardLayout, IsCharLowerW, MapVirtualKeyExW, ToUnicodeEx, GetKeyboardState, CreateAcceleratorTableW, DestroyAcceleratorTable, CopyAcceleratorTableW, LockWindowUpdate, SetMenuDefaultItem, GetDoubleClickTime, ModifyMenuW, RegisterClipboardFormatW, CharUpperBuffW, IsClipboardFormatAvailable, GetUpdateRect, DrawMenuBar, DefFrameProcW, DefMDIChildProcW, TranslateMDISysAccel, SubtractRect, CreateMenu, GetWindowRgn, DestroyCursor, SetRect, GetMessageW, TranslateMessage, DispatchMessageW, DefWindowProcW, PostQuitMessage, RegisterClassExW, GetClassInfoExW, CreateWindowExW, DestroyWindow, SetWindowPos, EnableWindow, GetWindowRect, GetWindowLongW, SetWindowLongW, GetActiveWindow, MessageBoxW, SendMessageW, IsWindow, PtInRect, MessageBeep, FindWindowW, GetDesktopWindow, LoadCursorW, GetAncestor, GetSystemMetrics, MonitorFromRect, GetMonitorInfoW, LoadStringW, WaitForInputIdle, IsWindowVisible, CreateDialogParamW, SetDlgItemTextW, SendDlgItemMessageW, SetTimer, KillTimer, LoadMenuW, DestroyMenu, CheckMenuItem, GetSubMenu, TrackPopupMenu, DrawTextW, GetForegroundWindow, SetForegroundWindow, BeginPaint, EndPaint, GetCursorPos, ClientToScreen, GetFocus, DestroyIcon, CallNextHookEx, SetWindowsHookExW, ValidateRect, GetKeyState, PeekMessageW, GetWindowTextLengthW, GetWindowTextW, GetSysColorBrush, GetLastActivePopup, GetWindowThreadProcessId, IsWindowEnabled, UnhookWindowsHookEx, CharUpperW, EmptyClipboard, InsertMenuW, PostMessageW, GetClientRect, AdjustWindowRectEx, ShowWindow, GetMenuItemCount, GetMenuItemID, GetMenuState, GetMenuStringW, RemoveMenu, ReleaseDC, GetDC, GetAsyncKeyState, SetClipboardData, ScreenToClient, GetSysColor, SetClassLongW, GetParent, EnumThreadWindows, SystemParametersInfoW, FindWindowExW, MoveWindow, RegisterWindowMessageW, LoadImageW, GetClassNameW
GDI32.dll	RestoreDC, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectPalette, SetBkMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetTextAlign, RectVisible, GetObjectW, MoveToEx, TextOutW, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CombineRgn, CreateFontIndirectW, CreateRectRgnIndirect, PtVisible, PatBlt, SetRectRgn, DPtoLP, GetTextExtentPoint32W, GetTextMetricsW, EnumFontFamiliesExW, LineTo, IntersectClipRect, GetWindowExtEx, GetViewportExtEx, GetPixel, GetObjectType, GetClipBox, ExcludeClipRect, Escape, CreateSolidBrush, CreateRectRgn, CreatePatternBrush, CreatePen, CreateHatchBrush, CreateCompatibleDC, CreateBitmap, BitBlt, DeleteObject, DeleteDC, CreateDCW, GetTextFaceW, GetViewportOrgEx, GetWindowOrgEx, SetPixelV, SetPaletteEntries, ExtFloodFill, PtInRegion, GetBoundsRect, FrameRgn, FillRgn, RoundRect, OffsetRgn, GetRgnBox, Rectangle, LPtoDP, CreateRoundRectRgn, Polyline, Polygon, CreatePolygonRgn, GetTextColor, Ellipse, CreateEllipticRgn, SetDIBColorTable, CreateDIBSection, StretchBlt, CopyMetaFileW, GetTextCharsetInfo, EnumFontFamiliesW, CreateDIBitmap, CreateCompatibleBitmap, GetBkColor, RealizePalette, GetDeviceCaps, GetStockObject, SelectObject, SetBkColor, SetTextColor, ExtTextOutW, GetSystemPaletteEntries, GetPaletteEntries, GetNearestPaletteIndex, CreatePalette, SetPixel
WINSPOOL.DRV	GetJobW, ClosePrinter, OpenPrinterW, DocumentPropertiesW
ADVAPI32.dll	CredWriteW, RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, RegCreateKeyExW, RegEnumKeyExW, CredReadW, CredEnumerateW, CredDeleteW, CredFree, GetUserNameW, RegDeleteKeyExW, RegEnumValueW, RegFlushKey, RegOpenKeyW, RegOpenKeyExA, RegQueryValueExA, RegDeleteValueW, RegNotifyChangeKeyValue, RegCreateKeyA, RegCreateKeyW, RegDeleteKeyW, RegOpenKeyA, RegQueryValueW, RegDeleteKeyA, RegSetValueExA, RegCloseKey
SHELL32.dll	DragQueryFileW, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetFileInfoW, SHGetKnownFolderPath, ShellExecuteW, Shell_NotifyIconW, SHBrowseForFolderW, SHAppBarMessage, DragFinish, SHCreateDirectoryExW
ole32.dll	OleGetClipboard, CoLockObjectExternal, RegisterDragDrop, RevokeDragDrop, OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleSetContainedObject, OleLockRunning, OleInitialize, OleUninitialize, DoDragDrop, CreateStreamOnHGlobal, CoInitializeEx, CoInitialize, CoUninitialize, CoCreateInstance, CoDisconnectObject, ReleaseStgMedium, OleDuplicateData, OleCreate, CoTaskMemAlloc, CoTaskMemFree, CoCreateGuid
OLEAUT32.dll	VariantClear, VariantInit, SafeArrayAccessData, SafeArrayGetLBound, SafeArrayGetUBound, SysStringLen, SysFreeString, SysAllocStringLen, LoadTypeLib, SystemTimeToVariantTime, VariantTimeToSystemTime, SysAllocString, VariantCopy, VarBstrFromDate, VariantChangeType
MSIMG32.dll	TransparentBlt, AlphaBlend
SHLWAPI.dll	UrlEscapeW, PathAddExtensionW, PathAppendW, PathFindFileNameW, PathIsDirectoryW, PathIsFileSpecW, PathRemoveExtensionW, PathRemoveFileSpecW, PathRenameExtensionW, UrlCanonicalizeW, PathIsUNCW, PathStripToRootW, PathFindExtensionW, StrFormatKBSizeW, PathFileExistsW
UxTheme.dll	GetThemeSysColor, IsThemeBackgroundPartiallyTransparent, IsAppThemed, GetWindowTheme, DrawThemeText, DrawThemeParentBackground, OpenThemeData, CloseThemeData, DrawThemeBackground, GetThemeColor, GetCurrentThemeName, GetThemePartSize
bcrypt.dll	BCryptDestroyKey, BCryptEncrypt, BCryptGenerateSymmetricKey, BCryptSetProperty, BCryptDestroyHash, BCryptCloseAlgorithmProvider, BCryptFinishHash, BCryptHashData, BCryptCreateHash, BCryptVerifySignature, BCryptGetProperty, BCryptOpenAlgorithmProvider, BCryptDecrypt
CRYPT32.dll	CertFindCertificateInStore, CertCloseStore, CertOpenStore, CryptImportPublicKeyInfoEx2, CryptHashCertificate2, CertCreateCertificateContext, CertVerifySubjectCertificateContext, CertFreeCertificateContext, CryptUnprotectData, CryptProtectData, CryptStringToBinaryW, CertAddCertificateContextToStore
Secur32.dll	GetUserNameExW
gdiplus.dll	GdipCreateFromHDC, GdipCreateBitmapFromHBITMAP, GdipDrawImageI, GdipDeleteGraphics, GdipBitmapUnlockBits, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipCreateBitmapFromStream, GdipGetImagePaletteSize, GdipGetImagePalette, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipGetImageGraphicsContext, GdipDisposeImage, GdipCloneImage, GdiplusStartup, GdipFree, GdipAlloc, GdiplusShutdown, GdipDrawImageRectI, GdipSetInterpolationMode
OLEACC.dll	LresultFromObject, AccessibleObjectFromWindow, CreateStdAccessibleObject
IMM32.dll	ImmReleaseContext, ImmGetOpenStatus, ImmGetContext
WINMM.dll	PlaySoundW

Version Infos

Description	Data
LegalCopyright	Copyright Adobe Systems Inc. 1992-2021
InternalName	AcroTray
FileVersion	21.1.20155.433178
CompanyName	Adobe Systems Inc.
PrivateBuild
LegalTrademarks
Comments
ProductName	AcroTray - Adobe Acrobat Distiller helper application.
SpecialBuild
ProductVersion	21.1.20155.433178
FileDescription	AcroTray
OriginalFilename	AcroTray.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

• acrotray.exe

Click to jump to process

Memory Usage

• acrotray.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

System Behavior

Analysis Process: acrotray.exe PID: 7056 Parent PID: 6072

Function Logs

General

Start time:	17:24:47
Start date:	18/05/2021
Path:	C:\Users\user\Desktop\acrotray.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\acrotray.exe'
Imagebase:	0x1310000
File size:	5237432 bytes
MD5 hash:	0EFD56703E827AA5A659757894EDBA29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Created

Key Value Created

Key Value Queried

Key Monitored

Thread Activities

Thread Created

Thread Execution Resumed

Show Windows behavior

Memory Activities

Memory Allocated

Memory Usage Statistics

Show Windows behavior

System Activities

Show Windows behavior

Timing Activities

User Timer set

Show Windows behavior

Windows UI Activities

Window Created

Window UI Found

Show Windows behavior

LPC Port Activities

Chronological Activities

Disassembly

Code Analysis

Analysis Process: acrotray.exe PID: 7056 Parent PID: 6072 acrotray.exeCOMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2%
Total number of Nodes:	1523
Total number of Limit Nodes:	21

Executed Functions

Function 014715D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,?,01471539,00000000), ref: 014715E1
GetLastError.KERNEL32(00000028,?,01471539,00000000), ref: 01471614

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 014715DC

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: DebugErrorLastOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 4132100945-2690750368
Opcode ID: d91ecfc1ce4e922cc18645841c62061e9f592200c57758e399a6b58a91846db1
Instruction ID: 85a420ec873fa311a62379f7b7061563e21ce405fef1f9213ab21c9c9ee271a9
Opcode Fuzzy Hash: d91ecfc1ce4e922cc18645841c62061e9f592200c57758e399a6b58a91846db1
Instruction Fuzzy Hash: 4BF06D301412064BEB345E6DE864AAB3FACAB10B90F1CA41FFA08C5235EB31D0918F91

Uniqueness

Uniqueness Score: -1.00%

Function 01471690, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,7DFC34E3,01489FF0,00000028,01489FEF), ref: 014716FF
GetProcAddress.KERNEL32(73B60000,QueryActCtxW), ref: 01471714
QueryActCtxW.KERNEL32 ref: 0147174B
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 014717A9
SetLastError.KERNEL32(0000006F), ref: 014717C0
GetModuleHandleW.KERNEL32(Kernel32.dll), ref: 01471819
GetProcAddress.KERNEL32(73B60000,CreateActCtxW), ref: 0147182E
CreateActCtxWWorker.KERNEL32 ref: 01471854
GetLastError.KERNEL32 ref: 01471861
LoadLibraryW.KERNELBASE(Comctl32.dll,00000000,00000000,00000002,Comctl32.dll,00000040), ref: 014718E2

Strings

CreateActCtxW, xrefs: 01471828
Kernel32.dll, xrefs: 014716FA, 01471814
GetModuleHandleExW, xrefs: 01471763
QueryActCtxW, xrefs: 0147170E
@, xrefs: 014718B8
Comctl32.dll, xrefs: 014718C9, 014718DD
, xrefs: 014717CB

