Edit tour

Windows Analysis Report
FSCaptureSetup107.exe

Overview

General Information

Sample name:	FSCaptureSetup107.exe
Analysis ID:	1527895
MD5:	28627a37983f5dc8e00d9c03c7b2dec6
SHA1:	dcfdb2464c29de44c6df1c1c0f5cf4a5342cfadb
SHA256:	762463fe496836bc1e6c6a58703f45182575b29494753df3145cd5c563e07f8c
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Compliance

Score:	49
Range:	0 - 100

Signatures

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

FSCaptureSetup107.exe (PID: 5284 cmdline: "C:\Users\user\Desktop\FSCaptureSetup107.exe" MD5: 28627A37983F5DC8E00D9C03C7B2DEC6)

FSCapture.exe (PID: 5960 cmdline: "C:\Program Files (x86)\FastStone Capture\FSCapture.exe" MD5: D5AC941C445B6EB907D0B96D84F15FE7)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\FastStone Capture\FSCPlugin06.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\FastStone Capture\FSCPlugin04.dll	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\nsk6323.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Compliance

Uses 32bit PE files

Source: FSCaptureSetup107.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

Window detected: < &BackI &AgreeCancelwww.FastStone.org www.FastStone.orgLicense AgreementPlease review the license terms before installing FastStone Capture 10.7.Press Page Down to see the rest of the agreement.Please read the following terms and conditions carefully before using FastStone Capture. Use of FastStone Capture indicates you accept the terms of this license agreement and warranty.1. Disclaimer of WarrantyFastStone Capture (this software) is provided "as-is" and without warranty of any kind express implied or otherwise including without limitation any warranty of merchantability or fitness for a particular purpose. In no event shall the author of this software be held liable for data loss damages loss of profits or any other kind of loss while using or misusing this software.2. LicenseFastStone Capture is shareware. You may try it free for 30 days. Once this 30-day period has expired you must either purchase a license to use this software or uninstall it from your computer promptly.3. Restrictions on Use FastStone Capture must not be decompiled disassembled reverse engineered or otherwise modified. Copyright (C) 2024 FastStone Corporation. All rights reserved.If you accept the terms of the agreement click I Agree to continue. You must accept the agreement to install FastStone Capture 10.7.

Creates license or readme file

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\LicenseAgreement.txt			Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\LicenseAgreement.txt			Jump to behavior

PE / OLE file has a valid certificate

Source: FSCaptureSetup107.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: FSCaptureSetup107.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\hesha\Desktop\FSCPlugin07_V1_035\FastStone.Ocr\obj\Release\FSCPlugin07.pdb source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCPlugin07.exe.0.dr
Source:	Binary string: C:\Users\hesha\Desktop\FSCPlugin07_V1_035\FastStone.Ocr\obj\Release\FSCPlugin07.pdbxP source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCPlugin07.exe.0.dr

Spreading

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405D74
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Code function: 0_2_0040699E FindFirstFileW,FindClose,	0_2_0040699E
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B

Networking

Source: FSRecorder.exe.0.dr	String found in binary or memory: http://avisynth.org
Source: FSCaptureSetup107.exe, FSCrossHair.exe.0.dr, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCrossHair.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCrossHair.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: FSCaptureSetup107.exe, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: FSCaptureSetup107.exe, FSCrossHair.exe.0.dr, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: FSCaptureSetup107.exe, FSCrossHair.exe.0.dr, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: FSCaptureSetup107.exe, FSCrossHair.exe.0.dr, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCrossHair.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: FSCaptureSetup107.exe, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: FSCaptureSetup107.exe, FSCrossHair.exe.0.dr, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: FSRecorder.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCrossHair.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCrossHair.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: FSCaptureSetup107.exe, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCrossHair.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: FSCaptureSetup107.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: FSCaptureSetup107.exe, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: FSCaptureSetup107.exe, FSCrossHair.exe.0.dr, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: FSCaptureSetup107.exe, FSCrossHair.exe.0.dr, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCrossHair.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCrossHair.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: FSCaptureSetup107.exe, FSCrossHair.exe.0.dr, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: FSRecorder.exe.0.dr	String found in binary or memory: http://sourceforge.net/projects/gplmpgdec/
Source: FSRecorder.exe.0.dr	String found in binary or memory: http://www.axis.com/techsup/software/amc/index.htm
Source: FSRecorder.exe.0.dr	String found in binary or memory: http://www.datastead.com/WMScriptWriter
Source: FSRecorder.exe.0.dr	String found in binary or memory: http://www.datastead.com/WMScriptWriterU
Source: FSRecorder.exe.0.dr	String found in binary or memory: http://www.datastead.com/_download/WMFDist11.zip
Source: FSCaptureSetup107.exe, FSCrossHair.exe.0.dr, FSCPlugin07.exe.0.dr, FSCPlugin06.exe.0.dr, FSRecorder.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCrossHair.exe.0.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: FSCaptureSetup107.exe, 00000000.00000002.2337132344.00000000004FF000.00000004.00000020.00020000.00000000.sdmp, FSCaptureSetup107.exe, 00000000.00000003.2335936709.00000000004FD000.00000004.00000020.00020000.00000000.sdmp, Website.url.0.dr	String found in binary or memory: http://www.faststone.org
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.faststone.org/
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.faststone.org/FSCTutorial.htm
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.faststone.org/FSCTutorial.htmU
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.faststone.org/U
Source: FSRecorder.exe.0.dr	String found in binary or memory: http://www.matroska.org/
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.faststone.org/order.htm
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.faststone.org/order.htmU

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

Code function: 0_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405809

System Summary

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

Code function: 0_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403640

Detected potential crypto function

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Code function: 0_2_00406D5F	0_2_00406D5F
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077DFB4F	4_2_077DFB4F
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077DE3C8	4_2_077DE3C8
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077D6A59	4_2_077D6A59
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077DAE47	4_2_077DAE47
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077D1A30	4_2_077D1A30
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077DEAC0	4_2_077DEAC0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077D4A85	4_2_077D4A85
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077DDE84	4_2_077DDE84
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077DD940	4_2_077DD940
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10023030	4_2_10023030
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1003F050	4_2_1003F050
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10007070	4_2_10007070
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001C0D6	4_2_1001C0D6
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001C0D8	4_2_1001C0D8
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10016190	4_2_10016190
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_100131A0	4_2_100131A0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_100451A0	4_2_100451A0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_100221D0	4_2_100221D0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10021200	4_2_10021200
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10037200	4_2_10037200
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10064234	4_2_10064234
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10016270	4_2_10016270
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10020270	4_2_10020270
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1004A280	4_2_1004A280
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001E299	4_2_1001E299
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001F2B0	4_2_1001F2B0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10007330	4_2_10007330
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10016340	4_2_10016340
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1004E340	4_2_1004E340
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10001430	4_2_10001430
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10022507	4_2_10022507
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10022509	4_2_10022509
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1002152C	4_2_1002152C
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10033530	4_2_10033530
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10047540	4_2_10047540
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001F5C4	4_2_1001F5C4
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001F5C6	4_2_1001F5C6
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001B5E0	4_2_1001B5E0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10007620	4_2_10007620
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1003D650	4_2_1003D650
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10042680	4_2_10042680
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001C710	4_2_1001C710
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10013730	4_2_10013730
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10066732	4_2_10066732
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10007738	4_2_10007738
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10064778	4_2_10064778
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001D780	4_2_1001D780
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_100117E0	4_2_100117E0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_100237F0	4_2_100237F0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10033800	4_2_10033800
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1000D840	4_2_1000D840
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001B858	4_2_1001B858
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_100338B9	4_2_100338B9
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1005D8E0	4_2_1005D8E0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_100348F0	4_2_100348F0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10005950	4_2_10005950
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001C96C	4_2_1001C96C
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_100489B0	4_2_100489B0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10021A00	4_2_10021A00
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10042A10	4_2_10042A10
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10020A30	4_2_10020A30
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10006A90	4_2_10006A90
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001FA90	4_2_1001FA90
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10058AD0	4_2_10058AD0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10023AF6	4_2_10023AF6
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10023AF4	4_2_10023AF4
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1005EB19	4_2_1005EB19
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10011C80	4_2_10011C80
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10048CB0	4_2_10048CB0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10051CC0	4_2_10051CC0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10063CF0	4_2_10063CF0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1003DD30	4_2_1003DD30
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10020D36	4_2_10020D36
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10020D34	4_2_10020D34
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001AD70	4_2_1001AD70
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001FDA4	4_2_1001FDA4
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001FDA6	4_2_1001FDA6
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10005E09	4_2_10005E09
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001BE60	4_2_1001BE60
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10064E70	4_2_10064E70
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10065EC6	4_2_10065EC6
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10007EF0	4_2_10007EF0
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1004AF10	4_2_1004AF10
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001CF40	4_2_1001CF40
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001AFD6	4_2_1001AFD6
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001AFD8	4_2_1001AFD8
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1001DFF0	4_2_1001DFF0

PE file contains more sections than normal

Source: FSCPlugin03.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: FSCPlugin02.dll.0.dr	Static PE information: Number of sections : 11 > 10

Sample file is different than original file name gathered from version info

Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameX vs FSCaptureSetup107.exe
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFSCPlugin07.exe8 vs FSCaptureSetup107.exe
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibwebp.dllB vs FSCaptureSetup107.exe
Source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsharpyuv.dllB vs FSCaptureSetup107.exe

Uses 32bit PE files

Source: FSCaptureSetup107.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean4.winEXE@2/50@0/0

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

0_2_00403640

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

Code function: 0_2_00404AB5 GetDlgItem,SetWindowTextW,SHAutoComplete,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404AB5

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

Code function: 0_2_004021AA CoCreateInstance,

0_2_004021AA

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

File created: C:\Program Files (x86)\FastStone Capture

Jump to behavior

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

File created: C:\Users\Public\Desktop\FastStone Capture.lnk

Jump to behavior

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe

Mutant created: \Sessions\1\BaseNamedObjects\FSCapture

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

File created: C:\Users\user\AppData\Local\Temp\nsf6303.tmp

Jump to behavior

Source: Yara match	File source: C:\Program Files (x86)\FastStone Capture\FSCPlugin06.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\FastStone Capture\FSCPlugin04.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsk6323.tmp, type: DROPPED

Source: FSCaptureSetup107.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

File read: C:\Users\user\Desktop\FSCaptureSetup107.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FSCaptureSetup107.exe "C:\Users\user\Desktop\FSCaptureSetup107.exe"
Source: unknown	Process created: C:\Program Files (x86)\FastStone Capture\FSCapture.exe "C:\Program Files (x86)\FastStone Capture\FSCapture.exe"