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Module$AddressErrorHandleLastProc$CreateFileLibraryLoadNameQueryWorker
String ID: $@$Comctl32.dll$CreateActCtxW$GetModuleHandleExW$Kernel32.dll$QueryActCtxW
API String ID: 722819805-1516674335
Opcode ID: 7fbacdfa734aad5a19ae985d3725d11c5eaee33a70f76bae797b80307ce23945
Instruction ID: 964e735fdeabf7282d6bac87c8ee9d277c7a5dd6d89b266909a0f93bfc6918bc
Opcode Fuzzy Hash: 7fbacdfa734aad5a19ae985d3725d11c5eaee33a70f76bae797b80307ce23945
Instruction Fuzzy Hash: 7A51A771E413199BEB309F699C58BDA7BB8FB04F50F11429BE905E72A0DB749940CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01321C00, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 140
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,Software\Adobe\Licensing\UserSpecificLicensing,00000000,?,?,?,?,00000000), ref: 01321C56
RegQueryValueExW.ADVAPI32(00000000,Enabled,00000000,00000000,?,0000000A,?,?,00000000), ref: 01321C79
RegCloseKey.ADVAPI32(00000000,?,?,00000000), ref: 01321CC6
RegOpenKeyExW.KERNELBASE(80000002,Software\Adobe\Identity\UserSpecificIdentity,00000000,?,?,?,?,00000000), ref: 01321CF9
RegQueryValueExW.ADVAPI32(00000000,Enabled,00000000,00000000,?,0000000A,?,?,00000000), ref: 01321D17
RegCloseKey.ADVAPI32(00000000,?,?,00000000), ref: 01321D60

Strings

Enabled, xrefs: 01321D0F
Software\Adobe\Licensing\UserSpecificLicensing, xrefs: 01321C38
Software\Adobe\Identity\UserSpecificIdentity, xrefs: 01321CDA
Enabled, xrefs: 01321C71

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Enabled$Enabled$Software\Adobe\Identity\UserSpecificIdentity$Software\Adobe\Licensing\UserSpecificLicensing
API String ID: 3677997916-2449448046
Opcode ID: e1d26dffe2db7d664aee11af61e001d8068b6eaa72a0a7eb734e8c1b834abc9d
Instruction ID: 6506906ad9951f26f8f741340fadfce0088d2d65b894df997619c9c641fffbd4
Opcode Fuzzy Hash: e1d26dffe2db7d664aee11af61e001d8068b6eaa72a0a7eb734e8c1b834abc9d
Instruction Fuzzy Hash: 04413631E00228AADF11AFA4DD95BFEBBF9EF46318F580099E845B7151E3629908C760

Uniqueness

Uniqueness Score: -1.00%

Function 0131FDC0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,?,00000000,00020019,?,SOFTWARE\Adobe\Adobe Acrobat\DC\Installer\,0000002A,7DFC34E3), ref: 0131FE49
RegQueryValueExW.ADVAPI32(?,?,00000000,?), ref: 0131FE9B
RegCloseKey.ADVAPI32(?), ref: 0131FEBA

Strings

SOFTWARE\Adobe\Adobe Acrobat\DC\Installer\, xrefs: 0131FE0A
bIsSingleClientApp, xrefs: 0131FE58

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Adobe\Adobe Acrobat\DC\Installer\$bIsSingleClientApp
API String ID: 3677997916-1952853169
Opcode ID: d23d6735590a20832196a84d2ae4ac286fd1e12b6735ef8d2dbcc9465e0a1db6
Instruction ID: f63d342d8e78b4b244504a69a95b12028a30cb59f63fbe9d107137587504d66e
Opcode Fuzzy Hash: d23d6735590a20832196a84d2ae4ac286fd1e12b6735ef8d2dbcc9465e0a1db6
Instruction Fuzzy Hash: 64414770D10249DEEF14DFA4CC59BEEBBB8FF04718F545129E401B6284E7B46A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0131FA10, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,Software\Adobe\Licensing\FeatureRestrictedLicensing,00000000,?,?,00000000), ref: 0131FA58
RegQueryValueExW.ADVAPI32(00000000,Enabled,00000000,00000000,?,00000014), ref: 0131FA78
RegCloseKey.ADVAPI32(00000000), ref: 0131FAB0

Strings

Software\Adobe\Licensing\FeatureRestrictedLicensing, xrefs: 0131FA4E
Enabled, xrefs: 0131FA70

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Enabled$Software\Adobe\Licensing\FeatureRestrictedLicensing
API String ID: 3677997916-351268846
Opcode ID: b3019c5b8738101b62e6913341763e4de870fa32eb1c6c0bff4d38e931cb605e
Instruction ID: 427aaef3617e9b5ac7de4027e9b102504e58b48a77056fc27c5037cfe4f6f88d
Opcode Fuzzy Hash: b3019c5b8738101b62e6913341763e4de870fa32eb1c6c0bff4d38e931cb605e
Instruction Fuzzy Hash: EF1182B1A00209AFEF14DFA1DC55BEEB7FCEB08704F00016AE941E6140E6799908CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0131FBA0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00000001,?,00000000), ref: 0131FBD0
RegQueryValueExW.ADVAPI32(00000000,bIsNGLLicensing,00000000,00000000,00000000,00000004), ref: 0131FBEE

Strings

bIsNGLLicensing, xrefs: 0131FBE6
SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0131FBB6

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: OpenQueryValue
String ID: SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement$bIsNGLLicensing
API String ID: 4153817207-1028593876
Opcode ID: 126b4a076cda85e8799dbbdbf7d9b1c751e73a7fe905815e117abb254815dbc8
Instruction ID: 27e7ae6e35c5ac586492c00d368b1deb0b4ae723bcdbe7c3c6d7d857a9d57fca
Opcode Fuzzy Hash: 126b4a076cda85e8799dbbdbf7d9b1c751e73a7fe905815e117abb254815dbc8
Instruction Fuzzy Hash: 77F06271A80208BBEF10CE95DC56BEEB7FCEB00719F10419AED05E2180E6B25A589A94

Uniqueness

Uniqueness Score: -1.00%

Function 0131F8E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,Software\Adobe\Adobe Acrobat\DC\Activation,00000000,00000001,?,00000000), ref: 0131F910
RegQueryValueExW.ADVAPI32(00000000,IsAMTEnforced,00000000,00000000,00000003,00000004), ref: 0131F92E

Strings

Software\Adobe\Adobe Acrobat\DC\Activation, xrefs: 0131F8F6
IsAMTEnforced, xrefs: 0131F926

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: OpenQueryValue
String ID: IsAMTEnforced$Software\Adobe\Adobe Acrobat\DC\Activation
API String ID: 4153817207-1397981253
Opcode ID: 2e3a16fc7e33cef60cf45354658f178aa5699f99479b12f5892b7aac3ce0f171
Instruction ID: e2314337cca64c3aa8f9a5375c182268022c9048197ac7274517261f0bfb6fcf
Opcode Fuzzy Hash: 2e3a16fc7e33cef60cf45354658f178aa5699f99479b12f5892b7aac3ce0f171
Instruction Fuzzy Hash: 1EF03071A8520CBBEB20DEA5DC56FDDB7BCEB00718F2041A6E904A2180E7B16758DA54

Uniqueness

Uniqueness Score: -1.00%

Function 0131FCA0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,Software\Adobe\Adobe Acrobat\DC\Activation,00000000,00000001,?,00000000), ref: 0131FCD0
RegQueryValueExW.ADVAPI32(00000000,IsNGLEnforced,00000000,00000000,00000003,00000004), ref: 0131FCEE

Strings

Software\Adobe\Adobe Acrobat\DC\Activation, xrefs: 0131FCB6
IsNGLEnforced, xrefs: 0131FCE6

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: OpenQueryValue
String ID: IsNGLEnforced$Software\Adobe\Adobe Acrobat\DC\Activation
API String ID: 4153817207-896486528
Opcode ID: 8066c21d6bbdea55b3fb3ed617592d9472f602c807198765d319d699b1081fe4
Instruction ID: c1f0ec464a0ea9e764ba5fae5b31bdf20766d12d302ebb72ad0a7f1e54b58f7e
Opcode Fuzzy Hash: 8066c21d6bbdea55b3fb3ed617592d9472f602c807198765d319d699b1081fe4
Instruction Fuzzy Hash: E4F03671A41208FBEB20DE91DC56FDE77BCE700718F104196E905A2185E7B15658DB94

Uniqueness

Uniqueness Score: -1.00%

Function 015EC1E0, Relevance: 3.0, APIs: 2, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(017BD120,0000000C), ref: 015EC1F3
ExitThread.KERNEL32 ref: 015EC1FA

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: e0e4b285b2c105efc095349f4488c3a59276184b0607498b70db035e2483ef56
Instruction ID: 327b575a53d10d70c1e8aacbb060431198680ba8526ebd2fc6dc55c24d1568d9
Opcode Fuzzy Hash: e0e4b285b2c105efc095349f4488c3a59276184b0607498b70db035e2483ef56
Instruction Fuzzy Hash: 76F0DCB0A00206AFDB1AEFF0D819B2E7BA5FF44611F10409DE1029B2A0DB3098008B90

Uniqueness

Uniqueness Score: -1.00%

Function 013CC440, Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 013CC4EF

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 28dbfe6269e1cb55c88011b0a601e92cee6aec6ae85dea9b24ee73fc422215fa
Instruction ID: 509832c8bdb079691904792b2e1f5315ecfb201aa10559960637eb5844cceac6
Opcode Fuzzy Hash: 28dbfe6269e1cb55c88011b0a601e92cee6aec6ae85dea9b24ee73fc422215fa
Instruction Fuzzy Hash: 2A21A2B1900216AFDB10DF6DCD44B5AFBF8FB15724F14862AE928E7780E775A910CB90

Uniqueness

Uniqueness Score: -1.00%

Function 014714E0, Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?), ref: 0147155B

Part of subcall function 014715D0: OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,?,01471539,00000000), ref: 014715E1
Part of subcall function 014715D0: GetLastError.KERNEL32(00000028,?,01471539,00000000), ref: 01471614

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: DebugErrorLastLibraryLoadOutputString
String ID:
API String ID: 3685684345-0
Opcode ID: 9aa19e7811aed9f646dd021d20c338f726b69688607c9b266e3cfd51ee116e99
Instruction ID: 9ae5a5988ed448f156e69cb9a39b9fc043c9d6614a83c86f31688c83b3404f94
Opcode Fuzzy Hash: 9aa19e7811aed9f646dd021d20c338f726b69688607c9b266e3cfd51ee116e99
Instruction Fuzzy Hash: E21182B2944259DFDB24DF99D944BAEBBB8F744B20F00462FE812E3390D7355404CB90

Uniqueness

Uniqueness Score: -1.00%

Function 016018D5, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0160123B,00000001,00000364,00000006,000000FF,?,?,015EC561,016015FB,?,?,015FDDD3), ref: 01601916

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71e20cc9bf5487540dfd2ddeb84ca1ce17c8a97a49b971e9b379d9f851b2e514
Instruction ID: 2a8860e5f99fb6b0f7f255ae0da24e34dd3b72bfe6322a10f346910bb0e9b374
Opcode Fuzzy Hash: 71e20cc9bf5487540dfd2ddeb84ca1ce17c8a97a49b971e9b379d9f851b2e514
Instruction Fuzzy Hash: 76F082316012296BEB2F5BAA9C04B5B7B9DEF87770B058125F919EA2D4DB30DD0186E0

Uniqueness

Uniqueness Score: -1.00%

Function 016012FA, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,01492F10,?,?,?,?,01311010,000000E0), ref: 0160132C

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 056f51cc24420b37d1c68e6006ff68fce131074eebf52c14d9557703d87d6298
Instruction ID: f22ed8f9f6748b122558e2c2576199d7b2c8f95f01f526ff987c914c55d4ee93
Opcode Fuzzy Hash: 056f51cc24420b37d1c68e6006ff68fce131074eebf52c14d9557703d87d6298
Instruction Fuzzy Hash: E6E0E5315012229BE73F26699C00B5B3B49AF533A1F010164FD4596AC0CF20D80242E9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0160B3FF, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01601099: GetLastError.KERNEL32(?,?,?,015EC205,017BD120,0000000C), ref: 0160109E
Part of subcall function 01601099: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,015EC205,017BD120,0000000C), ref: 0160113C

GetACP.KERNEL32(?,?,?,?,?,?,015FF204,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0160B4C0
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,015FF204,?,?,?,00000055,?,-00000050,?,?), ref: 0160B4EB
_wcschr.LIBVCRUNTIME ref: 0160B57F
_wcschr.LIBVCRUNTIME ref: 0160B58D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0160B654

Strings

A62254DC881E46726AB08085A283BCD9550B21044DE806945F482E8690DE3E132DF33ECEC9DDB8AC5F4511EE2F0C3982242152209F6B8BFEF14B7122594369AD, xrefs: 0160B4C9
utf8, xrefs: 0160B5BD

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: A62254DC881E46726AB08085A283BCD9550B21044DE806945F482E8690DE3E132DF33ECEC9DDB8AC5F4511EE2F0C3982242152209F6B8BFEF14B7122594369AD$utf8
API String ID: 4147378913-2384799892
Opcode ID: cc74fddec7a4d79b01cc3b8dee7fdd4d5e92648ff1dee9c5ac7b665128cbfbc3
Instruction ID: 48f9ea292d2da3f829592b3f30ed632e11d6bc893b82f753d68b6b4e80c7b489
Opcode Fuzzy Hash: cc74fddec7a4d79b01cc3b8dee7fdd4d5e92648ff1dee9c5ac7b665128cbfbc3
Instruction Fuzzy Hash: B0710775600202AAE72FAF38CC45BBB77A9EF54750F11846DEA05DB2C0FB71E5408764

Uniqueness

Uniqueness Score: -1.00%

Function 0160DF51, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0160E0CC

Strings

1#IND, xrefs: 0160F25C
1#QNAN, xrefs: 0160F26A
1#SNAN, xrefs: 0160F263
1#INF, xrefs: 0160F287

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c8d80ab4d5859462b932151ad63c43f0be361d97f1e25a8da2fb659edbcd0559
Instruction ID: 10196634c75e35fb5430652889b729a25081ee3bd275057689f27e0555a0c06a
Opcode Fuzzy Hash: c8d80ab4d5859462b932151ad63c43f0be361d97f1e25a8da2fb659edbcd0559
Instruction Fuzzy Hash: D7C25171E046298FDB2ACE28DD407EAB7B5FB48315F1445EAD90DE7280E775AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 0160BBA6, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,0160BEC4,00000002,00000000,?,?,?,0160BEC4,?,00000000), ref: 0160BC3F
GetLocaleInfoW.KERNEL32(00000000,20001004,0160BEC4,00000002,00000000,?,?,?,0160BEC4,?,00000000), ref: 0160BC68
GetACP.KERNEL32(?,?,0160BEC4,?,00000000), ref: 0160BC7D

Strings

ACP, xrefs: 0160BBC4
OCP, xrefs: 0160BBFA

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: d02aa7043e7cd52ccc9abfdc96974a2dd76ab83d93e59a857ceb96ee22d32726
Instruction ID: 3054c20a719844be8e361f683d9314369ad9b24eb1ea42e34cb30a45a44754bc
Opcode Fuzzy Hash: d02aa7043e7cd52ccc9abfdc96974a2dd76ab83d93e59a857ceb96ee22d32726
Instruction Fuzzy Hash: D321B62A604501ABEB3F8F18DD01B97B7A6EB80E54B46C464F90AD7395EF72DD41C350

Uniqueness

Uniqueness Score: -1.00%

Function 0160BD7B, Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01601099: GetLastError.KERNEL32(?,?,?,015EC205,017BD120,0000000C), ref: 0160109E
Part of subcall function 01601099: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,015EC205,017BD120,0000000C), ref: 0160113C

Part of subcall function 01601099: _free.LIBCMT ref: 016010FB
Part of subcall function 01601099: _free.LIBCMT ref: 01601131

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0160BE87
IsValidCodePage.KERNEL32(00000000), ref: 0160BED0
IsValidLocale.KERNEL32(?,00000001), ref: 0160BEDF
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0160BF27
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0160BF46

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: b2db33206c71b5166aee0ad55972b691ee17bf0bad22f2e231eaa2216867ef7d
Instruction ID: d134d840f195a3ade21d4224f3382161fd333f6a066582d2e24cbc062cdd243b
Opcode Fuzzy Hash: b2db33206c71b5166aee0ad55972b691ee17bf0bad22f2e231eaa2216867ef7d
Instruction Fuzzy Hash: BF51A175A00206AFEB2ADFA9DC50ABB77B9FF54740F188429E701E72D0E7709904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 013205D0, Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 441COMMON

Download Yara Rule

APIs

Part of subcall function 013205D0: std::_Xinvalid_argument.LIBCPMT ref: 01320465
Part of subcall function 013205D0: std::_Xinvalid_argument.LIBCPMT ref: 01320475

Concurrency::cancel_current_task.LIBCPMT ref: 013208A4
Concurrency::cancel_current_task.LIBCPMT ref: 01320A13

Strings

string too long, xrefs: 01320460
vector too long, xrefs: 01320470

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: string too long$vector too long
API String ID: 3646673767-1617939282
Opcode ID: 3580f867d9cdd662aac58ea07f629bd2b92c3014ceed8d86c129d904e134ce74
Instruction ID: dfe795d8135f73ccbab0c8699d6d8b68688501a9e4f31c9b628784ae0a71b77a
Opcode Fuzzy Hash: 3580f867d9cdd662aac58ea07f629bd2b92c3014ceed8d86c129d904e134ce74
Instruction Fuzzy Hash: D6D1B771E00119ABCB18DFACD8808AEBBF9FF99314B14426AE915D7350D7319A14CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 01606102, Relevance: 4.7, APIs: 3, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,01765598), ref: 0160616C
_free.LIBCMT ref: 0160615A

Part of subcall function 016015D5: HeapFree.KERNEL32(00000000,00000000,?,015FDDD3), ref: 016015EB
Part of subcall function 016015D5: GetLastError.KERNEL32(?,?,015FDDD3), ref: 016015FD

_free.LIBCMT ref: 01606326

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 2155170405-0
Opcode ID: e64738ef4612cbd14cbb11ff525f6e0e262277a5aa734d8dad24098f837a4974
Instruction ID: 1c1824d17540089f0c5dde61f65b49601eb7439372c10b5301c371cfffbe3085
Opcode Fuzzy Hash: e64738ef4612cbd14cbb11ff525f6e0e262277a5aa734d8dad24098f837a4974
Instruction Fuzzy Hash: C8510771D0021AABDB2AEF69DC809AB7BBDAF44320B10816DE511972C1E7309E518B94

Uniqueness

Uniqueness Score: -1.00%

Function 015E60A1, Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 015E6199
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 015E61A3
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 015E61B0

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2ca5299f108c93687aca21f11cf93fdd2c6b840f6aadcce02383e413b90dcaa1
Instruction ID: cd2e24afec4d9df151cfc394bc3cc6ff067a5b5e0ffe70f5ad70b59da31b84a1
Opcode Fuzzy Hash: 2ca5299f108c93687aca21f11cf93fdd2c6b840f6aadcce02383e413b90dcaa1
Instruction Fuzzy Hash: A731D375D012299BCB25DF68DD88B8DBBF8BF58350F5041EAE41CAA250E7709F858F44

Uniqueness

Uniqueness Score: -1.00%

Function 015FD2FF, Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,015FD2FE,?,?,?,?), ref: 015FD321
TerminateProcess.KERNEL32(00000000,?,015FD2FE,?,?,?,?), ref: 015FD328
ExitProcess.KERNEL32 ref: 015FD33A

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c3ac06be097ed8acec74b987d870e31d47c26e8f5afbccaef2e74001187b627f
Instruction ID: 55aaac5486738c6ff0a77100873ca12f8c3d5fb0119fc1577393ebccee1fa703
Opcode Fuzzy Hash: c3ac06be097ed8acec74b987d870e31d47c26e8f5afbccaef2e74001187b627f
Instruction Fuzzy Hash: C0E08C32000209AFCF226F98ED1CA0C3F79FF40242B40401CFA049A174CB36DC62CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015F2D90, Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af2702f08044148ee84ead01a99c278225720cda3c2f24a0d427ecb11bc2b6c
Instruction ID: 3f897c2636dd304d0be9e038d6dbde5bcbe2c94fa2861e7255c9e8f4889ad8e3
Opcode Fuzzy Hash: 8af2702f08044148ee84ead01a99c278225720cda3c2f24a0d427ecb11bc2b6c
Instruction Fuzzy Hash: 5DF14F71E012199FDF14CFA8C880AADBBF5FF88314F15826EDA19AB345D731A901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015E13B2, Relevance: 3.0, APIs: 2, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,015D0C62,2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271,?,?,?,015D0C97,?,?,00000006,?,?,?,015CF7C6,00000006,00000001), ref: 015E13CB
GetSystemTimeAsFileTime.KERNEL32(016E92E8,?,?,015D0C62,2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271,?,?,?,015D0C97,?,?,00000006,?,?,?,015CF7C6), ref: 015E13CF

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 4fa3eeccf04c9cfdce8810e327e80eebdaae0579c4c89b5230dbdc0f326b6f74
Instruction ID: 9e624e8c85d83ba2ee1e718a97ebedb47b98502467c7b0e890e7f39dc49cf0f5
Opcode Fuzzy Hash: 4fa3eeccf04c9cfdce8810e327e80eebdaae0579c4c89b5230dbdc0f326b6f74
Instruction Fuzzy Hash: F5D0A932901428E78B212B89BC184AD7BADFB08B603041052EA099A114CB602C104BD0

Uniqueness

Uniqueness Score: -1.00%

Function 015FE3FF, Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000000), ref: 015FE62C

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7ac618ae5f254d5c4833721026656948b19cdc33caa3a404d676933fc90658c6
Instruction ID: a9fd45308432c8537524dc784837f6587693d7513ba73587e7e2aeb7533e50f0
Opcode Fuzzy Hash: 7ac618ae5f254d5c4833721026656948b19cdc33caa3a404d676933fc90658c6
Instruction Fuzzy Hash: 12B13B71610609CFE715CF2CC48AA697BE1FF45364F26865CEA99CF2A1D335E981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0160B6F2, Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01601099: GetLastError.KERNEL32(?,?,?,015EC205,017BD120,0000000C), ref: 0160109E
Part of subcall function 01601099: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,015EC205,017BD120,0000000C), ref: 0160113C

EnumSystemLocalesW.KERNEL32(0160B820,00000001,00000000,?,-00000050,?,0160BE5B,00000000,?,?,?,00000055,?), ref: 0160B764

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: cb7eab9f9b77727afacb578e87578ce5d23a195966ef6d233476e05c32d7baa0
Instruction ID: 254c4369b729015352f6d0be8e987281e7e5a99fbcf510fdfc8978a3e3500066
Opcode Fuzzy Hash: cb7eab9f9b77727afacb578e87578ce5d23a195966ef6d233476e05c32d7baa0
Instruction Fuzzy Hash: 1F11253A2003059FDB1DAF39DCA05BBBB92FF84359B18842DD98787B80D371A902C740

Uniqueness

Uniqueness Score: -1.00%

Function 0160B78D, Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01601099: GetLastError.KERNEL32(?,?,?,015EC205,017BD120,0000000C), ref: 0160109E
Part of subcall function 01601099: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,015EC205,017BD120,0000000C), ref: 0160113C

EnumSystemLocalesW.KERNEL32(0160BA80,00000001,00000000,?,-00000050,?,0160BE1F,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0160B7D7

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 644f7f9302e600f1fc42110a794e0e4d9adf7b1c6993462088885628d2863c5c
Instruction ID: 8f7143739a839635771ad7d86f1a69cdceb27ca1a1c00ff3135cf4b9199f014c
Opcode Fuzzy Hash: 644f7f9302e600f1fc42110a794e0e4d9adf7b1c6993462088885628d2863c5c
Instruction Fuzzy Hash: 8EF0C23A2003045FDB2A9E399C90A7B7B95EF81768B09846DE9468B690D6B19C41C750

Uniqueness

Uniqueness Score: -1.00%

Function 0160194D, Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01600271: EnterCriticalSection.KERNEL32(?,?,0160991C,?,017BD620,0000000C), ref: 01600280

EnumSystemLocalesW.KERNEL32(01601940,00000001,017BD420,0000000C,01601DAB,00000000), ref: 01601985

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 6517d2507bd8ab2e84d6439f0313f084efce2883398576edf70a07120d1cecb8
Instruction ID: c249d7b8511e2eeef85f3e9f64e39bfb83ae9132cc66d8253d18763575701c98
Opcode Fuzzy Hash: 6517d2507bd8ab2e84d6439f0313f084efce2883398576edf70a07120d1cecb8
Instruction Fuzzy Hash: A0F04976A04205EFDB14EFA8E881B9EBBF0EB48725F10812EE511DB290C7B59900CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0160B6A7, Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01601099: GetLastError.KERNEL32(?,?,?,015EC205,017BD120,0000000C), ref: 0160109E
Part of subcall function 01601099: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,015EC205,017BD120,0000000C), ref: 0160113C

EnumSystemLocalesW.KERNEL32(0160B600,00000001,00000000,?,?,0160BE7D,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0160B6DE

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 6aaf1d7f94e177bc41bc88f23839330fa7b2440ba6ba7745ef446d421502a979
Instruction ID: 7457994673ce75d83d3a74b0360e98bf9185200e19e785aa11481f99e57d47b1
Opcode Fuzzy Hash: 6aaf1d7f94e177bc41bc88f23839330fa7b2440ba6ba7745ef446d421502a979
Instruction Fuzzy Hash: E5F0E53A30025957CB1A9F3ADC65A7BBF94EFC1754B06805EEA06CB291C7729842C790