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: libwebp.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: libsharpyuv.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: icm32.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Visit www.FastStone.org.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\FastStone Capture\Website.url
Source: Uninstall FastStone Capture.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\FastStone Capture\uninst.exe
Source: FastStone Capture.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\FastStone Capture\FSCapture.exe
Source: FastStone Capture.lnk0.0.dr	LNK file: ..\..\..\Program Files (x86)\FastStone Capture\FSCapture.exe
Source: FastStone Capture Help.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\FastStone Capture\FSCaptureHelp.chm

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

File written: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ioSpecial.ini

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Automated click: Next >
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Automated click: I Agree
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Automated click: Install

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

PE / OLE file has a valid certificate

Source: FSCaptureSetup107.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: FSCaptureSetup107.exe

Static file information: File size 9173144 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: FSCaptureSetup107.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\hesha\Desktop\FSCPlugin07_V1_035\FastStone.Ocr\obj\Release\FSCPlugin07.pdb source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCPlugin07.exe.0.dr
Source:	Binary string: C:\Users\hesha\Desktop\FSCPlugin07_V1_035\FastStone.Ocr\obj\Release\FSCPlugin07.pdbxP source: FSCaptureSetup107.exe, 00000000.00000002.2338865430.00000000026E2000.00000004.00000020.00020000.00000000.sdmp, FSCPlugin07.exe.0.dr

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe

Code function: 4_2_077D9915 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

4_2_077D9915

PE file contains an invalid checksum

Source: FSCPlugin01.dll.0.dr	Static PE information: real checksum: 0x5a4c2 should be: 0x540ce
Source: System.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x3d68
Source: FSCIcon.db.0.dr	Static PE information: real checksum: 0x0 should be: 0xf25e
Source: InstallOptions.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x7de9

PE file contains sections with non-standard names

Source: FSCPlugin02.dll.0.dr	Static PE information: section name: .didata
Source: FSCPlugin03.dll.0.dr	Static PE information: section name: .didata

Uses code obfuscation techniques (call, push, ret)

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077D5091 push ecx; ret	4_2_077D50A4
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1005CDC5 push ecx; ret	4_2_1005CDD8
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_0076C300 push 0076C32Ch; ret	4_2_0076C324

Source: libsharpyuv.dll.0.dr

Static PE information: section name: .text entropy: 6.81310369329101

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCrossHair.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\libwebp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCPlugin06.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCPlugin04.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSRecorder.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\libsharpyuv.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSFocus.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCPlugin02.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ShellExecAsUser.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCPlugin07.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCPlugin01.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\uninst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCIcon.db	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCPlugin05.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\FSCPlugin03.dll	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

File created: C:\Program Files (x86)\FastStone Capture\FSCIcon.db

Jump to dropped file

Creates license or readme file

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\LicenseAgreement.txt			Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\Program Files (x86)\FastStone Capture\LicenseAgreement.txt			Jump to behavior

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Capture	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Capture\FastStone Capture.lnk	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Capture\FastStone Capture Help.lnk	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Capture\Visit www.FastStone.org.lnk	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Capture\Uninstall FastStone Capture.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSCrossHair.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSCPlugin06.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSRecorder.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSCPlugin04.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSFocus.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSCPlugin02.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ShellExecAsUser.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSCPlugin07.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSCPlugin01.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\uninst.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSCIcon.db	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSCPlugin05.dll	Jump to dropped file
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FastStone Capture\FSCPlugin03.dll	Jump to dropped file

Found large amount of non-executed APIs

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Code function: 0_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405D74
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Code function: 0_2_0040699E FindFirstFileW,FindClose,	0_2_0040699E
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

API call chain: ExitProcess graph end node

graph_0-3489

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe

Code function: 4_2_077D92A5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_077D92A5

Contains functionality to dynamically determine API calls

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe

4_2_077D9915

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077D92A5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_077D92A5
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077D8DEF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_077D8DEF
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_077DCDAA __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_077DCDAA
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_1005D0E5 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_1005D0E5
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10059BFE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_10059BFE
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: 4_2_10065C74 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	4_2_10065C74

HIPS / PFW / Operating System Protection Evasion

Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	Binary or memory string: TrayNotifyWndShell_TrayWndU
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp, FSCrossHair.exe.0.dr, FSRecorder.exe.0.dr	Binary or memory string: Shell_TrayWnd
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp, FSRecorder.exe.0.dr	Binary or memory string: SHELL_TRAYWND
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	Binary or memory string: Shell_TrayWndtooltips_class32SV
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp, FSCrossHair.exe.0.dr, FSRecorder.exe.0.dr	Binary or memory string: Shell_TrayWndU
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp, FSRecorder.exe.0.dr	Binary or memory string: PROGMAN
Source: FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp, FSRecorder.exe.0.dr	Binary or memory string: SHELL_TRAYWNDU

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: GetLocaleInfoA,		4_2_077DF93C
Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe	Code function: GetLocaleInfoA,		4_2_100664E8

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\FSCaptureSetup107.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\FastStone Capture\FSCapture.exe

Code function: 4_2_077D8CDB GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_077D8CDB

Source: C:\Users\user\Desktop\FSCaptureSetup107.exe

0_2_00403640

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Process Injection	1 Access Token Manipulation	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	2 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	2 Obfuscated Files or Information	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FSCaptureSetup107.exe	4%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\FastStone Capture\FSCIcon.db	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSCPlugin01.dll	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSCPlugin02.dll	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSCPlugin03.dll	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSCPlugin04.dll	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSCPlugin05.dll	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSCPlugin06.exe	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSCPlugin07.exe	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSCapture.exe	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSCrossHair.exe	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSFocus.exe	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\FSRecorder.exe	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\libsharpyuv.dll	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\libwebp.dll	0%	ReversingLabs
C:\Program Files (x86)\FastStone Capture\uninst.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsf6353.tmp\InstallOptions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ShellExecAsUser.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsf6353.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.datastead.com/WMScriptWriterU	FSRecorder.exe.0.dr	false		unknown
http://www.faststone.org	FSCaptureSetup107.exe, 00000000.00000002.2337132344.00000000004FF000.00000004.00000020.00020000.00000000.sdmp, FSCaptureSetup107.exe, 00000000.00000003.2335936709.00000000004FD000.00000004.00000020.00020000.00000000.sdmp, Website.url.0.dr	false		unknown
http://www.datastead.com/_download/WMFDist11.zip	FSRecorder.exe.0.dr	false		unknown
http://www.faststone.org/FSCTutorial.htmU	FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.faststone.org/FSCTutorial.htm	FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
https://www.faststone.org/order.htmU	FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.axis.com/techsup/software/amc/index.htm	FSRecorder.exe.0.dr	false		unknown
http://www.matroska.org/	FSRecorder.exe.0.dr	false		unknown
http://sourceforge.net/projects/gplmpgdec/	FSRecorder.exe.0.dr	false		unknown
http://nsis.sf.net/NSIS_ErrorError	FSCaptureSetup107.exe	false	URL Reputation: safe	unknown
https://www.faststone.org/order.htm	FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.faststone.org/	FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	false		unknown
http://www.datastead.com/WMScriptWriter	FSRecorder.exe.0.dr	false		unknown
http://avisynth.org	FSRecorder.exe.0.dr	false		unknown
http://www.faststone.org/U	FSCapture.exe, 00000004.00000000.2325806470.0000000000711000.00000020.00000001.01000000.0000000B.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527895
Start date and time:	2024-10-07 10:59:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FSCaptureSetup107.exe
Detection:	CLEAN
Classification:	clean4.winEXE@2/50@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 65 Number of non-executed functions: 90
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: FSCaptureSetup107.exe

Simulations

Behavior and APIs

Time	Type	Description
05:00:49	API Interceptor	2x Sleep call for process: FSCapture.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\FastStone Capture\FSCIcon.db	faststone-capture_voLss-1.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Program Files (x86)\FastStone Capture\FSCIcon.db	faststone-capture_voLss-1.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Program Files (x86)\FastStone Capture\FSCPlugin01.dll	faststone-capture_voLss-1.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Program Files (x86)\FastStone Capture\FSCPlugin01.dll	faststone-capture_voLss-1.exe	Get hash	malicious	PureLog Stealer	Browse

Created / dropped Files

C:\Program Files (x86)\FastStone Capture\Credits.txt

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2022
Entropy (8bit):	3.7043669932880423
Encrypted:	false
SSDEEP:	48:wflLV+HAj/7lIimIldNaq2WgS4xCWMa++zPDh:wNx+Ho7GimStL4xCz0zrh
MD5:	107FBA7548488E7B2442556BE048D5C2
SHA1:	8FFD3008E3929C5503F5F7BC4B3126D5E444AD4E
SHA-256:	232A42E5CEF0478141B49A6BE9DA1F0F0C7C10B76F3C7B72EB9D91222AAC034D
SHA-512:	62FCE847420A4AC40A1BAE163E41E04A621D14775E5E2E7DC3A0A63FFC1EF100F1A92014E7DE7307C0F98A6C34210012A4A3992B2AE99D4AF4D34520BFB6BF7D
Malicious:	false
Reputation:	low
Preview:	..M.a.n.y. .t.h.a.n.k.s. .t.o. .t.h.e. .f.o.l.l.o.w.i.n.g. .t.r.a.n.s.l.a.t.o.r.s.:. .........B.r.a.z.i.l.i.a.n. .P.o.r.t.u.g.u.e.s.e. .-. .t.r.a.n.s.l.a.t.e.d. .b.y. .A.l.d.i.n.e.y. .O.l.i.v.e.i.r.a.....B.u.l.g.a.r.i.a.n. .-. .t.r.a.n.s.l.a.t.e.d. .b.y. ...5.>.@.3.8. ..... .&.2.5.B.0.=.>.2.....C.h.i.n.e.s.e. .(.S.i.m.p.l.i.f.i.e.d.). .-. .t.r.a.n.s.l.a.t.e.d. .b.y. ..n.....C.h.i.n.e.s.e. .(.T.r.a.d.i.t.i.o.n.a.l.). .-. .t.r.a.n.s.l.a.t.e.d. .b.y. .H.S.M.....C.z.e.c.h. .-. .t.r.a.n.s.l.a.t.e.d. .b.y. .T.Y.a.s...k. .J.i.Y.......D.u.t.c.h. .-. .t.r.a.n.s.l.a.t.e.d. .b.y. .A.l.b.e.r.t. .H.a.n.s.e.n. .&. .J.a.a.p. .K.r.a.m.e.r.....F.r.e.n.c.h. .-. .t.r.a.n.s.l.a.t.e.d. .b.y. .C.o.l.o.k. .w.w.w...c.o.l.o.k.-.t.r.a.d.u.c.t.i.o.n.s...c.o.m.....G.e.r.m.a.n. .-. .t.r.a.n.s.l.a.t.e.d. .b.y. .W.i.n.f.r.i.e.d. .G...n...l.e.r. .w...g.a.e.n.s.s.l.e.r.@.g.m.x...d.e.....H.u.n.g.a.r.i.a.n. .-. .t.r.a.n.s.l.a.t.e.d. .b.y. .Z.i.t.y.i.'.s. .T.r.a.n.s.l.a.t.o.r. .T.e.a.m.....I.t.a.l.i.a.n. .-. .t.r.a.n.s.

C:\Program Files (x86)\FastStone Capture\Draw.db

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	749154
Entropy (8bit):	7.924075690289188
Encrypted:	false
SSDEEP:	12288:fZXeDKBnzkX0lrYlEIEYBzRZCfWI8pjTmqapHpvAkbl03rx7Qns1VUzuvtIsLL72:YQ4kUQGV3I8V+pIqurKsbFtIg74/T
MD5:	8F23FAE255FF499A0EE3B2A34DCB402E
SHA1:	10A40CF783D16BACBC7FCC9D9D13425AAC7D6362
SHA-256:	0A0B62E6F5F3B7824EEC81CA33740B6B16D73E2093505AC191F0CD75E4931CA0
SHA-512:	6EB259269C8AF00C7174DED2E04246BA07F0D48A8CDD9158A97C38A7D5D55B8C3ACE4ADDB7A08C3B3A6A26F5489B38F6802DA8C79522A2251A5565AB75AD92F2
Malicious:	false
Reputation:	low
Preview:	k......0...o....#..$9..;K...]...r.........+..........................[....7...P...j.........................S..jk......K...........P........"..:;...g.....................J....-...[..j\|..\|..............E...~...j...sE...]..qt.....\|...M...........R....8..>O...f......8.......]........F..Oh..\|...~...>...0..._.......O&.../...8...@...I...R..r[...e...n......:..................-...O.......<........$...+...4...D...b...i.........`...............n.......\...{.......<........9..T^..vp......................=...Z...............S...........d...6..@E...S...a...PNG........IHDR..............>a.....pHYs..........+......tEXtSoftware.Adobe ImageReadyq.e<....IDATx...V.I....@......{.#..>...#..>.w.......FYw.....'X.a5........{.v'3./...$3I.7U.U......'.W...p?............QY..J...........y_.$..PY.Rq..[...R........J.G.q........R.Ex..(..m%.rA..?.../Z9.}.`....(..o+.........x....].....$.........X...'9-. '.n. .w......Y..@P.e.. .....!x...@..(V.s......&...8.....)).p.\0..~..w+..@B..(..,:....(.t.

C:\Program Files (x86)\FastStone Capture\FSCIcon.db

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	3.0334915512311196
Encrypted:	false
SSDEEP:	96:nPtA/dChd6kwoSJNAngD+PLKIoyNSjcWTvR0MHm////////////IXDlw2RjbGS7f:ni0hd5HUUtoyIjcWTOMHhxAivM3
MD5:	E4DD6134F0DA16B24F9DF1BBA0969F55
SHA1:	4CED9E445246FCD570E42ACC85BCE4F89AE4736D
SHA-256:	3CC8478F1DE6BA82347702F74A0A413105189C26238123C6DE21635D751FFD80
SHA-512:	E19495DFA70A803FBDD6C974A17C26277809BF251C0DA7BB81BD12E6F44B35E5F34F7944C2BB2B823F85AB0B7048A7D3761D52CA793249B168984D93E9C90E58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: faststone-capture_voLss-1.exe, Detection: malicious, Browse Filename: faststone-capture_voLss-1.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................................... ....@..........................................................................@.......`.......................P......................................................................................CODE................................ ..`DATA......... ......................@...BSS..........0...........................idata.......@......................@....reloc.......P......................@..P.rsrc........`......................@..P....................................@..P........................................................................................................................................................................................................................

C:\Program Files (x86)\FastStone Capture\FSCPlugin01.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326856
Entropy (8bit):	6.507303143563013
Encrypted:	false
SSDEEP:	6144:Iu/M8/CrMeIS4iB7ncZzPnRGpk2WQvg1+i/X5NKP5NCs/lwaj2Qy:l/Anc1x2Wj5NKPqs92Qy
MD5:	F421919DA3CB7C44B086210D4D797D7A
SHA1:	CDCA33C63F6FAE255A6F64BDCA62BD8DBC7032DC
SHA-256:	CF66F927D6D3EBC77D93567C25C9577803E5FB64201755D7773257C4C3ED5D2B
SHA-512:	BB98BFDBEA713AE19DA38CB3CFAA4F2C54A5AF2C9ADC8A80EEA415F45EB07005307733589FCF54F407A090E5E6C228FAC3FF654F4AA71CB861265D6B41A01472
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: faststone-capture_voLss-1.exe, Detection: malicious, Browse Filename: faststone-capture_voLss-1.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...f...f...f..f...f.{.f...f...f...f..f...f..f...f..f...f..f...f:..f...f..f...f...ft..fc..f...f...f...f~..f...fF..f...fRich...f................PE..L...J.%N...........!.....P...................`............................................... ... .................`4../...@........p...........................:...................................................`...............................text....J.......P.................. ..`.rdata.......`.......`..............@..@.data........@... ...@..............@....CRT.........`.......`..............@....rsrc........p... ...p..............@..@.reloc..&@.......P..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\FastStone Capture\FSCPlugin02.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3687568
Entropy (8bit):	5.966246760152598
Encrypted:	false
SSDEEP:	49152:IhFXzHdg+4U90CBP+uKC7kqzDLS0l1W4D1T:+dbUC
MD5:	A3101ADDC099361A751198614972D5FA
SHA1:	9379EC77C520C19CD698369AEF6ACDC4E32EE10D
SHA-256:	4EF58566D20EAE8ED18177DA8FCABBC55A5585CC5CC51806EF86E136291AC1F1
SHA-512:	A0AE4A9BF7BA7AF8B539CEB77ACA1F21C27A6AC6B418737559263E2C5084568E9A821E7C8101CF7E1DA5F00A677CFAC528185BF31E0C67BF76A1D4174DA70F37
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d.....\e..........".......-..(........,.......@..............................p9.......8...`..........@............... ...............p3.......3.\|@....8.......6.......8..&....3..n............................3.(...................8.3.H....P3.J....................text.....-.......-................. ..`.data.................-.............@....bss.........02..........................idata..\|@....3..B....2.............@....didata.J....P3......J2.............@....edata.......p3......`2.............@..@.tls..........3..........................rdata..m.....3......b2.............@..@.reloc...n....3..p...d2.............@..B.pdata........6.......4.............@..@.rsrc.........8......x7.............@..@.............p9.......8.............@..@

C:\Program Files (x86)\FastStone Capture\FSCPlugin03.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2274448
Entropy (8bit):	6.65325844717495
Encrypted:	false
SSDEEP:	24576:x1+Sus1HRBOcDtwCpFf4fMaJj8C7hkEcw32Ig1BJS/AcOWdg0DZMK0jwUAHxala:NJzVAjj8uo1nSocOsDZMoDHxk
MD5:	FC610B497818BCB5249E72410AED5162
SHA1:	3DA9E3FEF84300FBDA10FDC9E97250D1FB4367A2
SHA-256:	FB8C862B1E2C2F423DDE036B9D77F241951674DC5E6EE51954F2B37E19BCA378
SHA-512:	4F23BEA8BA7BF51DCE14437FE5209B3B3209C1D6D7F8912FA91FA734A98CB92BED129CDEE8EBFDDFD22FCF42D90B5944E5D64E026FF531527B705664FAB8B3E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....\e.........."......x..........0.............@..........................`#.....T~#...@......@...........................`...0...."..............."..&..........................................................lh...............................text....[.......\.................. ..`.itext.......p.......`.............. ..`.data....W.......X...\|..............@....bss....Dl...............................idata...0...`...2..................@....didata.............................@....edata..............................@..@.tls....T................................rdata..]...........................@..@.reloc..............................@..B.rsrc.........".......!.............@..@.............`#.......".............@..@................

C:\Program Files (x86)\FastStone Capture\FSCPlugin04.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1648520
Entropy (8bit):	6.611277014754512
Encrypted:	false
SSDEEP:	24576:r+L+R2nWVAu3td0VpXRwylIjLVt0sA7GIdmuTFgke8KR6DdgO3I3q4Pj3HCMo:wI3LEhBsDV89Y7XCMo
MD5:	3D936F0507E9BE6F4AEDE56BF440F42C
SHA1:	CFFFCE39FB24978BA87D550AA9729FD0776B4FCC
SHA-256:	99C55D9B65D38C22DD84FC96DE55A29008E564B92AE97D9B3B31BBDD31D78A01
SHA-512:	C913E2FD6B2E4242727322E14750DFF8911C8CD5FB3713DB8BB9F83E22C2247C39CB1A9B1FD4D768A11B47755DD1CFCD8C5F1D06F9FFF724554C50B6A2B50006
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\FastStone Capture\FSCPlugin04.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................H..........PU.......`....@......................................@......@...........................@...2.......................).......%..................................................................................CODE.....G.......H.................. ..`DATA.....W...`...X...L..............@...BSS......z...............................idata...2...@...4..................@....tls....$................................rdata..............................@..P.reloc...%.......&..................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\FastStone Capture\FSCPlugin05.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120456
Entropy (8bit):	6.439927806022288
Encrypted:	false
SSDEEP:	3072:yuJnXnJMBIrVDtuUFAWoULBRmBrv8qKxs:yYXfpxuUFZDBR8h
MD5:	70C3F6892684641080C6FFE2F32B9BDA
SHA1:	CBB401C44A17E85E54E73B0C716CD5E819FF6421
SHA-256:	3D2877A8D739F682FB5323C00D568483F8C878C6AC745DE5F0D0CAA7FFA3788A
SHA-512:	D1341D4E190EA4109A15A99E4119B2559C0D330DF43AB2ED6605F454E9F7012FD42FA75DDE9A8290C366FBF50B4D44D36548E35568BC510B974FA4CFE47F7F30
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q..[Q..[Q..[>.@[D..[>.t[9..[X.M[\..[Q..['..[X.][U..[>.u[...[>.q[S..[>.E[P..[>.D[P..[>.C[P..[RichQ..[........PE..L....%8d...........!..... ..........om.......0......................................4$....@..........................w......\|o..P........................&...........1...............................X..@............0..x............................text............ .................. ..`.rdata...H...0...J...$..............@..@.data....3...........n..............@....rsrc...............................@..@.reloc.. $.......&..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FastStone Capture\FSCPlugin06.exe

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2869128
Entropy (8bit):	6.587584991339312
Encrypted:	false
SSDEEP:	49152:LGcGi7xkdj0xGjEEBSNI+1oeuX4KQxUjB30yM5RTbT4XN:KcVkZ9Buoeo4ajB30XiXN
MD5:	3DFF39A3EDA72F6360CEDCBB5F324C67
SHA1:	035B5F7CF78276F61EDC89180C21B623A236B449
SHA-256:	D1A175B774962E38E37C40A8DA1F6CED0D0FCD8E5A5667EFEBC94F26C2FB1C76
SHA-512:	3504988ED204572B41B85400294E3E4B98022CB1958EDF9A07F79BF3701DEAC34E1E701457BD65759B8F988A91B3159575B8BC04301D0161C4C38026EA70CD55
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\FastStone Capture\FSCPlugin06.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t%..&......$.%.......%...@...........................,.......,...@......@............................'..4....)...............+..)....(.l.............................(.....................................................CODE.....r%......t%................. ..`DATA.........%......x%.............@...BSS.......... '.......'..................idata...4....'..6....'.............@....tls....$.....'......8'..................rdata........(......8'.............@..P.reloc..l.....(......:'.............@..P.rsrc.........).......(.............@..P..............,.......+.............@..P........................................................................................................................................