Uniqueness

Uniqueness Score: -1.00%

Function 01601F06, Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,015FFD81,?,20001004,00000000,00000002,?,?,015FF36C), ref: 01601F3A

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4ffa885d37809608f49ebdf17d175802347b4334d064976ce6c07dc1d80748c8
Instruction ID: a09d4135704f8df72f0f162cfc9bdef02845c1986c2e9fab075183dace9c4e9d
Opcode Fuzzy Hash: 4ffa885d37809608f49ebdf17d175802347b4334d064976ce6c07dc1d80748c8
Instruction Fuzzy Hash: 72E09A35100118BBCB172F64EC04A9E3E6AEF59761F000018FE01212A0CB31CD209A98

Uniqueness

Uniqueness Score: -1.00%

Function 015E9EBF, Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b261f5de8a3f3ca2a1be3e59719b223d15645e5d96039ccfddd9bbe321561a
Instruction ID: 1b055349f4fcdbe5a9d4dfe55d7a4295d307ae0439f64d53c438f954a2510a52
Opcode Fuzzy Hash: d0b261f5de8a3f3ca2a1be3e59719b223d15645e5d96039ccfddd9bbe321561a
Instruction Fuzzy Hash: 45516A70E0074A5AEF3F8A3C849CBBE6FD9BF91208F04491DD572DF282D616D944C252

Uniqueness

Uniqueness Score: -1.00%

Function 0160F783, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0de9c9b75b628b0794124a21a510d17b2a43e4595c46f529451b33bcbf86cd
Instruction ID: 417146827d1d9e7ace8c7aefd0a89068605b0ca553bc8d8776c47e584dab806f
Opcode Fuzzy Hash: ad0de9c9b75b628b0794124a21a510d17b2a43e4595c46f529451b33bcbf86cd
Instruction Fuzzy Hash: 2421B373F205394B7B0CC47E8C562BDB6E1C78C501745827AF8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 0160F663, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da682b67b6e76839dcb618f2a1d69d9eb67ab82ffa0c0bce30ccfe69001b03e
Instruction ID: bdfa004fa8662e4d1de0131a413c3e0bcd48bce5087c12b5aeaa15b43ab1c142
Opcode Fuzzy Hash: 9da682b67b6e76839dcb618f2a1d69d9eb67ab82ffa0c0bce30ccfe69001b03e
Instruction Fuzzy Hash: 8511A723F30C255B675C81798C1327A91D3DBD815030F437AD826E72C4E894DE13C290

Uniqueness

Uniqueness Score: -1.00%

Function 01606564, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5379c56c5339116fa515bbd403340ecbb0b14c6f88512186119c39f13819e676
Instruction ID: c87dce176048a29abbf6097bca15088250cef9fd7530fb826a67029f4b485885
Opcode Fuzzy Hash: 5379c56c5339116fa515bbd403340ecbb0b14c6f88512186119c39f13819e676
Instruction Fuzzy Hash: 31F03072A152249BCF2BC64CC805B5AB3B9EB45B69F51405AF505DB281D3B1EE50C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 016065A8, Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 036fad3b38285c6e52aeae5abec6d738fe92eb7e6d0c60a1623e2d89cc1db0b2
Instruction ID: 10732cd7e828b2e5f74bfce1e04a5a4dc51a0d015f2bc1941ebd1d80fb07a397
Opcode Fuzzy Hash: 036fad3b38285c6e52aeae5abec6d738fe92eb7e6d0c60a1623e2d89cc1db0b2
Instruction Fuzzy Hash: E1E08C32A11238EBCB2ADB9CC94498AF7ECEB45B40B11009AF601E3280C670DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0160A9DD, Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0160AA21

Part of subcall function 01609C19: _free.LIBCMT ref: 01609C36
Part of subcall function 01609C19: _free.LIBCMT ref: 01609C48
Part of subcall function 01609C19: _free.LIBCMT ref: 01609C5A
Part of subcall function 01609C19: _free.LIBCMT ref: 01609C6C
Part of subcall function 01609C19: _free.LIBCMT ref: 01609C7E
Part of subcall function 01609C19: _free.LIBCMT ref: 01609C90
Part of subcall function 01609C19: _free.LIBCMT ref: 01609CA2
Part of subcall function 01609C19: _free.LIBCMT ref: 01609CB4
Part of subcall function 01609C19: _free.LIBCMT ref: 01609CC6
Part of subcall function 01609C19: _free.LIBCMT ref: 01609CD8
Part of subcall function 01609C19: _free.LIBCMT ref: 01609CEA
Part of subcall function 01609C19: _free.LIBCMT ref: 01609CFC
Part of subcall function 01609C19: _free.LIBCMT ref: 01609D0E

_free.LIBCMT ref: 0160AA16

Part of subcall function 016015D5: HeapFree.KERNEL32(00000000,00000000,?,015FDDD3), ref: 016015EB
Part of subcall function 016015D5: GetLastError.KERNEL32(?,?,015FDDD3), ref: 016015FD

_free.LIBCMT ref: 0160AA38
_free.LIBCMT ref: 0160AA4D
_free.LIBCMT ref: 0160AA58
_free.LIBCMT ref: 0160AA7A
_free.LIBCMT ref: 0160AA8D
_free.LIBCMT ref: 0160AA9B
_free.LIBCMT ref: 0160AAA6
_free.LIBCMT ref: 0160AADE
_free.LIBCMT ref: 0160AAE5
_free.LIBCMT ref: 0160AB02
_free.LIBCMT ref: 0160AB1A

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: e0d7f4e87a8d932935f449cc2da4639e1fed441b26722eb17bf846784dca2954
Instruction ID: 8518032dd26fd6d35c5ee587843cbca0728245b1269af407f27822588998c72d
Opcode Fuzzy Hash: e0d7f4e87a8d932935f449cc2da4639e1fed441b26722eb17bf846784dca2954
Instruction Fuzzy Hash: 5C314C715007029EEB3BAAB9DD44B5B77EAAB113A0F14481DE4569B2D1EF31E9808714

Uniqueness

Uniqueness Score: -1.00%

Function 01328120, Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 276COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 013281B0

Part of subcall function 015CE534: std::_Lockit::_Lockit.LIBCPMT ref: 015CE546
Part of subcall function 015CE534: std::locale::_Setgloballocale.LIBCPMT ref: 015CE561
Part of subcall function 015CE534: _Yarn.LIBCPMT ref: 015CE577
Part of subcall function 015CE534: std::_Lockit::~_Lockit.LIBCPMT ref: 015CE5B7

std::ios_base::_Addstd.LIBCPMT ref: 01328289
_strftime.LIBCMT ref: 0132834C
__Mtx_unlock.LIBCPMT ref: 0132841D

Strings

ios_base::eofbit set, xrefs: 013282B9
%d-%m-%Y %I:%M:%S, xrefs: 01328341
2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271, xrefs: 01328357, 0132841C
---, xrefs: 013283B5
---, xrefs: 013283BC
ios_base::badbit set, xrefs: 013282AA, 013282D3, 0132830F
ios_base::failbit set, xrefs: 013282B4

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$AddstdInitLockit::_Lockit::~_Mtx_unlockSetgloballocaleYarn_strftimestd::ios_base::_
String ID: %d-%m-%Y %I:%M:%S$---$---$2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3552534032-800858077
Opcode ID: 079365251b24654f772e720262044db8edfe1ee24d461f1b7b3bd96b109704e6
Instruction ID: afb9e92392e07ab00398b52f6c23b849203dfb1ceb86d3af0d6c2d0f624023bf
Opcode Fuzzy Hash: 079365251b24654f772e720262044db8edfe1ee24d461f1b7b3bd96b109704e6
Instruction Fuzzy Hash: 8D91F4B1D00315AFDB10EFA8DC88B9EBBE8FF58718F144159ED05AB385E77999048B90

Uniqueness

Uniqueness Score: -1.00%

Function 013C43D0, Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 013C4473
___from_strstr_to_strchr.LIBCMT ref: 013C4489

Strings

-1e+9999, xrefs: 013C44E6
null, xrefs: 013C44D1
%%.%dg, xrefs: 013C4402
Infinity, xrefs: 013C44ED
NaN, xrefs: 013C44CC
1e+9999, xrefs: 013C44F2
-Infinity, xrefs: 013C44E1, 013C44FE

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: %%.%dg$-1e+9999$-Infinity$1e+9999$Infinity$NaN$null
API String ID: 601868998-1955747591
Opcode ID: 49fee3b4020e5feabc3f7e83e4a8e67a31934d3e7e969c2b04eb23b89125edd0
Instruction ID: a7f4497607ae59bbb3f69f066b863626ee7492c2f93faac4e8028f9ffe02a3d2
Opcode Fuzzy Hash: 49fee3b4020e5feabc3f7e83e4a8e67a31934d3e7e969c2b04eb23b89125edd0
Instruction Fuzzy Hash: F24136B5900249ABDB11DF68DC15BFEBBB8FF01A0CF54415DE801AB241E7719A09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0131D9B0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?), ref: 0131D9D6
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000), ref: 0131D9EB
RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00020006,?), ref: 0131DA17
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 0131DA41
RegSetValueExW.ADVAPI32(?,?,00000000,00000003,00000062,00000064), ref: 0131DA61
RegCloseKey.ADVAPI32(?), ref: 0131DA6D

Strings

SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0131DA0D
SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0131DA37

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ByteCharMultiWide$CloseCreateOpenValue
String ID: SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement$SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
API String ID: 2501786468-283844744
Opcode ID: 8e069f34c3b262f45b154bfb65f93d45e913e506ed16ce4db49db814ecbc920e
Instruction ID: dcc57b439a17d71194c202969f06068f8a6dac1ca553b4f3358e2e1cb44c0421
Opcode Fuzzy Hash: 8e069f34c3b262f45b154bfb65f93d45e913e506ed16ce4db49db814ecbc920e
Instruction Fuzzy Hash: 35217531644315BFFB308F95EC16FAA7BADEB45B10F104295FA19F61C4DAB06910CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0131D8E0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,00000000,00000000,?), ref: 0131D90B
MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,?,00000000), ref: 0131D920
RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00020006,?), ref: 0131D93E
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 0131D969
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,00000004,00000004), ref: 0131D98D
RegCloseKey.ADVAPI32(?), ref: 0131D999

Strings

SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0131D934
SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0131D95F

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ByteCharMultiWide$CloseCreateOpenValue
String ID: SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement$SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
API String ID: 2501786468-283844744
Opcode ID: ce45f9bae77aba945c83739c4ad656cb6c97921671fa3b1e24b22b59f9952585
Instruction ID: d8a1dc132aba0a8b5396d1cca7da53aef284027eadcfc280b3103e99293a6886
Opcode Fuzzy Hash: ce45f9bae77aba945c83739c4ad656cb6c97921671fa3b1e24b22b59f9952585
Instruction Fuzzy Hash: FC215E31644318BFEB309F95EC16F9977A9EB04B50F104196F719FA0D4D6B06950CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0131DA90, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,00000000,00000000,00000001), ref: 0131DABC
MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,?,00000000), ref: 0131DAD1
RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00020006,?), ref: 0131DAEF
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 0131DB1A
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,00000004,00000004), ref: 0131DB3E
RegCloseKey.ADVAPI32(?), ref: 0131DB4A

Strings

SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0131DAE5
SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0131DB10

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ByteCharMultiWide$CloseCreateOpenValue
String ID: SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement$SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
API String ID: 2501786468-283844744
Opcode ID: 91d252ed6532428fafc1f8966500645d9fdedb613f5c3c7014fb74f7f64b84de
Instruction ID: f840144bdf335ae978948e2bfb69414711075a4067cc20f3f6aaad0cb761245a
Opcode Fuzzy Hash: 91d252ed6532428fafc1f8966500645d9fdedb613f5c3c7014fb74f7f64b84de
Instruction Fuzzy Hash: 45212E31644328BFEB309B959C16FA977B8AB05B50F104196B719FA0D4D6B0A950CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 015EB6F7, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 015EB87F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 015EB89B
__allrem.LIBCMT ref: 015EB8B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 015EB8D0
__allrem.LIBCMT ref: 015EB8E7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 015EB905