C:\Program Files (x86)\FastStone Capture\FSCPlugin07.exe

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26504
Entropy (8bit):	6.539209436879084
Encrypted:	false
SSDEEP:	384:gGSRg3LRNHTitQa6anmoNsaaU9JGnKUDzE6/L8+IYix6wEtiyAM+o/8E9VF0Nyg0:gp2LROLqX/ATYixpFyAMxkEWC
MD5:	E3EF14ED122068DAE0AEEF89DB996513
SHA1:	32CE0BEE51FB8FF7E02C7917CB06D72DABDD0FCB
SHA-256:	FE43D2A447EACBDA956728AD75B85C4743D406389C0354F3D81BBB0DFB4A7D44
SHA-512:	FED0BD0CFC1F5272A62CCFB6B8127B272D10D942D2DD8505EA61685B50426AA5C167117060A627F19649A672721F824018DFDA1B610EBE740694EAF7445E9371
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|..f.........."...0..2...........P... ...`....@.. ...............................@....`.................................PP..O....`..(............>...)...........O............................................... ............... ..H............text....0... ...2.................. ..`.rsrc...(....`.......4..............@..@.reloc...............<..............@..B.................P......H.......h4..............`N................................................(.....~....-.r...p.....(....o....s.........~.....~.............0..........rU..p.(....(......9.......rW..p(....9......i.1l.....ro..p(....,D(....o.....+".o .....o!...ru..p.o"...(#...($....o%...-....,..o&.....r}..p(....,...i.2.......(....o'.......((...($.....&.........K..y...................0..7.........()...}.......}.......}......\|......(...+..\|....(+.....{......0..R........{......E........c...;..

C:\Program Files (x86)\FastStone Capture\FSCapture.exe

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7563656
Entropy (8bit):	6.870770305666163
Encrypted:	false
SSDEEP:	196608:7SyDtyDnxB+yKtRlR6dqHXJ7YPcwD4YSqObJdmr2tKjmSIS:7NyDxBnY6BEwDaqOO2tAmSIS
MD5:	D5AC941C445B6EB907D0B96D84F15FE7
SHA1:	F3351699F44612579EA2646001DF954B3AA85A3B
SHA-256:	1A8499B56435991CB6B042919B6D79357E913C14B9CBBC1089525D77F9FDB2EE
SHA-512:	EEBEF0DB392B714D6F9BB950C11F136C80E81C38292347C9A99721A7B1D5AE129E8B4833A904B1340C259BE3C9617EEAA3D23A40B070D8C5628671D60FF6C48D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................LN...$.....HRN......`N...@..........................0t.......t...@......@............................P..@....T..............@s..)...0Q..J........................... Q.....................................................CODE....<JN......LN................. ..`DATA.........`N......PN.............@...BSS.......... P.......P..................idata...@....P..B....P.............@....tls....0.....Q......HP..................rdata....... Q......HP.............@..P.reloc...J...0Q..L...JP.............@..P.rsrc.........T.......S.............@..P.............0t......@s.............@..P........................................................................................................................................

C:\Program Files (x86)\FastStone Capture\FSCaptureHelp.chm

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	176729
Entropy (8bit):	7.916956322771971
Encrypted:	false
SSDEEP:	3072:rKrOuOmioe0Z/FnSgNf+YVvhNIJC5KH/CNQ4GJXDd1E0M:r2OuOmu0e4f+YhhVrxKLE0M
MD5:	EE9541FC0234AAE432DB2985B4ABB709
SHA1:	C89BE531F7FD37D5F04A68C9D3F2D36DF96C0428
SHA-256:	4815A94312EA9218C5B1E502F53A83719B20415FFDD3F6BBC285F772A8558256
SHA-512:	03A46A6E997BDF9613922B842C0B2EFDCA39A0670B7113ADEFF4C696318FFFDC1FBD46857CD90AB826E0289452E13C364BB03A6127069CB9EE5D77F7327E0B04
Malicious:	false
Preview:	ITSF....`.......e.R........\|.{.......".....\|.{......."..`...............x.......T.......................Y...............ITSP....T...........................................j..].!......."..T...............PMGL................./..../#IDXHDR...t.../#ITBITS..../#STRINGS...^.'./#SYSTEM..n.5./#TOPICS...t.@./#URLSTR...D.../#URLTBL...4.../$FIftiMain..../$OBJINST...5.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...1../$WWKeywordLinks/..../$WWKeywordLinks/BTree...9.L./$WWKeywordLinks/Data......./$WWKeywordLinks/Map....../$WWKeywordLinks/Property.... ./ActiveWindow.gif...;.M./CaptureButtons.gif...#.../CapturePanel.gif...8..g./CapturePanel.htm..p.../CaptureSmallBar.gif...E.../CloseButton.gif...D.a./CloseTabButton.gif...3.../ContactUs.htm...o.c./CutVideo.gif...N.{./DragCursorShape.gif......./DrawVideoButton.gif...v.I./Editor.htm...R.&./EditVideoButton.gif...w.0./EditVideoFile.htm...5.^./FastStoneLogo.gif...!.../Features.htm...x.y./FixRegion.gif...~.Y./Freehand.gif...#.f./FSCAnnotation.gi

C:\Program Files (x86)\FastStone Capture\FSCrossHair.exe

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	646792
Entropy (8bit):	6.622561341110581
Encrypted:	false
SSDEEP:	12288:hIRXXg5ro19GsHuRwX6ZLs+O3EoKhjkiYkKhtmfCllQtpP/Z63iwwoZRr:hI+oGZRwqZLPO6jkiUf3lUP/Z63iwwoT
MD5:	EFFB23AB4ECE53D5E07C8C0437D86BBE
SHA1:	B695BDA41C3B115375025B6A11E6E2CFE740EAEE
SHA-256:	C0BCB458D844158F42F8BE4DA7187008115F849FF25D85AA00FA8637869EDE2F
SHA-512:	CABFFD4A53524A681DB07784F5C8517545F730ABEC1ADF5C79DA4A91A61295EEC266313FF631C1CDF2389C564C2D448A7B323A6122674617BA130E7F9B0A9F16
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................x...<...................@.......................... ...................@...............................(.......^...............&... ..T...................................................................................CODE.....v.......x.................. ..`DATA.................\|..............@...BSS......................................idata...(.........................@....tls....$................................rdata..............................@..P.reloc..T.... ......................@..P.rsrc....^.......^...Z..............@..P............. ......................@..P........................................................................................................................................

C:\Program Files (x86)\FastStone Capture\FSFocus.exe

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	651912
Entropy (8bit):	6.630178927904243
Encrypted:	false
SSDEEP:	12288:9IuPNeBhqk/28pUgna9ref4+/dFPfwCXrUhgIZXu8C6Z:9IkeBVpRna98dlzeu8b
MD5:	97AA518D2A3B2AD63573128C7E10E6C5
SHA1:	88CD0BC2496025A7979393807DCC089BA09BD9E8
SHA-256:	493B2B08ECADD1895C4FCFE0FFD9C7B2B4F5B276CCD494846E0CB35DE004AD91
SHA-512:	1A77895B740191CCDFCB3377528EF1B907BC138297D5EEA7BCEFA23D65EBCBCC11F29EBA70151C570928ECA099C2C87A1AE1D94226A19DBB0C2EE459AC371256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................:......\|.............@..........................0......x............@...............................(.......^...............&...0............................... ......................................................CODE....,........................... ..`DATA....P...........................@...BSS......................................idata...(.........................@....tls....$................................rdata....... ......................@..P.reloc.......0......................@..P.rsrc....^.......^...n..............@..P.............0......................@..P........................................................................................................................................

C:\Program Files (x86)\FastStone Capture\FSLogo.png

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PNG image data, 210 x 55, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16493
Entropy (8bit):	7.970089956405633
Encrypted:	false
SSDEEP:	384:UaHshj5NpHFgERfllmpvRxNL0ldMRVTPcP1VWyg+ag:9GzCERtliJxNL0ERVDAVpag
MD5:	D03A70C659C1B548EE2076D3E937CEE6
SHA1:	296DFEFAE326199D39E2B21280D3CE2315F8C5C2
SHA-256:	15DA9D859193790BC08AAA1C88CB61E318FC8E90D8D37D72A5884A028887A898
SHA-512:	0B23D90EFF56642DB7E96A475FE350CA555C5CEDD118FE01A8224B0E85FA908AC4B06AFFBAFA91E0B7A760F9780C9D8683EC773E2CA7935F15D7DCC412B69FA9
Malicious:	false
Preview:	.PNG........IHDR.......7.....y..s....gAMA....\|.Q.... cHRM..z%..............u0...`..:....o......?.IDATx.b...?..022.H.......c..'...b..R.D3.....@..M..p$....@.;...E....P..'53.'..P6r........H46?.2.(.aa...!...l..._.....0.{..C\|\|.E.H......F.X.v.( ....#.....,G..5SUUm....3.3..%.ht}.....?0Q0......}.Z...N...../.H".K.o....#(..2..u.....utt...~CN......kii.Drrr....=...5H.(\...&....._.>v...999g.... .....g..wn.AICC#...s...... .p.H,.~...f.{VVVP..k......fB...3.;wN.(t..?1@"m(f"..6{.l577.\|NN.........a...?.P._...o.Q&!!...C~Pa.........3.,LA4....i...j...$.....f..;w>.....T...?6w.3G...=..a..>\|.......@.........W...........L .O.>1.9r...."@!a.D&...C%.`...fl...Swtt,........[.lac....T.r..K........l.1..,p......._.\|.+.fL.`.g.....d.... ,,,....'.......P.."..k6..?_...HHH..N`..y.f\|...d....V#.#..08@.P).....\c.%.....3.2.....o..%.. ........%..D..W766..6.b@~...;8,.?....@a&.U.(`M/X.d..(....Q...VP}.....;.W.\ax....p...gPWWgPVVf.f.P......(3...VVVN...Nc.d..H.2o.I....hW....eZ`...;G... .