Strings

ios_base::failbit set, xrefs: 015EB98B

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID: ios_base::failbit set
API String ID: 1992179935-3924258884
Opcode ID: 7d93b62e7d1e0e0a0392306af628f4ba7e0132a84151ca25d3fa0f9aba709697
Instruction ID: a96cdbea3c8de1561ba154fcc17cd0f1dab0d0a00b87a43d7b13afed4e99b0d7
Opcode Fuzzy Hash: 7d93b62e7d1e0e0a0392306af628f4ba7e0132a84151ca25d3fa0f9aba709697
Instruction Fuzzy Hash: 51813572E00B179BD729AE6CCC44B6A77E9BF50361F144629E541DE6D1EB30E9008B90

Uniqueness

Uniqueness Score: -1.00%

Function 015FF99D, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01601099: GetLastError.KERNEL32(?,?,?,015EC205,017BD120,0000000C), ref: 0160109E
Part of subcall function 01601099: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,015EC205,017BD120,0000000C), ref: 0160113C

_memcmp.LIBVCRUNTIME ref: 015FFC36
_free.LIBCMT ref: 015FFCAA
_free.LIBCMT ref: 015FFCC3
_free.LIBCMT ref: 015FFD01
_free.LIBCMT ref: 015FFD0A
_free.LIBCMT ref: 015FFD16

Strings

C, xrefs: 015FFAF9

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C
API String ID: 4275183328-1037565863
Opcode ID: 8388885b0f325669ad2c2b02c31fcfd9f061dfd14ed21caca4cb8152c6e49db1
Instruction ID: f63a4dbfd610b9f632298b7f73a5c2e2742445f5a2f14fe1a5ebf6f2f3495c31
Opcode Fuzzy Hash: 8388885b0f325669ad2c2b02c31fcfd9f061dfd14ed21caca4cb8152c6e49db1
Instruction Fuzzy Hash: 8AB14C7690122A9BDB25DF18C894BADB7B4FF48314F1445DED94AAB790E770AE80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01489EC0, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Adobe\Designer\8.2,00000000,00000002,00000000,?,?,0131D3EA,00000000), ref: 01489ED6
RegDeleteValueW.ADVAPI32(00000000,MasterKey,?,?,0131D3EA,00000000), ref: 01489EE8
RegDeleteValueW.ADVAPI32(00000000,MasterApp,?,?,0131D3EA,00000000), ref: 01489EF6
RegCloseKey.ADVAPI32(00000000,?,?,0131D3EA,00000000), ref: 01489EFF

Strings

Software\Adobe\Designer\8.2, xrefs: 01489ECC
MasterKey, xrefs: 01489EE0
MasterApp, xrefs: 01489EEE

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: DeleteValue$CloseOpen
String ID: MasterApp$MasterKey$Software\Adobe\Designer\8.2
API String ID: 1772201698-2757307797
Opcode ID: ad74be981ec8670e0590e89c2b53c7ca56d2fe62b68261b0ff455ef98559e1c7
Instruction ID: ba9e27c80f4533551cd23c23224d6dda803ba234f7405d6698870e36a219c152
Opcode Fuzzy Hash: ad74be981ec8670e0590e89c2b53c7ca56d2fe62b68261b0ff455ef98559e1c7
Instruction Fuzzy Hash: 49E04F71644208FBDB219F92ED3BF5DBB38EB00601F101098FA05B0164DBB11A21DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0131C3D0, Relevance: 12.1, APIs: 8, Instructions: 94filepipeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000001,C0000000,00000000,00000000,00000003,00190000,00000000,?,00000000,00000000,00000000,00000001), ref: 0131C3EC
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000001), ref: 0131C3F9
SetNamedPipeHandleState.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0131C41F
WriteFile.KERNEL32(00000000,00000003,00000004,00000001,00000000,?,00000000,00000000), ref: 0131C439
GetLastError.KERNEL32(?,00000000,00000000), ref: 0131C443
CloseHandle.KERNEL32(00000000,?,00000000,00000000), ref: 0131C456

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ErrorFileHandleLast$CloseCreateNamedPipeStateWrite
String ID:
API String ID: 1195787737-0
Opcode ID: ddc6bc9b788095afb89c208f2ff29e65aaf84bfb49f322bfcb7c642b0dc8f6f2
Instruction ID: 74b03fd2f52a9662584147abef32156cb0d14cb0f6d825766c465ad1342b165e
Opcode Fuzzy Hash: ddc6bc9b788095afb89c208f2ff29e65aaf84bfb49f322bfcb7c642b0dc8f6f2
Instruction Fuzzy Hash: F521A671A402286BEB319A99EC45BBE7BBCEB44A61F0051AAFD09F3194D7708A11C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0148A040, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Adobe\Adobe Acrobat\DC\Activation,00000000,00000001,?,?,00000000), ref: 0148A0EE
RegQueryValueExW.ADVAPI32(?,Disabled,00000000,00000000,00000000,00000004), ref: 0148A112

Strings

en_US, xrefs: 0148A29B
Disabled, xrefs: 0148A107
zh_CN, xrefs: 0148A2D5
Software\Adobe\Adobe Acrobat\DC\Activation, xrefs: 0148A0BD

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: OpenQueryValue
String ID: Disabled$Software\Adobe\Adobe Acrobat\DC\Activation$en_US$zh_CN
API String ID: 4153817207-3686816119
Opcode ID: 39629bc2ee9ca630612bd77872acf0dd3ca0da81c070d6241740ec596d84f525
Instruction ID: b30c4212daf9abe36ec47f78f6718f4d00458005c03e259eb4fd70e823f5a2ee
Opcode Fuzzy Hash: 39629bc2ee9ca630612bd77872acf0dd3ca0da81c070d6241740ec596d84f525
Instruction Fuzzy Hash: 32A19B709043689FEB30DF68D848B9EBBF4BB04308F50846EE559AB351DBB1A549CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01601B16, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 01601B6D
ext-ms-, xrefs: 01601B81

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 4e29cb6625787b6b1a3f9494858ab133ffb048cc72d45909fb62073271f3a543
Instruction ID: 8ffb0b13870d2d3d458fcea0a786a940fa9d38dd3f754883b652228090c9bdc4
Opcode Fuzzy Hash: 4e29cb6625787b6b1a3f9494858ab133ffb048cc72d45909fb62073271f3a543
Instruction Fuzzy Hash: F721D871A01A21ABD73B9A699C94F2B77A8AB427A4F150551FD06E73D1F770EC0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 0160A603, Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0160A34F: _free.LIBCMT ref: 0160A374

_free.LIBCMT ref: 0160A651

Part of subcall function 016015D5: HeapFree.KERNEL32(00000000,00000000,?,015FDDD3), ref: 016015EB
Part of subcall function 016015D5: GetLastError.KERNEL32(?,?,015FDDD3), ref: 016015FD

_free.LIBCMT ref: 0160A65C
_free.LIBCMT ref: 0160A667
_free.LIBCMT ref: 0160A6BB
_free.LIBCMT ref: 0160A6C6
_free.LIBCMT ref: 0160A6D1
_free.LIBCMT ref: 0160A6DC

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9771e65f1d495e9572a28e565a02ea9162a5f769647979ca51d29ea56db4d033
Instruction ID: eb196c582aed3ced45f45d702d26eaf628e0c5055b86f829dc487fecfec3c618
Opcode Fuzzy Hash: 9771e65f1d495e9572a28e565a02ea9162a5f769647979ca51d29ea56db4d033
Instruction Fuzzy Hash: 92115171540B05ABD53BB7F1CC05FCB77AE5F11B90F48081DA29AAB0D0FAA6F5044754

Uniqueness

Uniqueness Score: -1.00%

Function 013232E0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,00000000,00000000,00000064,?), ref: 01323303
MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,?,00000000), ref: 01323318
RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00020019,?), ref: 01323339
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,0000012C), ref: 0132337A
RegCloseKey.ADVAPI32(?), ref: 0132338B

Strings

SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0132332F

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ByteCharMultiWide$CloseOpenQueryValue
String ID: SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
API String ID: 2332129513-717607756
Opcode ID: f69cdb39d9e4ce9ee2ddc084ce563e1417476456bf208782341447ea1849daf5
Instruction ID: 530e39e2e36e5006db454ba090492def04a3db9e09e52b121a6d9a70c5783acf
Opcode Fuzzy Hash: f69cdb39d9e4ce9ee2ddc084ce563e1417476456bf208782341447ea1849daf5
Instruction Fuzzy Hash: 90114271A44218BFEB209F91DC05FEA77BCEB45710F104196FA09F61C0DA706A54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0131D7F0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,00000000,00000000,0131C753,?), ref: 0131D813
MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,?,00000000), ref: 0131D828
RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00020019,?), ref: 0131D849
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,0000012C), ref: 0131D88A
RegCloseKey.ADVAPI32(?), ref: 0131D89B

Strings

SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0131D83F

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ByteCharMultiWide$CloseOpenQueryValue
String ID: SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
API String ID: 2332129513-717607756
Opcode ID: 5eea2aeb24b4eebff58fb8cdb0f5a07f5b14318a24912f4bc3a5614cfdd4917d
Instruction ID: 0caf8121c02e7506bab75592f7ebd12bfa3b824ced371f903f3d18ff820da6d2
Opcode Fuzzy Hash: 5eea2aeb24b4eebff58fb8cdb0f5a07f5b14318a24912f4bc3a5614cfdd4917d
Instruction Fuzzy Hash: F2118271A00218BFEB209F91DC05FEA77ACEB45710F104196FA09F61C0DA706A54CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01323210, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,00000000,00000000,?), ref: 01323250
MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,?,00000000), ref: 01323265
RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00020019,?), ref: 01323286
RegQueryValueExW.ADVAPI32(?,?,00000000,00000004,00000000,00000004), ref: 013232B4
RegCloseKey.ADVAPI32(?), ref: 013232C9

Strings

SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0132327C

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ByteCharMultiWide$CloseOpenQueryValue
String ID: SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
API String ID: 2332129513-717607756
Opcode ID: 0be888ee88fd89415c6e8a77b9ff372191836284b240ef33472229b526406417
Instruction ID: e19ca156436ebbf874ced72eca5f6875ba836e40a1da1685ee26d5c920721550
Opcode Fuzzy Hash: 0be888ee88fd89415c6e8a77b9ff372191836284b240ef33472229b526406417
Instruction Fuzzy Hash: A8211971A40229AFEB209F91DC15FDAB7B8EB04710F1042D6FA1DB71D0DA716A54CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0131D720, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,00000000,00000000,0131C773), ref: 0131D760
MultiByteToWideChar.KERNEL32(00000000,00000000,00000062,000000FF,?,00000000), ref: 0131D775
RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,00000000,00020019,?), ref: 0131D796
RegQueryValueExW.ADVAPI32(?,?,00000000,00000004,00000000,00000004), ref: 0131D7C4
RegCloseKey.ADVAPI32(?), ref: 0131D7D9

Strings

SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement, xrefs: 0131D78C

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ByteCharMultiWide$CloseOpenQueryValue
String ID: SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
API String ID: 2332129513-717607756
Opcode ID: fcf0dfdd22717afbc26eb60dce939f8a5d6878e6b2b18bd029e3bd71612c9c6c
Instruction ID: c3eab9686df111f834387b151f18d7f5a9d6145ee21c8d7251a05e433d012ced
Opcode Fuzzy Hash: fcf0dfdd22717afbc26eb60dce939f8a5d6878e6b2b18bd029e3bd71612c9c6c
Instruction Fuzzy Hash: 1D210771A00229AFEB209F91DC15FDAB7B8AB04710F1042D6FA0DB6190DA706A84CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0148A410, Relevance: 10.5, APIs: 4, Strings: 3, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(0131C773,0172EB67,?,00000000,?,0131C753,?), ref: 0148A428
lstrcpyA.KERNEL32(0131C753,0172EBF6,?,0131C753,?), ref: 0148A434
lstrcpyA.KERNEL32(0131C773,ACRO,?,0131C753,?), ref: 0148A467
lstrcpyA.KERNEL32(0131C753,00000000,?,0131C753,?), ref: 0148A474

Strings

APRO, xrefs: 0148A447
APEX, xrefs: 0148A455
ACRO, xrefs: 0148A461

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: lstrcpy
String ID: ACRO$APEX$APRO
API String ID: 3722407311-2711017224
Opcode ID: b60a3e1ac4da1a06b3f972d3fe4899c5b899fab56274fb3a66b25d0ba935607e
Instruction ID: c6ba1efc36dd45870e6df40cb6aaef44bfd3efedcf7a4f8d739de504785326b0
Opcode Fuzzy Hash: b60a3e1ac4da1a06b3f972d3fe4899c5b899fab56274fb3a66b25d0ba935607e
Instruction Fuzzy Hash: A5F0B470140226779B203E1AEC18CAEF668AB45A60720822FF10AF3564DFB061534FD5