C:\Program Files (x86)\FastStone Capture\FSRecorder.exe

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5863304
Entropy (8bit):	6.582730492890511
Encrypted:	false
SSDEEP:	98304:IeTs99ujC8vUZJFdIabS8b4Y24Lm/W71mRGfggzzM72X:I/XujC8MLFdIaO8k34LmpyggM72X
MD5:	86725CB7E49416271CA85E1D856F3054
SHA1:	A3502C78ABD19FDED5248A3AC1C2C7947BACF396
SHA-256:	9116FDB5078190544BCC39F8DF793D23ED3262333EA5600FC1B8BC6FA07E46DF
SHA-512:	674C9F793685FE6945F052FB8C597E6F60A10DCB97DBA03565E75FB7DE7CD53446CDA9AC188F1389CEB4ABEA7B2479D35DD477518D30D3602FD0026992CF1169
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..................B..d......@.B.......C...@..........................PZ.......Y...@......@...........................`E.xA....H..............NY..)....E...............................E.....................................................CODE......B.......B................. ..`DATA..........C.......B.............@...BSS.....i.....D.......D..................idata..xA...`E..B....D.............@....tls....0.....E.......D..................rdata........E.......D.............@..P.reloc........E.......D.............@..P.rsrc.........H.......G.............@..P.............PZ......NY.............@..P........................................................................................................................................

C:\Program Files (x86)\FastStone Capture\Languages\FSC02.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	208511
Entropy (8bit):	5.620716068879169
Encrypted:	false
SSDEEP:	3072:jjevRI50115sxnOIdO7YljePuqQIQ9Ausbk2Nr7rCg9kKVBp/7Yto:jaiVr4KoZ
MD5:	CC760999D7474C52255929889C66CA5C
SHA1:	4F4D3A6AEB374B464EE7036B1E69229A134B5738
SHA-256:	04F909824B08317EEFC33F448ABDE06B1D50372AF502501E61B94961BD7A538D
SHA-512:	42AC01E1CF16CA2F28950DEB78654A63FAE3EE7B4CEB17EEAD72F71907F670AC39D97CAA4C5DB4CDA3484C28245ACD7A6E534BCAC7727B29E6360AB6CB971F9B
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About....sQ.N....Label3..'...Copyright (C) %1% FastStone Corporation ...HrCg@b.g ... .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:.....[.eQ..z......Label4......Support Email:..../e.c...{......LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....o..NIl.S......Label6......Translator's name.....n.....BntHome......Visit Home Page.......;Nu.....BntPurchase......Buy Now.....zsS-.pN....BntClose......Close....sQ.....VersionLabel......Version %1%....Hr,g:. .%.1.%.....RegisterToText......Unregistered Trial Version....g.l.Q.(uHr................MyStringCollection.S01......Single-User License....US(u7b...S......MyStringCollection.S02..,...Family License that covers up to 5 computers.....[.^...S..../e.c5.N...Y......MyStringCollection.S03......Educational Site License....Ye..:g.g.z.p...S......MyStringCollection.S04......Educational Worldwide Licens

C:\Program Files (x86)\FastStone Capture\Languages\FSC03.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	209129
Entropy (8bit):	5.627456769442713
Encrypted:	false
SSDEEP:	3072:QEhGzK5G7Fh605YGK6GDftCIa27zLDzI0POkrH4iazqlGjBgxr8FIEHHL4:n75bx1x2HM
MD5:	8751416A2E09ACDAACB2EDECCFF0EF67
SHA1:	3146782E5C90DF46A7A0AFBC3C1FED49032F54B5
SHA-256:	58EB9056EB56801457352F7153AD44BED539C37E2808DA151001155034AA1773
SHA-512:	A32E3D982BDD7B4AA879BF62EE26558962756B109DE20CA8D0DBD16A08CD76DA9B27E9D8ED2B72D160B6995E9F4BAE37D5CAA9DDDE64C33C7688C010B669A2EF
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About......e....Label3..'...Copyright (C) %1% FastStone Corporation ...Hr.k@b.g ... .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:.....}.z:.....Label4......Support Email:..../e.c..P[...N:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....-N.e..o.:.....Label6......Translator's name....H.S.M.....BntHome......Visit Home Page.....b.........BntPurchase......Buy Now.....zsS........BntClose......Close...........VersionLabel......Version %1%....Hr,g .%.1.%.....RegisterToText......Unregistered Trial Version....g;..Qf.(uHr................MyStringCollection.S01......Single-User License.....U.O(u..1..SI.....MyStringCollection.S02..,...Family License that covers up to 5 computers.....[.^1..SI. .(./e.c.g.Y .5. ..S..f.).....MyStringCollection.S03......Educational Site License....Ye.._j.i.z.1..SI.....MyStringCollection.S04......Educational Worl

C:\Program Files (x86)\FastStone Capture\Languages\FSC05.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	287753
Entropy (8bit):	4.41441990168391
Encrypted:	false
SSDEEP:	3072:5Ogq/rhkCe/spdGX6e2VhrDQmyY+qh1w81D2chrwGqm0AfJS66J4Ym6sf2SKQVXU:2XxXYQaQgDgi
MD5:	EED09EC6F80153A98E52CE2A1DDE6549
SHA1:	59902A655F70AFDFA00FA58C58B3F293766A229C
SHA-256:	488AFC4127E2440FBAF5616B7D0479519B62FC1786A741889A97357E93536E8C
SHA-512:	B37720A95FD8C6D969EFEDF0572F3493017E4D06BBCF5396CF36541C8B17AF9C21BA5107F9CD1DE5C9EBE81CA30B0F50B73A84815AD83448AC2EF2C37E488691
Malicious:	false
Preview:	........L.......TAboutWindowj...........AboutWindow......About....O.v.e.r.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....W.e.b.s.i.t.e.:.....Label4......Support Email:....S.u.p.p.o.r.t. .e.-.m.a.i.l.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....V.e.r.t.a.a.l.d. .d.o.o.r.:.....Label6......Translator's name....A.l.b.e.r.t. .H.a.n.s.e.n. .e.n. .J.a.a.p. .K.r.a.m.e.r.....BntHome......Visit Home Page....B.e.z.o.e.k. .h.o.m.e.p.a.g.i.n.a.....BntPurchase......Buy Now....K.o.o.p. .n.u.....BntClose......Close....S.l.u.i.t.e.n.....VersionLabel......Version %1%....V.e.r.s.i.e. .%.1.%.....RegisterToText......Unregistered Trial Version....O.n.g.e.r.e.g.i.s.t.r.e.e.r.d.e. .d.e.m.o.v.e.r.s.i.e.................MyStringCollection.S01......Single-User License....S.i.n.g.l.e.-.u.s.e.r. .L.i.c.e.n.t.i.e.....MyString

C:\Program Files (x86)\FastStone Capture\Languages\FSC06.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	306159
Entropy (8bit):	4.362139594009469
Encrypted:	false
SSDEEP:	1536:JT2QirCjZeMlxk0x1y2Z9LI7yxnTjGIWvUVWClRXVuOCpAXK0DcYX0xX7pnGhpdb:d2FwzxAkE6mIa2VypAXK0DuLpEpdV9
MD5:	0246C3E9497F63F11E122E30F235361A
SHA1:	28F1445CC038FD92B9CE88F6A58B314F2207C5F7
SHA-256:	4CE1B7D56E34BD43E0D895CA81A41DF1435FBD35EA06031C93610314F76B7048
SHA-512:	1BA5976107562F1D4BA0889C8E05BFD73C3D2EA4BBD3D621294897E22656CC8C80901DFDEFA6EFF172672665D8CA9B2C4F32445664ABECEA491FE222EB2F1C6B
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About....A. .p.r.o.p.o.s.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....S.i.t.e. .W.e.b.:.....Label4......Support Email:....E.n.v.o.y.e.r. .u.n. .e.m.a.i.l.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....T.r.a.d.u.i.t. .p.a.r.:.....Label6......Translator's name!...C.o.l.o.k. .-. .w.w.w...c.o.l.o.k.-.t.r.a.d.u.c.t.i.o.n.s...c.o.m.....BntHome......Visit Home Page....P.a.g.e. .d.'.a.c.c.u.e.i.l.....BntPurchase......Buy Now....A.c.h.e.t.e.r. .m.a.i.n.t.e.n.a.n.t.....BntClose......Close....F.e.r.m.e.r.....VersionLabel......Version %1%....V.e.r.s.i.o.n. .%.1.%.....RegisterToText......Unregistered Trial Version....V.e.r.s.i.o.n. .d.'.e.s.s.a.i. .n.o.n. .e.n.r.e.g.i.s.t.r...e.................MyStringCollection.S01......Single-User License....L.i.c.e.

C:\Program Files (x86)\FastStone Capture\Languages\FSC07.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	298809
Entropy (8bit):	4.414228832456031
Encrypted:	false
SSDEEP:	3072:QVVqx/R0BHw6kT5hRyJIbwbVC4nIYS9V+QC4VkSk+aMv1XyqAWPY5aTsNQEh1KeR:sVwiNUGQb0q6
MD5:	BD34FDCC1444D9DA2E1AC8BDAAA82A93
SHA1:	A99E80DAFC175E64E02F75F35EE7F3D3AAB9E3D1
SHA-256:	A9F6C0BDBA563F87AA1C66A814564DFC985624707BDE7E8776B17785F82B6A95
SHA-512:	DD6EE4B635AE3528CD75E1DC6CCF854F18A2F1B007D804BE9B7DD7A94BA97AFCC0D6AAF8EFD7786F2381866406A1D0D78BAA7886F8C232E9334B5B8F8A5ADD10
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About......b.e.r.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....I.n.t.e.r.n.e.t.-.S.e.i.t.e.:.....Label4......Support Email:....S.u.p.p.o.r.t. .E.-.M.a.i.l.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....D.e.u.t.s.c.h.e. ...b.e.r.s.e.t.z.u.n.g.:.....Label6......Translator's name#...W.i.n.f.r.i.e.d. .G...n...l.e.r. .w...g.a.e.n.s.s.l.e.r.@.g.m.x...d.e.....BntHome......Visit Home Page....H.o.m.e. .P.a.g.e.....BntPurchase......Buy Now....J.e.t.z.t. .k.a.u.f.e.n.....BntClose......Close....S.c.h.l.i.e...e.n.....VersionLabel......Version %1%....V.e.r.s.i.o.n. .%.1.%.....RegisterToText......Unregistered Trial Version....N.i.c.h.t. .r.e.g.i.s.t.r.i.e.r.t.e. .T.e.s.t.v.e.r.s.i.o.n.................MyStringCollection.S01......Single-User License....E.i.

C:\Program Files (x86)\FastStone Capture\Languages\FSC08.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	298185
Entropy (8bit):	4.35766713960632
Encrypted:	false
SSDEEP:	3072:155O9ryG/k8mkvNR70m8qVZHfGaf4Is1Gb08TvPaCdYIstC:T5iI8mvm8i3QIZ08TvYIZ
MD5:	90F47C7F9EDFCDC15C9B3E761C9EE997
SHA1:	26F1BBD0D6991E9A5E37CECE74E15E0E922D8AE7
SHA-256:	931A2367A2E6830D66CC0EBB0E9D5E8CE84FC5F0187DFD8C83B95F80F1F28374
SHA-512:	9D6EA643427C4527095189BFE13E9124DB49E6818030AA5B415A0ED8E07E752EE5E0116395683C63F58624EA61F895AE64A1A240E629C49DA6FB1799D1DA0A77
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About....I.n.f.o. .p.r.o.g.r.a.m.m.a.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....S.i.t.o. .w.e.b.:.....Label4......Support Email:....E.m.a.i.l. .s.u.p.p.o.r.t.o.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....T.r.a.d.o.t.t.o. .d.a.:.....Label6......Translator's name....R.o.b.e.r.t.o. .B... .(.v... .1.9...1.2...2.0.2.3.).....BntHome......Visit Home Page....V.i.s.i.t.a. .s.i.t.o. .w.e.b. .p.r.o.g.r.a.m.m.a.....BntPurchase......Buy Now....A.c.q.u.i.s.t.a.....BntClose......Close....C.h.i.u.d.i.....VersionLabel......Version %1%....V.e.r.s.i.o.n.e. .%.1.%.....RegisterToText......Unregistered Trial Version ...V.e.r.s.i.o.n.e. .d.i. .p.r.o.v.a. .n.o.n. .r.e.g.i.s.t.r.a.t.a.................MyStringCollection.S01......Single-User License....L.i.c.e.

C:\Program Files (x86)\FastStone Capture\Languages\FSC10.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	292075
Entropy (8bit):	4.5497947965231065
Encrypted:	false
SSDEEP:	3072:Vl8diIXbDnEjuAo/alByUS5MSIG7mqeFZawP:QAjro/anym7H
MD5:	A6E5E213287A9C8D3B17C47C9F51CC87
SHA1:	BC2001F6C0970C6FA4FE3F3155CFB07BE3121F71
SHA-256:	D8E9EBF1957B77C78AD2511C57DF242A91CAAADDE7ECDD9EAC9AE359EF9FB7C2
SHA-512:	B856BB745B1B93A27C801A3E8D38BFF5C0D1F00F98E778346D1AB87887FD719319D42BBF0EBD156D1EB979D5C82835983693F013CD971CC3B0EB7F5784D26DB2
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About....O. .p.r.o.g.r.a.m.i.e.....Label3..'...Copyright (C) %1% FastStone Corporation-...P.r.a.w.a. .a.u.t.o.r.s.k.i.e. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....S.t.r.o.n.a. .W.e.b.:.....Label4......Support Email:....W.s.p.a.r.c.i.e. .E.m.a.i.l.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....T.B.u.m.a.c.z.e.n.i.e.:.....Label6......Translator's name....M.a.c.i.e.j. .K.u.l.e.j.....BntHome......Visit Home Page....O.d.w.i.e.d.z. .s.t.r.o.n... .d.o.m.o.w.......BntPurchase......Buy Now....K.u.p. .t.e.r.a.z.....BntClose......Close....Z.a.m.k.n.i.j.....VersionLabel......Version %1%....W.e.r.s.j.a. .%.1.%.....RegisterToText......Unregistered Trial Version ...N.i.e.z.a.r.e.j.e.s.t.r.o.w.a.n.a. .w.e.r.s.j.a. .t.e.s.t.o.w.a.................MyStringCollection.S01......Single-User License....L.i.c.e.n.c.j.a. .u.\|.y.t.k.o.w.n.

C:\Program Files (x86)\FastStone Capture\Languages\FSC11.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	287337
Entropy (8bit):	5.084769712386656
Encrypted:	false
SSDEEP:	3072:Y68baSA5X5Hu0lZAljh76AdqGSAh4Ojok+:IN0sjHqiW
MD5:	4D22416774EDEB268FAA292667C2355C
SHA1:	23A5E47CD15D135F4F6D15B89062867A41612D21
SHA-256:	990243CD9B361EFF4A4765360D25A2369D5DB0B9C70A878A836D6457D948227A
SHA-512:	781D1B429266EFD59F06C6B1DD9A8426D3468EF36E5DED7A3DADDF74CB459682F8F5BF0D68E26CFA76EEF08EFC5988B977C32ECA7B4871D7ACD2C68BC3F2C2FB
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About...... .?.@.>.3.@.0.<.<.5.....Label3..'...Copyright (C) %1% FastStone Corporation+.....2.B.>.@.A.:.8.5. .?.@.0.2.0. ... .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....!.0.9.B.:.....Label4......Support Email:......>.G.B.0. .?.>.4.4.5.@.6.:.8.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:......5.@.5.2.>.4.:.....Label6......Translator's name).....<... ...@.>.E.8.=. .(.e.r.o.d.i.m.@.m.a.i.l...r.u.).,. ..... .$.5.4.>.@.5.=.:.>.....BntHome......Visit Home Page......>.<.0.H.=.O.O. .A.B.@.0.=.8.F.0.....BntPurchase......Buy Now......C.?.8.B.L.....BntClose......Close......0.:.@.K.B.L.....VersionLabel......Version %1%......5.@.A.8.O. .%.1.%.....RegisterToText......Unregistered Trial Version#.....5.7.0.@.5.3.8.A.B.@.8.@.>.2.0.=.=.0.O. .?.@.>.1.=.0.O. .2.5.@.A.8.O.................MyStringCollection.S01......Single-User License......4.=.

C:\Program Files (x86)\FastStone Capture\Languages\FSC12.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	307951
Entropy (8bit):	4.348845877617973
Encrypted:	false
SSDEEP:	3072:ti+IFWdHeM4c5SYYmSw+VbaqK7Oyw1uCUzFc+hm2y7fa8iUob/HbE8LKGcTZaM7b:ti+IB0YmSDbYw1u91m2yWLK1ZaMf
MD5:	DB6281DFCDD5E027D405362B94A5E89D
SHA1:	F879471662E0C2ABF937BF3B5EED73A10A03400B
SHA-256:	E83D3420658244CC0CC067D4E8F462C03DA4EA04255E525A38FFE78A77E21591
SHA-512:	A9BBE3155A19EA471E355452F7E0E5A769E4ACB3B62F4C1DDFDD289FB0683730600CA0F10F2C97A93D2CEC3F3DE05802CF3982F7E65E63BB5CAB75D55676FFED
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About....A.c.e.r.c.a. .d.e.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....S.i.t.i.o. .w.e.b.:.....Label4......Support Email:....E.m.a.i.l. .d.e. .s.o.p.o.r.t.e.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....T.r.a.d.u.c.i.d.o. .p.o.r.:.....Label6......Translator's name....A.i.t.o.r. .M.......BntHome......Visit Home Page....P...g.i.n.a. .w.e.b. .p.r.i.n.c.i.p.a.l.....BntPurchase......Buy Now....C.o.m.p.r.a.r. .a.h.o.r.a.....BntClose......Close....C.e.r.r.a.r.....VersionLabel......Version %1%....V.e.r.s.i...n. .%.1.%.....RegisterToText......Unregistered Trial Version....V.e.r.s.i...n. .d.e. .p.r.u.e.b.a. .n.o. .r.e.g.i.s.t.r.a.d.a.................MyStringCollection.S01......Single-User License....L.i.c.e.n.c.i.a. .d.e. .u.n. .s.o.l.o. .u.s.u.a.

C:\Program Files (x86)\FastStone Capture\Languages\FSC13.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	299307
Entropy (8bit):	4.529750204459055
Encrypted:	false
SSDEEP:	3072:lfjLd5ks8kKfRD1bcgR9qTFTLDByE4n6TdhnZmlkn+WjUVeHo5y4EuIXlkOFLmOz:IWjUVeHo5y4FRfsPpuhtv+
MD5:	E95134798E06DB4E1E52BC5DC7A49B77
SHA1:	872FA05CC614C429289540F3434CB65E2607CEB7
SHA-256:	88713CB53CB6E879A8B6408644BF500AB488A3DAD4F01A412EC98C9F8EE1A3FC
SHA-512:	766D1BD91FDE0FB90DED2A706DD2482109F2F26CCCEFBB21FDFFD31EDD08D085D54576858D4F3DD4B0BC27F3C1112FDD95BF8A38119C303380019E5B36F171C3
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About....N...v.j.e.g.y.....Label3..'...Copyright (C) %1% FastStone Corporation)...S.z.e.r.z.Q.i. .j.o.g. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....W.e.b.o.l.d.a.l.:.....Label4......Support Email:......g.y.f...l.s.z.o.l.g...l.a.t.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....F.o.r.d...t...:.....Label6......Translator's name....Z.i.t.y.i.'.s. .T.r.a.n.s.l.a.t.o.r. .T.e.a.m.....BntHome......Visit Home Page....W.e.b.o.l.d.a.l. .f.e.l.k.e.r.e.s...s.e.....BntPurchase......Buy Now....V...s...r.l...s.....BntClose......Close....B.e.z...r...s.....VersionLabel......Version %1%....V.e.r.z.i...:. .%.1.%.....RegisterToText......Unregistered Trial Version....R.e.g.i.s.z.t.r...l.a.t.l.a.n. .p.r...b.a.v.e.r.z.i...................MyStringCollection.S01......Single-User License....E.g.y.f.e.l.h.a.s.z.n...l...s. .l.i.c.e.n.c.....My

C:\Program Files (x86)\FastStone Capture\Languages\FSC15.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	222445
Entropy (8bit):	5.641112659354512
Encrypted:	false
SSDEEP:	3072:fIHMLiOdP9mbmTvL20ripqXL7gXTKMqMS+G+wMd+QtA464nM6TAkXTMqHoZRitc:Z+jkMdVTjMqAF
MD5:	7931DD3115D08D00D7A765FA7CE30DE5
SHA1:	22D5BA1C5F1AD0FA5ECBE231B82A8C9C59754CB9
SHA-256:	F6BC47A9A2A1263EEF4AFFB4DC27594B3DD08C245C66B710BB7F0EBF794CCA45
SHA-512:	2B0A639DC5D5B62991CC62891F55AA329EB3851A114D726B86245DF6EE3D1A3D7041AB0958534B1C6555FDEC6A70F164FF93031046708B2CCDDD500ED2996CA9
Malicious:	false
Preview:	........L.......TAboutWindow*...........AboutWindow......About...............Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....H..t...:.....Label4......Support Email:....0. .....:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:.........:.....Label6......Translator's name.............BntHome......Visit Home Page....H..t... .).8.....BntPurchase......Buy Now........ .l......BntClose......Close.....0.....VersionLabel......Version %1%........ .%.1.%.....RegisterToText......Unregistered Trial Version....D..]. .......................MyStringCollection.S01......Single-User License.....\|. ...... .\|.t. .......MyStringCollection.S02..,...Family License that covers up to 5 computers....\... .5...X. .....0... ........ ...q. .\|.t. .......MyStringCollection.S03......Educational Site License....P.!.. ...t.. .\|.t.