Uniqueness

Uniqueness Score: -1.00%

Function 01602A06, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(8304488B,015E77B1,00000000), ref: 01602A4E
__fassign.LIBCMT ref: 01602C2D
__fassign.LIBCMT ref: 01602C4A
WriteFile.KERNEL32(?,00000010,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 01602C92
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 01602CD2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 01602D7E

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 6b0099b9d8e168360ae1d777fe7e6237b755eebeee67491433962c1643b3bd38
Instruction ID: 612996718f20f6601253ac596336819605222564f0f90d430db4b41bcd5e776c
Opcode Fuzzy Hash: 6b0099b9d8e168360ae1d777fe7e6237b755eebeee67491433962c1643b3bd38
Instruction Fuzzy Hash: EBD1BC75D002599FCB1ACFA8C8949EEBBB5BF48314F28415EE815BB381D730AD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01323BF0, Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 01323C20
std::_Lockit::_Lockit.LIBCPMT ref: 01323C42
std::_Lockit::~_Lockit.LIBCPMT ref: 01323C6A
__Getctype.LIBCPMT ref: 01323D40
std::_Facet_Register.LIBCPMT ref: 01323D7E
std::_Lockit::~_Lockit.LIBCPMT ref: 01323DDE

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: d59579120bb63c1d6297576524b67c4a332560712608f660a8169009de1a88bb
Instruction ID: 9a0958dfedfb09da046352b2a6e67926e32e87e0985de5b63c61db22e63b14de
Opcode Fuzzy Hash: d59579120bb63c1d6297576524b67c4a332560712608f660a8169009de1a88bb
Instruction Fuzzy Hash: 1C619FB1A0022ADFDF11DF98C944BAEBBB4FF54718F144059D815AB341EB79AA05CB81

Uniqueness

Uniqueness Score: -1.00%

Function 01325370, Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 01323E00: std::_Lockit::_Lockit.LIBCPMT ref: 01323E34
Part of subcall function 01323E00: std::_Lockit::_Lockit.LIBCPMT ref: 01323E54
Part of subcall function 01323E00: std::_Lockit::~_Lockit.LIBCPMT ref: 01323E7C
Part of subcall function 01323E00: std::_Lockit::~_Lockit.LIBCPMT ref: 01323FC4

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0132560D

Strings

ios_base::eofbit set, xrefs: 01325542
2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271, xrefs: 01325385
ios_base::badbit set, xrefs: 01325534, 01325559, 01325592
ios_base::failbit set, xrefs: 0132553D

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Ios_base_dtorstd::ios_base::_
String ID: 2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1566447432-3405666089
Opcode ID: 0c4dfcfb0f5e7414b4eede14312f230ceaeae88c464b4f8391bc073365d655c2
Instruction ID: a494e16e402b08ebb83abb0d52a8d2bb6cbbbbef4ead53862f679c1e9934a5b2
Opcode Fuzzy Hash: 0c4dfcfb0f5e7414b4eede14312f230ceaeae88c464b4f8391bc073365d655c2
Instruction Fuzzy Hash: 0E816CB5A00219DFDB10DF98D880AADBBF8FF48314F14419EE916AB351D735AE01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01324C20, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 186COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 01324DF2

Strings

ios_base::eofbit set, xrefs: 01324D7A
2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271, xrefs: 01324DC3
ios_base::badbit set, xrefs: 01324D6B, 01324D94, 01324DC2
ios_base::failbit set, xrefs: 01324D75

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ___std_exception_copy
String ID: 2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2659868963-3405666089
Opcode ID: 0fd5e60f6b6c94bf2caff7c2dece5cd5fab5ff7de11c0558aeabe4ceedadff79
Instruction ID: 9299cf6effb278967b959185983155fc5ee009e262c1fc05e59cb6f9cd8909bf
Opcode Fuzzy Hash: 0fd5e60f6b6c94bf2caff7c2dece5cd5fab5ff7de11c0558aeabe4ceedadff79
Instruction Fuzzy Hash: 3A61BE75A00619EFCB10DF58D984B99BBF8FF09324F1481AAE915AB352D774AE00CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0131C600, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0131C65C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104), ref: 0131C678
SetCurrentDirectoryW.KERNEL32(?), ref: 0131C69C
SetCurrentDirectoryW.KERNEL32(?), ref: 0131C762

Strings

\amt_assets, xrefs: 0131C6C7

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CurrentDirectory$ByteCharMultiWide
String ID: \amt_assets
API String ID: 1927298138-3216911787
Opcode ID: e6ad44c20258e0da3c2ccdd7d3d2e3b9fa4eb80762fac41c82c366d682caddf3
Instruction ID: c287b4d0a35810ed742ddca0075ed617daa564724448d9fd7f4b969d78f82f7f
Opcode Fuzzy Hash: e6ad44c20258e0da3c2ccdd7d3d2e3b9fa4eb80762fac41c82c366d682caddf3
Instruction Fuzzy Hash: 23411A72A8021D5FDB24EB689C45FDE73ACAB64714F040596F654EB184DBB09A848B90

Uniqueness

Uniqueness Score: -1.00%

Function 0131C110, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72stringCOMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32(C:\,?,00000105,00000000,00000000,00000000,?,00000105,?,?,?,?,?,00000000), ref: 0131C1A0
lstrlenW.KERNEL32(00000208,?,?,?,?,?,00000000), ref: 0131C1BF

Strings

TsnIorcAeBoda, xrefs: 0131C1DA
thsnYaVieBoda, xrefs: 0131C1E1
C:\, xrefs: 0131C19B

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: InformationVolumelstrlen
String ID: C:\$TsnIorcAeBoda$thsnYaVieBoda
API String ID: 2744656266-46497372
Opcode ID: 57d4189f6ee89193322307da4d084641a9fa6e0db3b8e17eb5d62c8d832dff27
Instruction ID: ae053a5a88acfe92147da912f44b6a70a7a1938881fabc2b9fd21a174b36e26a
Opcode Fuzzy Hash: 57d4189f6ee89193322307da4d084641a9fa6e0db3b8e17eb5d62c8d832dff27
Instruction Fuzzy Hash: 9C21D4B1A8021DABEB21DF54CC45FDE77BCAB15708F800095F604E6185DBB09A848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 01320140, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(80000001,Software\Adobe\Adobe Acrobat\DC\AdobeViewer,00000000,00000000,00000000,00000002,00000000,0131C8B5,00000000), ref: 0132016C
RegSetValueExW.ADVAPI32(00000000,EULAAcceptedForBrowser,00000000,00000004,00000001,00000004,00000000), ref: 0132018F
RegCloseKey.ADVAPI32(00000000), ref: 0132019A

Strings

Software\Adobe\Adobe Acrobat\DC\AdobeViewer, xrefs: 0132015D
EULAAcceptedForBrowser, xrefs: 01320187

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CloseCreateValue
String ID: EULAAcceptedForBrowser$Software\Adobe\Adobe Acrobat\DC\AdobeViewer
API String ID: 1818849710-3804961394
Opcode ID: d39130529e80edcd1bd2d49b53ddbdd3934fd6d8c1b0e0c816cd922a4575382c
Instruction ID: 4f53155c8a58e328b843e4dc5b03def0c42166ad29f3ffc6d296a17840e74bc6
Opcode Fuzzy Hash: d39130529e80edcd1bd2d49b53ddbdd3934fd6d8c1b0e0c816cd922a4575382c
Instruction Fuzzy Hash: 33F01235A80308BAEB309E90AD0AFD97BA89B01B15F204194FF04B61D0D7B16A24D795

Uniqueness

Uniqueness Score: -1.00%

Function 013201D0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(0131C83D,Software\Adobe\Adobe Acrobat\DC\AdobeViewer,00000000,00000000,00000000,00000002,00000000,?,00000000), ref: 013201FC
RegSetValueExW.ADVAPI32(00000000,Launched,00000000,00000004,00000001,00000004), ref: 0132021F
RegCloseKey.ADVAPI32(00000000), ref: 0132022A

Strings

Software\Adobe\Adobe Acrobat\DC\AdobeViewer, xrefs: 013201ED
Launched, xrefs: 01320217

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CloseCreateValue
String ID: Launched$Software\Adobe\Adobe Acrobat\DC\AdobeViewer
API String ID: 1818849710-41317194
Opcode ID: ab9d8fba567f5d40d2de46dc77483c23af7bec4d5d2eed80ddb883868fd15f49
Instruction ID: e1beed71e09bf33d5432a01f6ce4d31c728ffcf036770f5e16dc93a0ed9d7f2d
Opcode Fuzzy Hash: ab9d8fba567f5d40d2de46dc77483c23af7bec4d5d2eed80ddb883868fd15f49
Instruction Fuzzy Hash: D1F01275A80308BAEB309E90AD0AFD97BB8EB01B15F104194FF04B61D0D6B15A14D799

Uniqueness

Uniqueness Score: -1.00%

Function 01471470, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,73B77610,?,014718D9,00000000,00000000,00000002,Comctl32.dll,00000040), ref: 0147148C
GetProcAddress.KERNEL32(73B60000,FindActCtxSectionStringW), ref: 014714A1
FindActCtxSectionStringW.KERNEL32(?,014718D9,00000000,00000000,00000002,Comctl32.dll,00000040), ref: 014714D1

Strings

Kernel32.dll, xrefs: 01471487
FindActCtxSectionStringW, xrefs: 0147149B

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: AddressFindHandleModuleProcSectionString
String ID: FindActCtxSectionStringW$Kernel32.dll
API String ID: 1814600871-2752986935
Opcode ID: 65819728f3db6a554f14e7259b0c1b6bd199e6e9b5a86547f91c99ce89a8fdf5
Instruction ID: 1300d3ea8a6f0a7685c5cae714f66b1fd78f67cc2eb79c054526d55396031a8b
Opcode Fuzzy Hash: 65819728f3db6a554f14e7259b0c1b6bd199e6e9b5a86547f91c99ce89a8fdf5
Instruction Fuzzy Hash: E8F01272A45229ABCB329FB5BC149AB3F69FB04AB57009026FD0596325D7359820DB90

Uniqueness

Uniqueness Score: -1.00%

Function 014713B0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,00000028,?,01471610,00000028,?,01471539,00000000), ref: 014713CC
GetProcAddress.KERNEL32(73B60000,ActivateActCtx), ref: 014713E1
ActivateActCtx.KERNEL32(?,01471610,00000028,?,01471539,00000000), ref: 01471408

Strings

Kernel32.dll, xrefs: 014713C7
ActivateActCtx, xrefs: 014713DB

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ActivateAddressHandleModuleProc
String ID: ActivateActCtx$Kernel32.dll
API String ID: 722951063-1680618737
Opcode ID: 4bf4a82a38006969c362c8ade6b5d9d85f1ed7b0dea8d8c333ce0ced9983df5b
Instruction ID: 80682fbb4b79920204233890cbe535e714e911eab65398ef96ff6c8606847650
Opcode Fuzzy Hash: 4bf4a82a38006969c362c8ade6b5d9d85f1ed7b0dea8d8c333ce0ced9983df5b
Instruction Fuzzy Hash: 99F08272B06229AB9B315FB9BD1499B7FACFB04AB57009027FC04D6A24D7309810CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01471410, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,00000000,?,014715BE,00000000,00000000,01471572), ref: 0147142C
GetProcAddress.KERNEL32(73B60000,DeactivateActCtx), ref: 01471441
DeactivateActCtx.KERNEL32(?,014715BE,00000000,00000000,01471572), ref: 01471468

Strings

Kernel32.dll, xrefs: 01471427
DeactivateActCtx, xrefs: 0147143B

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: AddressDeactivateHandleModuleProc
String ID: DeactivateActCtx$Kernel32.dll
API String ID: 2931768472-3029746753
Opcode ID: 90debe412d3335398d7e5872735cd55eb196d13dc143f8748189d05408a5a956
Instruction ID: 5a804dc470d52dc93a4858d801fb30bb3ab7c5b8833414bfc8d9c0b80a5b8546
Opcode Fuzzy Hash: 90debe412d3335398d7e5872735cd55eb196d13dc143f8748189d05408a5a956
Instruction Fuzzy Hash: 9EF08272B066299B8B315FB5BC5499B7F6CFB04AB57009027FC09E6224D7309810DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 015FD341, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,015FD336,?,?,015FD2FE,?,?,?), ref: 015FD356
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 015FD369
FreeLibrary.KERNEL32(00000000,?,?,015FD336,?,?,015FD2FE,?,?,?), ref: 015FD38C

Strings

CorExitProcess, xrefs: 015FD361
mscoree.dll, xrefs: 015FD34F

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b48d4c4cf5d7bc0e834aac310f1a7224e059a04749478a5190dc38ae1bff6095
Instruction ID: def3be8675c6eb4b09c565482a7dc2274d52548597379a7024bb26d817571d4b
Opcode Fuzzy Hash: b48d4c4cf5d7bc0e834aac310f1a7224e059a04749478a5190dc38ae1bff6095
Instruction Fuzzy Hash: 86F08235501219FBDB219FD5ED1AB9EBE7DFB04755F144098EA05A11A0CB708E10DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01605F27, Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 01605FA9
_free.LIBCMT ref: 01605FCD
_free.LIBCMT ref: 0160615A
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,01765598), ref: 0160616C
_free.LIBCMT ref: 01606326

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: f56b03d5ae2198ed11523face8255015867e93b1517ba58443327a2e69377d3f
Instruction ID: 3a0b2314b110d2299a16db4566f23cf5f1633dc9091bc83344835a1dc6b9b88f
Opcode Fuzzy Hash: f56b03d5ae2198ed11523face8255015867e93b1517ba58443327a2e69377d3f
Instruction Fuzzy Hash: 08C1277190021AABDB2BEF6CCD40AAB7BBAEF55360F1440ADE542973C1E7319A41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 015FF512, Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 016012FA: RtlAllocateHeap.NTDLL(00000000,?,?,?,01492F10,?,?,?,?,01311010,000000E0), ref: 0160132C

_free.LIBCMT ref: 015FF621
_free.LIBCMT ref: 015FF638
_free.LIBCMT ref: 015FF655
_free.LIBCMT ref: 015FF670
_free.LIBCMT ref: 015FF687

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 0ebe317c75d651874d820cd8f9728299d5b719348a3f37215fd96554f46f4bf3
Instruction ID: e68e7e6918025ad4cc05b6dcbfccabda50d858ddf4879c7370454d9c86ee1ff9
Opcode Fuzzy Hash: 0ebe317c75d651874d820cd8f9728299d5b719348a3f37215fd96554f46f4bf3
Instruction Fuzzy Hash: 5651B373A00205AFDB25DF69CC40A6A77F5FF58720F14456EEA06DB6A0EB31EA01CB44

Uniqueness

Uniqueness Score: -1.00%

Function 01323A00, Relevance: 7.6, APIs: 5, Instructions: 147COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 01323A34
std::_Lockit::_Lockit.LIBCPMT ref: 01323A54
std::_Lockit::~_Lockit.LIBCPMT ref: 01323A7C
std::_Facet_Register.LIBCPMT ref: 01323B74
std::_Lockit::~_Lockit.LIBCPMT ref: 01323BD1

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 223d8467dfa91a93bc3485d0fad8bc5b022d6c2da718cb04579ae6bf6289d493
Instruction ID: 9a09d659f482fd9dc06169d9e9c00858198e56ee7aaa44f7aaa7d412349f4c39
Opcode Fuzzy Hash: 223d8467dfa91a93bc3485d0fad8bc5b022d6c2da718cb04579ae6bf6289d493
Instruction Fuzzy Hash: EA51C170A01219DFEB11DF98C984BAEBBB4FF58318F14846DD8056B381DB79AE05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01323E00, Relevance: 7.6, APIs: 5, Instructions: 145COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 01323E34
std::_Lockit::_Lockit.LIBCPMT ref: 01323E54
std::_Lockit::~_Lockit.LIBCPMT ref: 01323E7C
std::_Facet_Register.LIBCPMT ref: 01323F67
std::_Lockit::~_Lockit.LIBCPMT ref: 01323FC4

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: eb62a8b775cb528ad9ffe8300242188ef3bd0830b6af5f354003ecf705fbdb8f
Instruction ID: 39055dd5001b7b0c63c6e70a4c388d243d5546a6a6e7a140a7192ddacd407ca3
Opcode Fuzzy Hash: eb62a8b775cb528ad9ffe8300242188ef3bd0830b6af5f354003ecf705fbdb8f
Instruction Fuzzy Hash: 6C51D171A00329DFDB11DF98C984BAEBBB4FF58318F14405DD845AB381D779AA09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0160A0D7, Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0160A0EF

Part of subcall function 016015D5: HeapFree.KERNEL32(00000000,00000000,?,015FDDD3), ref: 016015EB
Part of subcall function 016015D5: GetLastError.KERNEL32(?,?,015FDDD3), ref: 016015FD

_free.LIBCMT ref: 0160A101
_free.LIBCMT ref: 0160A113
_free.LIBCMT ref: 0160A125
_free.LIBCMT ref: 0160A137

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0eeb3679ef2ee13346b2c0cf8cc9710b3e65ab6e1f166f631eebdf0a48bd5615
Instruction ID: 4c8ebce3db6bff24d6c2552c12ef80254096894af3efa72c77dfbdbcfa2f1380
Opcode Fuzzy Hash: 0eeb3679ef2ee13346b2c0cf8cc9710b3e65ab6e1f166f631eebdf0a48bd5615
Instruction Fuzzy Hash: 81F0AF720042016B923AEA99FC94C1777FAAA443B0758480DF146DBA80CF30F8C08764

Uniqueness

Uniqueness Score: -1.00%

Function 015F6D64, Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 375COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 015F6EEA
__freea.LIBCMT ref: 015F6F06

Strings

a/p, xrefs: 015F6FCE
am/pm, xrefs: 015F6F6A

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: 02744503f0ec11e1fdaccc06a88a572f1909a21bbc487315a7f58bb1e978d8f2
Instruction ID: e342fa6169532a481b934d3cdffdd7637f95f593df2d58410098eccc398e98b9
Opcode Fuzzy Hash: 02744503f0ec11e1fdaccc06a88a572f1909a21bbc487315a7f58bb1e978d8f2
Instruction Fuzzy Hash: EDC1CD35900216DAEB259FACC994EBFBBB2FF1A700F18404DEB01AF254D3319945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0131E310, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0131E33B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0131E39E

Part of subcall function 015CE634: _Yarn.LIBCPMT ref: 015CE653
Part of subcall function 015CE634: _Yarn.LIBCPMT ref: 015CE677

___std_exception_copy.LIBVCRUNTIME ref: 0131E411

Strings

bad locale name, xrefs: 0131E3C1

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::____std_exception_copy
String ID: bad locale name
API String ID: 951334191-1405518554
Opcode ID: 50239358b228be09d337de703cf990b6e40ff19a898bde8cc0f904be9ddb6033
Instruction ID: d1b0206da5cdee4ee48cb838e0302f7112df3b6e60bfbc3589afc53feabcbfa9
Opcode Fuzzy Hash: 50239358b228be09d337de703cf990b6e40ff19a898bde8cc0f904be9ddb6033
Instruction Fuzzy Hash: A541A0B1904784EFD720CF68C904B8BBFF8EB15724F108A5EE85597780E3B5AA04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 015E13F9, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(?,015CF0EE,?,013282CC), ref: 015E141B
SetLastError.KERNEL32(0000000D,?,015CF0EE,?,013282CC,?,00000000,?,01323944,017D0460,01323960,017D0464,01328468,?,013282CC,?), ref: 015E1479

Strings

ios_base::failbit set, xrefs: 015E13FC

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Once$ErrorExecuteInitLast
String ID: ios_base::failbit set
API String ID: 3407056439-3924258884
Opcode ID: c195195294078fbbd536c4db61532759c1021da4eda19a250407dac4dee56234
Instruction ID: 71ef8c2aceb6721696b81f96739fcd4109fb921d597d92359ab5bdef71a8d853
Opcode Fuzzy Hash: c195195294078fbbd536c4db61532759c1021da4eda19a250407dac4dee56234
Instruction Fuzzy Hash: 8411C832700129AFDF265E64DC885AEBBE9FF48751B008039FA55DA310D7708C118BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0131C220, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,Global\ARM Update Mutex,0131C1CF,?,?,?,?,?,00000000), ref: 0131C22C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0131C237
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 0131C243

Strings

Global\ARM Update Mutex, xrefs: 0131C220

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CloseErrorHandleLastMutexOpen
String ID: Global\ARM Update Mutex
API String ID: 4249120315-3247037459
Opcode ID: 8716ea50f7da85f4943c8f2725fd084987ad71da8239d4f68cd06de592555a93
Instruction ID: b703af6d6d2e731f4f44971702b72167dd4976480176478d4096295fe4e1186b
Opcode Fuzzy Hash: 8716ea50f7da85f4943c8f2725fd084987ad71da8239d4f68cd06de592555a93
Instruction Fuzzy Hash: D6D012707803015BDF7116B4BC1D7563558A704F46F5034D4F105E10DCEB94C451C760

Uniqueness

Uniqueness Score: -1.00%

Function 0131C260, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(00100000,00000000,Global\Acro Update Mutex,0131C2B2), ref: 0131C26C
CloseHandle.KERNEL32(00000000), ref: 0131C277
GetLastError.KERNEL32 ref: 0131C283

Strings

Global\Acro Update Mutex, xrefs: 0131C260

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CloseErrorHandleLastMutexOpen
String ID: Global\Acro Update Mutex
API String ID: 4249120315-954496354
Opcode ID: 38b0f1ba56b354abbcdf9861debfc21f0d49bee0336323c474b0ac875efa2594
Instruction ID: 88b6bf52292a0ae85dd62e2ad834310c498d06bc1e48c9adf9d933bb50d0c13e
Opcode Fuzzy Hash: 38b0f1ba56b354abbcdf9861debfc21f0d49bee0336323c474b0ac875efa2594
Instruction Fuzzy Hash: 8ED0127078030157DF7116B4BC5D7563558B700F46F5034D4F109E10ECDB98C411C760

Uniqueness

Uniqueness Score: -1.00%

Function 01604CC1, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 01604D48

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 6617e7864c7d08f008faa25ec7d3b74228eea2198e77ec31322edf05b9142cbc
Instruction ID: 461096fc1fdd983fa34d8e48c9d97c4bea4aae5b27e5b9e496ce7c57e2898fea
Opcode Fuzzy Hash: 6617e7864c7d08f008faa25ec7d3b74228eea2198e77ec31322edf05b9142cbc
Instruction Fuzzy Hash: FDB1F2329042469FDB2ACF6CCC807AFBBE5EF95250F1441AADA559B3C1DB349D02CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0131C780, Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0131C7EC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104), ref: 0131C807
SetCurrentDirectoryW.KERNEL32(?), ref: 0131C832
SetCurrentDirectoryW.KERNEL32(?), ref: 0131C8BC

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CurrentDirectory$ByteCharMultiWide
String ID:
API String ID: 1927298138-0
Opcode ID: c1560a30c5ad67b30e6236c135f5d9b2dd45a152001060cc5d6ed1e0f4d2d0f6
Instruction ID: e56169ef3abe158526d2b9b9b2f53b7b556e268b70a17bf876ce26ca67d12751
Opcode Fuzzy Hash: c1560a30c5ad67b30e6236c135f5d9b2dd45a152001060cc5d6ed1e0f4d2d0f6
Instruction Fuzzy Hash: 3C31FBB1A0011D9BDB20EF69DC84BDDB7B8EF54314F5045EAFA18A7155DA708D808BA4

Uniqueness

Uniqueness Score: -1.00%

Function 015EB9B8, Relevance: 6.1, APIs: 4, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40fe6a7217d7f030423dd041db857c62228e184ba07e4a44c0bb38cbc6b55577
Instruction ID: bbac3984c13a21dc2a95c9cd95c796defaf6453cdbf002a06527a3d494ea1119
Opcode Fuzzy Hash: 40fe6a7217d7f030423dd041db857c62228e184ba07e4a44c0bb38cbc6b55577
Instruction Fuzzy Hash: 6A218072A04117AFDF29AE65DC8896F77EDFF402667004515F425DA190EB71EC5087A0

Uniqueness

Uniqueness Score: -1.00%

Function 01601099, Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,015EC205,017BD120,0000000C), ref: 0160109E
_free.LIBCMT ref: 016010FB
_free.LIBCMT ref: 01601131
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,015EC205,017BD120,0000000C), ref: 0160113C

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: b0128e6ee27583bc414a3f22f2845d3dde0c03a74164d6a5e13d5e00ab9c993c
Instruction ID: ad2931289ca9abf2574d9a0ef00de93172b029f85fc931ac72158dd65bed3e8d
Opcode Fuzzy Hash: b0128e6ee27583bc414a3f22f2845d3dde0c03a74164d6a5e13d5e00ab9c993c
Instruction Fuzzy Hash: E811CA323005066F963F76B9EC94D3B266E9BC33B6714052CF326962D4EE61CC028764