C:\Program Files (x86)\FastStone Capture\Languages\FSC16.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	281187
Entropy (8bit):	4.5969337407860955
Encrypted:	false
SSDEEP:	3072:Es0TFO00rfnFBWrJa058R/G7QBhUQILMnCbVDb3rOJO0pReH3OzQTLZ38Vczg235:1rq00beU0OZue
MD5:	42803A06471EEF21A74B0ABF298045C9
SHA1:	C501D41B91F1039441D3AE947038272C6FFE901F
SHA-256:	44573027139C04EDC2C506427900B91261410EDD3B40067F39C33A68DB2BD87A
SHA-512:	CB423C8E43594F27985A1B380B769FCA76631B34DEF0B29287E3715AA2E8E83A909282EB0ED4CC7F0CE81BC373FCE71A655CA94DCB95CED20A7A23D23796C661
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About....O. .p.r.o.g.r.a.m.u.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....D.o.m.o.v.s.k... .s.t.r...n.k.a.:.....Label4......Support Email:....E.m.a.i.l. .p.o.d.p.o.r.y.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....P.Y.e.k.l.a.d.a.t.e.l.:.....Label6......Translator's name....T.Y.a.s...k. .J.i.Y.......BntHome......Visit Home Page....N.a.v.a.t...v.i.t. .d.o.m.o.v.s.k.o.u. .s.t.r...n.k.u.....BntPurchase......Buy Now....K.o.u.p.i.t. .n.y.n.......BntClose......Close....Z.a.v.Y...t.....VersionLabel......Version %1%....V.e.r.z.e. .%.1.%.....RegisterToText......Unregistered Trial Version....N.e.r.e.g.i.s.t.r.o.v.a.n... .z.k.u.a.e.b.n... .v.e.r.z.e.................MyStringCollection.S01......Single-User License....L.i.c.e.n.c.e. .p.r.o. .j.e.d.n.o.

C:\Program Files (x86)\FastStone Capture\Languages\FSC17.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	285949
Entropy (8bit):	4.46474682172852
Encrypted:	false
SSDEEP:	3072:DiufPpIQOF2TKleELRK5TXDELgDTAYh0adSyGpt8jPUhveNgm/sX+Bg:DtlSpY72V
MD5:	47269D776F98B5AF251476542EA8BC35
SHA1:	9BBA10DAADB3E396C142ED730773763FE3AED7AB
SHA-256:	9C57304F183D9992A71423597350F312CA954B3BE7549F4EA22C6961D70E20DD
SHA-512:	104BC221FFBD79670CFF0AEDB7B778780BF97896FA3B3A4436045FA6C71EEF4A1510CEF3CDA37C24D85CBF89CB91AE5C805F5A212E56FAF045238C4C0FA31BB2
Malicious:	false
Preview:	........L.......TAboutWindow>...........AboutWindow......About....O.m.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....H.e.m.s.i.d.a.:.....Label4......Support Email:....E.-.p.o.s.t. .f...r. .s.u.p.p.o.r.t.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:......v.e.r.s.a.t.t. .a.v.:.....Label6......Translator's name....G...r.a.n.....BntHome......Visit Home Page....B.e.s...k. .h.e.m.s.i.d.a.n.....BntPurchase......Buy Now....K...p. .n.u.....BntClose......Close....S.t...n.g.....VersionLabel......Version %1%....V.e.r.s.i.o.n. .%.1.%.....RegisterToText......Unregistered Trial Version....O.r.e.g.i.s.t.r.e.r.a.d. .t.e.s.t.v.e.r.s.i.o.n.................MyStringCollection.S01......Single-User License....E.n.a.n.v...n.d.a.r.l.i.c.e.n.s.....MyStringCollection.S02..,...Family License that covers up to 5 computers+...F.

C:\Program Files (x86)\FastStone Capture\Languages\FSC19.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	288439
Entropy (8bit):	5.084924661347102
Encrypted:	false
SSDEEP:	3072:lCPodg0A9DvuRj6Jg+JO0ErxULF3ayeUlEk:9uCYO0wMNp
MD5:	429BE29D82949F0CAB1C591936F4E06C
SHA1:	FA0318110D426237E632653AF60E7B3D093292C1
SHA-256:	499D76FE0E79FEA2C1288C960CE2543E65FC5C6F295875557C70631DC6342D86
SHA-512:	A596F9787B663C5608CE00623248F30F554074396DCFC740D68E7271D213B447D7F93B5C953FC082A46E2565E401BEF0EDA4AFE9E8E8F0E1D83DF9BE77EA3C84
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About......@.>. .?.@.>.3.@.0.<.C.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:......5.1.A.0.9.B.:.....Label4......Support Email:......;... .?.>.H.B.0. .?.V.4.B.@.8.<.:.8.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:......5.@.5.:.;.0.4.:.....Label6......Translator's name......2.3.5.=.V.9. ...V.@.>.H.=.8.G.5.=.:.>.....BntHome......Visit Home Page......>.<.0.H.=.O. .A.B.>.@.V.=.:.0.....BntPurchase......Buy Now......C.?.8.B.8. .=.5.3.0.9.=.>.....BntClose......Close......0.:.@.8.B.8.....VersionLabel......Version %1%......5.@.A.V.O. .%.1.%.....RegisterToText......Unregistered Trial Version......5.7.0.@.5.T.A.B.@.>.2.0.=.0. .2.8.?.@.>.1.=.0. .2.5.@.A.V.O.................MyStringCollection.S01......Single-User License......V.F.5.=.7.V.O. .4.;.O. .>.4.=.

C:\Program Files (x86)\FastStone Capture\Languages\FSC20.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	286837
Entropy (8bit):	5.08354792237096
Encrypted:	false
SSDEEP:	3072:vy8uSh91u689tbCijgDY8nF8rC/coedjp7khomqznSCtudPrpNdn/RaBugUi:kWOp7rAJ0
MD5:	5BFB37398A8739D751266A216A070F66
SHA1:	61412B871A07F07F9B1D0598B03F45DE5055762B
SHA-256:	6654E2CD70E94C0DF6D400A1A311EF2048473C3FECD61C6D76288E0B11F6E77F
SHA-512:	4A535F6941AE344233A071B3A5E04473F77B24C82EC21778D405019A8DC39F78B516F594AC29D5D878595A07137A6AD021CC214C97201FE5DF3BF5405B28502D
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About......B.=.>.A.=.>.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....#.5.1. .!.0.9.B.:.....Label4......Support Email:......>.4.4.@.J.6.:.0. .E.m.a.i.l.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:......@.5.2.5.4.5.=.>. .>.B.:.....Label6......Translator's name......5.>.@.3.8. ..... .&.2.5.B.0.=.>.2.....BntHome......Visit Home Page......>.A.5.B.8. ...>.<.0.H.=.0. .!.B.@.0.=.8.F.0.....BntPurchase......Buy Now......C.?.8. .!.5.3.0.....BntClose......Close......0.B.2.>.@.8.....VersionLabel......Version %1%......5.@.A.8.O. .%.1.%.....RegisterToText......Unregistered Trial Version......5.@.5.3.8.A.B.@.8.@.0.=.0. ...@.>.1.=.0. ...5.@.A.8.O.................MyStringCollection.S01......Single-User License......4.=.>.;.8.G.5.=. ...>.B.@.5.1.8.B.5.;.A.:.8.

C:\Program Files (x86)\FastStone Capture\Languages\FSC21.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	225967
Entropy (8bit):	5.62856445840315
Encrypted:	false
SSDEEP:	3072:yUXQNADvhPuuS82K9eH5UWidjOHLP6lC0KGTCNLY+3Ozey4WijhHJvfN7BZy9:OPqWKKT3u+NC4W0fNU
MD5:	C6DDC92D5448E304A3734E167AA27F3A
SHA1:	7CCCF975C5190654CB1D1264B53CEE8F5BC5A863
SHA-256:	95110C36EA1E06E3F74E6E6BC6BEB94AF32D867CD4AB364D90F53773FB5AFD08
SHA-512:	3615EFED949845901AAA37E848B212A7EF0D3E31AAA11896C53BA074AC0F9CED73F7341CE6F4FEEA5D61E4B137177D4A8133E9A74A780DB830AEFDC5862125BC
Malicious:	false
Preview:	........L.......TAboutWindowD...........AboutWindow......About.......T.`1X....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:.....0.0.0.0.0.0:.....Label4......Support Email:.....0.0.0.0.0.0.0:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:......3..c.O:.....Label6......Translator's name....N.g.u.y.e.n. .M.i.n.h. .H.i.e.u.....BntHome......Visit Home Page.....0.0.0.0.0.0x0....BntPurchase......Buy Now.....0.0.0.0.0.0..eQ....BntClose......Close....B}.N....VersionLabel......Version %1%.....0.0.0.0.0 .%.1.%.....RegisterToText......Unregistered Trial Version.....0.0.0.0.0*g.S._f.(uHr................MyStringCollection.S01......Single-User License.....P.N(u.0.0.0.0.0....MyStringCollection.S02..,...Family License that covers up to 5 computers.....g'Y.z+g5..S~0g0.[.e(u.0.0.0.0.0....MyStringCollection.S03......Educational

C:\Program Files (x86)\FastStone Capture\Languages\FSC22.fslang

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	298779
Entropy (8bit):	4.404260012828611
Encrypted:	false
SSDEEP:	3072:oy7pQA4QiFWF4AEl8qSC84aQpW1ZaMondC07EpBTh2lipBbJ4IDboeq:o35Al1e
MD5:	518EABDCA3C23F2CD40987C15C3184E5
SHA1:	733367184D305AECB1EB8062F8E9E4B3155BB42C
SHA-256:	F19692D21D4E7232AA14A1E8653B594E77DAA0F512227843FAA334511F183E26
SHA-512:	15E48CD882D06930D103DA38FBC8967E2B0DF13E7A88B5DF6F8E5AB3EF5C347830A9817574C34C8F8949F6C5220C6C38070FCE42E97B495A2DBF8E0F8D5558E4
Malicious:	false
Preview:	........L.......TAboutWindow............AboutWindow......About....S.o.b.r.e.....Label3..'...Copyright (C) %1% FastStone Corporation'...C.o.p.y.r.i.g.h.t. .(.C.). .%.1.%. .F.a.s.t.S.t.o.n.e. .C.o.r.p.o.r.a.t.i.o.n.....Label2......Web Site:....S.i.t.e. .n.a. .W.e.b.:.....Label4......Support Email:....E.-.m.a.i.l. .d.e. .S.u.p.o.r.t.e.:.....LblWebsite......www.FastStone.org........LblEmail......support@FastStone.org........Label5......Translated by:....T.r.a.d.u.z.i.d.o. .p.o.r.:.....Label6......Translator's name....A.l.d.i.n.e.y. .O.l.i.v.e.i.r.a.....BntHome......Visit Home Page....V.i.s.i.t.a.r. .a. .H.o.m.e. .P.a.g.e.....BntPurchase......Buy Now....C.o.m.p.r.a.r. .A.g.o.r.a.....BntClose......Close....F.e.c.h.a.r.....VersionLabel......Version %1%....V.e.r.s...o. .%.1.%.....RegisterToText......Unregistered Trial Version....V.e.r.s...o. .d.e. .T.e.s.t.e. .N...o. .R.e.g.i.s.t.r.a.d.a.................MyStringCollection.S01......Single-User License....L.i.c.e.n...a. .d.e. .U.s.u...r.i.o. ...

C:\Program Files (x86)\FastStone Capture\Languages\FSCaptureHelp_11.chm

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	299443
Entropy (8bit):	7.9635098115442915
Encrypted:	false
SSDEEP:	6144:mbJ0F6V3McbEG1RugYA9gHaSfgj/5avUjjzY9/k6ex3Mh0O5qw:o0i3MpA9g6SI7YUjjc9yx3MJh
MD5:	DB2FA7AF15BFF26038A8F9002E295A40
SHA1:	65B9F52E56D4F7535C01E2DBAD9EA5622ACFCF2F
SHA-256:	50AF8EF32BFB634E6508BEF4D6B1E8740023FF32305FA969F36AED7AE55AED35
SHA-512:	34E9C7F1E0EE734F17668EAE9332A866E8EFABF7CE81394EE8BDDA788E1581F4A9323A7FB566EA24D5590CDE27F29F9206656990E46FF6967085BB4FD9350419
Malicious:	false
Preview:	ITSF....`........s.8.......\|.{.......".....\|.{......."..`...............x.......T.......................................ITSP....T...........................................j..].!......."..T...............PMGL'................/..../#IDXHDR...e.../#ITBITS..../#STRINGS...O.c./#SYSTEM....5./#TOPICS...e.@./#URLSTR...5.../#URLTBL...%.../$FIftiMain..../$OBJINST...J.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...F../$WWKeywordLinks/..../$WWKeywordLinks/BTree...N.L./$WWKeywordLinks/Data......./$WWKeywordLinks/Map....../$WWKeywordLinks/Property...& ./ActiveWindow.gif....j./CaptureButtons.gif......./CapturePanel.gif...y..../CapturePanel.htm....L./CaptureSmallBar.gif...C.../CloseButton.gif.....a./CloseTabButton.gif......./ContactUs.htm...h.W./CutVideo.gif...j.../DelayCapture.gif...U.K./DragCursorShape.gif...R.../DrawVideoButton.gif.....*./Editor.htm...?.'./EditVideoButton.gif...f.../EditVideoFile.htm.....?./FastStoneLogo.gif...b.../Features.htm...f.q./FixRegion.gif...>."./Freehand.gif.

C:\Program Files (x86)\FastStone Capture\LicenseAgreement.txt

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.539411659056302
Encrypted:	false
SSDEEP:	24:9HE4Qt3+Ri45l+3mMIRW0QgbEL8JhQm46EWLR1gmcEy:udt3+Ri45l+WJoTH4J2mGWd1+Z
MD5:	2372C82DB2B5977877CA02FD643DFC10
SHA1:	BDFA3C625E3620CF2CA9DFB349FD73EC0EDDA645
SHA-256:	E468C5223B0E36710B0430A8F664B434DEC2A3B058603AF3282EDDBE62A996F6
SHA-512:	8269DAE425E15CCEE965CAE401B3BDB6398D13F2B63CA3040CE1B0845CD874994820DE0D850578099F1AE25C3A27AB9F2456D2ED044CF92506A309A133E03153
Malicious:	false
Preview:	Please read the following terms and conditions carefully before using FastStone Capture. Use of FastStone Capture indicates you accept the terms of this license agreement and warranty.....1. Disclaimer of Warranty....FastStone Capture (this software) is provided "as-is" and without warranty of any kind, express, implied or otherwise, including without limitation, any warranty of merchantability or fitness for a particular purpose. ....In no event shall the author of this software be held liable for data loss, damages, loss of profits or any other kind of loss while using or misusing this software.....2. License....FastStone Capture is shareware. You may try it free for 30 days. Once this 30-day period has expired, you must either purchase a license to use this software, or uninstall it from your computer promptly.....3. Restrictions on Use ....FastStone Capture must not be decompiled, disassembled, reverse engineered or otherwise modified. ......Copyright (C) 2024 FastStone Corporation

C:\Program Files (x86)\FastStone Capture\Website.url

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.faststone.org>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.448367439558377
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S4YWW7orvn:HRYFVm/r4YFo7n
MD5:	FC1E05873C9D464E374366092FC226A3
SHA1:	D58AFD89E33A709E20BCEEF81DCB2FC88A05C4AF
SHA-256:	34C6F429648B294039A085097E6485BFB4F19F1CE43654534C4119E7DB6CD797
SHA-512:	129C49E17AAE96603CDC0A0C2B9644ED46C9E3DF285FCFE325ED882335BF1CA160C4B9D42C254267BDA69C679D668E6E1DAC1518B6222D1800249F0602F5B947
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.faststone.org..

C:\Program Files (x86)\FastStone Capture\libsharpyuv.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	106640
Entropy (8bit):	6.818161398972172
Encrypted:	false
SSDEEP:	1536:/ZZZg5wwcuBil+UaTJwb6Y2FadNyPLxbuvtmgMbFuQh5gRbbbbbbbGUvy+yx:DDkjtqwIAg0FuQh5g0Uv
MD5:	0CE639618B3E361EFA1B09CF8FFE3D95
SHA1:	A1A08B5914A16772CCD9D699D938115E1618D424
SHA-256:	D34FB573DBB827161A4FFB22A6F06F8AC30778CCC5C8B173950B9D49BA2795C2
SHA-512:	249D12F438CF25C42A1ECC3F0BBF10E985DD88C7E5F3137C757EF5E6614D33FC3916675F32481B7BB448464CA37BB5E20B088D7E0BCCBF17525F07D42969A976
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;6..ZXN.ZXN.ZXN.#N.ZXN.ZYN.ZXN...N.ZXN...N.ZXN...N.ZXN...N.ZXN...N.ZXN...N.ZXNRich.ZXN........PE..L......e...........!.................C..............................................\|Z.............................. h.......b..(.......8............z...&..........................................._..@............................................text............................... ..`.rdata...X.......Z..................@..@.data....6...p.......P..............@....rsrc...8............d..............@..@.reloc...............h..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FastStone Capture\libwebp.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	503440
Entropy (8bit):	6.790981016396434
Encrypted:	false
SSDEEP:	6144:kee+bf9cK2+k5NkwaFmMNf6HMdeI3aji2ek+OKHepZwgL7SCr+Sf9EAOmDGPnc:q8Me6IA1ek+/SVEU+
MD5:	EF19B06FF151B46589DE08CDD17F5282
SHA1:	BA552C68FB231615731CFAEF3703FEAACA7B5794
SHA-256:	56A31BF39A191303F1B4D8766F481B974D35F3E39EB9525D8E4E88989F7B6F0D
SHA-512:	C87CDED8B3E7D954785534764C7665D08A5B4E30A8E1F8C4ED3D017BB9C27C64944C9C3C95BB0832B6B17C3EE86412BA23F4CA215FCDCD792002E5E64E02F2AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q.\|.../.../.../../.../.BZ/.../.BK/.../.BM/.../.../.../.B]/.../.BL/.../.BJ/.../.BO/.../Rich.../........PE..L......e...........!.....^...<...............p.......................................................................J.......C..<....... ................&......L....................................@..@............p..,............................text...D].......^.................. ..`.rdata.......p.......b..............@..@.data....(...`.......H..............@....rsrc... ............\..............@..@.reloc...'.......(...`..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FastStone Capture\uninst.exe

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	86264
Entropy (8bit):	7.106001835624037
Encrypted:	false
SSDEEP:	1536:rmsAYBdTU9fEAIS2PEtuo83hvVVZ+L8hRKPy6PTZ7xxB:qfY/TU9fE9PEtuh+fy6PTZF
MD5:	83BC9466FA5B28383A14C226D792896A
SHA1:	7504F83E247DF1CFFC4B29BF61660EA9CF25A4A9
SHA-256:	4EF87F73E6B7A7DA6745DA4F9B304BE375B9EBCF2341D366565D40F5FABEC77B
SHA-512:	D2211C52BCCAFFEF54E2AC45FED86454799D1C4658B7CC517E7AA6E8848F8F0396492B5005E428122049B8066E3D9943CCEB5EF2468FC1660CDB80ED0D2E6214
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@..................................x....@.............................................(...........p'...)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...(........0..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Capture\FastStone Capture Help.lnk

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri May 17 21:58:50 2024, mtime=Mon Oct 7 08:00:34 2024, atime=Fri May 17 21:58:50 2024, length=176729, window=hide
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	4.631282139390456
Encrypted:	false
SSDEEP:	24:8mYlGP6EtdOEB7eFGJwAA8yWdQVJ4dL/oUUl7qygm:8mYlGPttdOAi4pA8Td+GdL/9byg
MD5:	E4E19CF1D06CA94661C36337DCD0B2EF
SHA1:	35BD2964F63A9178A7310DBB7F22FE55D3A41F9A
SHA-256:	A58A772F4CD1D256AD0D716BE777BDBC8F48BC0A1DD0B38F0E74F31AAEBBD3F3
SHA-512:	4B8ED4DC7715DF69AF1A05A9B678E1359E88129AE6FCC1F6E59B32A02F8BCFA07476B52231125A852D4FF2C82F0A939757D87FFEB2AB4EB9F4DA0C8FEA31DC0E
Malicious:	false
Preview:	L..................F.... .........."..^...........Y............................P.O. .:i.....+00.../C:\.....................1.....GY.H..PROGRA~2.........O.IGY.H....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....l.1.....GY.H..FASTST~1..T......GY.HGY.H...........................3..F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.....p.2.Y....XY. .FSCAPT~1.CHM..T......XY.GY.H..............................F.S.C.a.p.t.u.r.e.H.e.l.p...c.h.m.......i...............-.......h...........c........C:\Program Files (x86)\FastStone Capture\FSCaptureHelp.chm..I.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.\.F.S.C.a.p.t.u.r.e.H.e.