Uniqueness

Uniqueness Score: -1.00%

Function 016011F0, Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,015EC561,016015FB,?,?,015FDDD3), ref: 016011F5
_free.LIBCMT ref: 01601252
_free.LIBCMT ref: 01601288
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,015EC561,016015FB,?,?,015FDDD3), ref: 01601293

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 564303206e05e028912a795aa7f3eae6c5bc455a435e1eb0d763856ec2fbfc45
Instruction ID: 87015d36e2c5ddbbd661523198909e35656a4afd07c26bbae604b94f3e6904a5
Opcode Fuzzy Hash: 564303206e05e028912a795aa7f3eae6c5bc455a435e1eb0d763856ec2fbfc45
Instruction Fuzzy Hash: FA11E5B23002066FD72B66B9AC94D3B276EABD73B5714822DF615D62D4EE21CC824364

Uniqueness

Uniqueness Score: -1.00%

Function 01330280, Relevance: 6.0, APIs: 4, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,0148A314,00000000,00020006,00000000,00000000,?,0148A497,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,bZHCNLocale,0148A314,?,0148A314,00000000), ref: 01330297
RegCreateKeyExW.ADVAPI32(80000001,0148A314,00000000,00000000,00000000,0002001F,00000000,00000000,00000000,?,0148A497,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,bZHCNLocale,0148A314,?,0148A314), ref: 013302BC
RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,0148A314,00000004,?,0148A497,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,bZHCNLocale,0148A314,?,0148A314,00000000), ref: 013302D6
RegCloseKey.ADVAPI32(00000000,?,0148A497,SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement,bZHCNLocale,0148A314,?,0148A314,00000000,?,?,00000000), ref: 013302DF

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CloseCreateOpenValue
String ID:
API String ID: 776291540-0
Opcode ID: 78447c2e3ff9ed1a2271b9b4590bbf0d085b9b92a7a14b32241376e009bf8a20
Instruction ID: d7e222e210848be5747c0d9fc88445b1d280a62b45ad76cafd6f13a7f569d8d6
Opcode Fuzzy Hash: 78447c2e3ff9ed1a2271b9b4590bbf0d085b9b92a7a14b32241376e009bf8a20
Instruction Fuzzy Hash: FFF01D35680308FBFB318E90EC16FA97B69EB04B40F204054FB04E90E1D6B19620DB98

Uniqueness

Uniqueness Score: -1.00%

Function 01610F77, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(015E77B1,015CFB87,?,00000000,015E77B1,?,0160DDC4,015E77B1,00000001,015E77B1,015E77B1,?,01602DDB,00000000,8304488B,015E77B1), ref: 01610F8E
GetLastError.KERNEL32(?,0160DDC4,015E77B1,00000001,015E77B1,015E77B1,?,01602DDB,00000000,8304488B,015E77B1,00000000,015E77B1,?,0160332F,00000010), ref: 01610F9A

Part of subcall function 01610F60: CloseHandle.KERNEL32(FFFFFFFE,01610FAA,?,0160DDC4,015E77B1,00000001,015E77B1,015E77B1,?,01602DDB,00000000,8304488B,015E77B1,00000000,015E77B1), ref: 01610F70

___initconout.LIBCMT ref: 01610FAA

Part of subcall function 01610F22: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,01610F51,0160DDB1,015E77B1,?,01602DDB,00000000,8304488B,015E77B1,00000000), ref: 01610F35

WriteConsoleW.KERNEL32(015E77B1,015CFB87,?,00000000,?,0160DDC4,015E77B1,00000001,015E77B1,015E77B1,?,01602DDB,00000000,8304488B,015E77B1,00000000), ref: 01610FBF

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3f708b40659f5f2961067ac80dce7ae35764b242667a8ddf49263f0e5f13915d
Instruction ID: cd3a396cdb45a6e7adb8d2c3949311ad5f3d76aa3bf05e8692c35dbca4181dda
Opcode Fuzzy Hash: 3f708b40659f5f2961067ac80dce7ae35764b242667a8ddf49263f0e5f13915d
Instruction Fuzzy Hash: C9F01C36901259BFCF222FA9EC0599A3F67FF083B0B149054FE08D6129D73289709BA0

Uniqueness

Uniqueness Score: -1.00%

Function 015CC632, Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,015CC5CF,00000064), ref: 015CC655
LeaveCriticalSection.KERNEL32(017D4FBC,00000002,?,015CC5CF,00000064,?,013C13CC,017D0718,7DFC34E3,00000000,0164098C,000000FF,?,013C2FBD,?,0163FD9B), ref: 015CC65F
WaitForSingleObjectEx.KERNEL32(00000002,00000000,?,015CC5CF,00000064,?,013C13CC,017D0718,7DFC34E3,00000000,0164098C,000000FF,?,013C2FBD,?,0163FD9B), ref: 015CC670
EnterCriticalSection.KERNEL32(017D4FBC,?,015CC5CF,00000064,?,013C13CC,017D0718,7DFC34E3,00000000,0164098C,000000FF,?,013C2FBD,?,0163FD9B,?), ref: 015CC677

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 86c250d9d576763711b65252823106b147e8f8d6b1bbe8b7927e953826a1d280
Instruction ID: 63df0eed9adf30353efd2cb974daf270753ba25c940a6a1c7f62530af611723e
Opcode Fuzzy Hash: 86c250d9d576763711b65252823106b147e8f8d6b1bbe8b7927e953826a1d280
Instruction Fuzzy Hash: 13E09232505228BBCB212F85FD1CA8EBFB9BB0AA61B0850D9F90A66534C7701C618BC0

Uniqueness

Uniqueness Score: -1.00%

Function 015FDBF2, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 015FDC60
_free.LIBCMT ref: 015FDC80

Strings

{"chainedWorkflow" : false, "entryResourceId" : "%s", "entryQueryString" : "%s", "id" : "%s", "instanceId" : "<guid>", "interceptUrl" : "https://oobe.adobe.com/", "type" : "%s", "version" : %d, "workflowIdCode" : %d}, xrefs: 015FDC00

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _free
String ID: {"chainedWorkflow" : false, "entryResourceId" : "%s", "entryQueryString" : "%s", "id" : "%s", "instanceId" : "<guid>", "interceptUrl" : "https://oobe.adobe.com/", "type" : "%s", "version" : %d, "workflowIdCode" : %d}
API String ID: 269201875-2169768307
Opcode ID: cbf921fc2e1b8ee1c7f947533fa47ab3e49fd8f37a3c82b1eabe74941acbcb01
Instruction ID: 4232746aa9b64661f30c7eef10b9e8c948e6c8c13f5864ff46869f153626f812
Opcode Fuzzy Hash: cbf921fc2e1b8ee1c7f947533fa47ab3e49fd8f37a3c82b1eabe74941acbcb01
Instruction Fuzzy Hash: 6541A036A00205AFDB24DFA8C980A6EB7F6FF89714B15456DD616EF381DB71E901CB80

Uniqueness

Uniqueness Score: -1.00%

Function 015EBD28, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 015EBDF9
_free.LIBCMT ref: 015EBE09

Strings

ios_base::failbit set, xrefs: 015EBDA0

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: _free
String ID: ios_base::failbit set
API String ID: 269201875-3924258884
Opcode ID: 2908372ded9ae887122bd55f7350047283e500cdef2ab58d07e9270d0c5c2b6b
Instruction ID: 3d3147431640111c5e046f1b59a6bacc4e05658a6fc7e5dcc5fc8dd3331191d0
Opcode Fuzzy Hash: 2908372ded9ae887122bd55f7350047283e500cdef2ab58d07e9270d0c5c2b6b
Instruction Fuzzy Hash: 4D318471C0024AEFDF1ADF99C984ADEBFF5BF59211F14406AE910AB250D7319A11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015CFABE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 015CFA26: __EH_prolog3_GS.LIBCMT ref: 015CFA2D

Part of subcall function 015E219C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0131CECC,?,?,?,0131CECC,?,0177FF78), ref: 015E21FC

std::_Xfsopen.LIBCPMT ref: 015CFB4B
std::_Xfsopen.LIBCPMT ref: 015CFB6B

Strings

2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271, xrefs: 015CFAC4, 015CFAD5, 015CFAFD

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: Xfsopenstd::_$ExceptionH_prolog3_Raise
String ID: 2CFA9046A773DAC36A267C57BA2D87ABFB9793F7C57B462A88F893252D76A85E4DECB50E547BFD187591DD72A40330CD47B9B37E73439CE2D0E963A620E4D271
API String ID: 1716935052-2184126485
Opcode ID: 55630f5d017c24ca479344749231dfbaf224c94d16ac0dd1d65b6e8d627c3553
Instruction ID: e2674f73d5f3a824d0bc24c0ab334a5daa17a13233cc262619d52c3a1cb4522f
Opcode Fuzzy Hash: 55630f5d017c24ca479344749231dfbaf224c94d16ac0dd1d65b6e8d627c3553
Instruction Fuzzy Hash: E9210731A003176FEF285D9CDC25BAE7B9BBF51E68F08402EFE48AE050D724DD128690

Uniqueness

Uniqueness Score: -1.00%

Function 015E7ADA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 015E7BE8: _free.LIBCMT ref: 015E7BF6

Part of subcall function 0160488E: MultiByteToWideChar.KERNEL32(01609201,00000100,E8458D00,00000000,00000000,00000020,?,0160A8AA,00000000,00000000,00000100,00000020,00000000,00000000,E8458D00,00000100), ref: 016048FE

GetLastError.KERNEL32(?,?,?,?,?,?,7DFC34E3,01328351,?,00000000,?,?,00000006,7DFC34E3,00000006,00000000), ref: 015E7B3E
__dosmaperr.LIBCMT ref: 015E7B45

Strings

ios_base::failbit set, xrefs: 015E7ADF

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr_free
String ID: ios_base::failbit set
API String ID: 4030486722-3924258884
Opcode ID: 2443a789c406e8be4b5fb4b1de7e1b8dce78e408f66db0a2be3e17d65d567840
Instruction ID: 669eac4d12fcf3e4479dbd1d406db5832f5249062bd0395bbce82016d3b1124f
Opcode Fuzzy Hash: 2443a789c406e8be4b5fb4b1de7e1b8dce78e408f66db0a2be3e17d65d567840
Instruction Fuzzy Hash: D621C631D006166BDF2A9F198C04A5E77EDFF99230B104519EA299F190EB70E9108BD0

Uniqueness

Uniqueness Score: -1.00%

Function 01471650, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32.dll,?,0147176D,GetModuleHandleExW), ref: 01471661
GetProcAddress.KERNEL32(73B60000,0147176D), ref: 01471674

Strings

Kernel32.dll, xrefs: 0147165C

Memory Dump Source

Source File: 00000000.00000002.911285434.0000000001311000.00000020.00020000.sdmp, Offset: 01310000, based on PE: true

Associated: 00000000.00000002.911273292.0000000001310000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911695193.000000000166F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.911919196.00000000017C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911931712.00000000017C6000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.911940916.00000000017D0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911946359.00000000017D3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.911961446.00000000017D7000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1310000_acrotray.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Kernel32.dll
API String ID: 1646373207-1926710522
Opcode ID: b7981eb2a468d1e572b35ab130f69801744bf20b3e6863a3e1433201eed6b131
Instruction ID: ddad04cd82ec00b420c2d9106aec2c9604df152a85d1a3b38c24ffc90c7a6805
Opcode Fuzzy Hash: b7981eb2a468d1e572b35ab130f69801744bf20b3e6863a3e1433201eed6b131
Instruction Fuzzy Hash: F9D05EB63052099B97209FF9BD58AA37BACAB14A547049426F908C2524EB30E020DB24

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report acrotray.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Compliance:

Networking:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: acrotray.exe PID: 7056 Parent PID: 6072

General

File Activities

File Opened

File Attributes Queried

Volume Information Queried

Device IO

Section Activities

Sections loaded by Windows

Function 014715D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
COMMON

Function 01471690, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 171
libraryloaderCOMMON

Function 01321C00, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 140
registryCOMMON

Function 0131FDC0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97
registryCOMMON

Function 0131FA10, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60
registryCOMMON

Function 0131FBA0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41
registryCOMMON

Function 0131F8E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
registryCOMMON

Function 0131FCA0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
registryCOMMON

Function 015EC1E0, Relevance: 3.0, APIs: 2, Instructions: 39
threadCOMMON

Function 013CC440, Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Function 014714E0, Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 016018D5, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 016012FA, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE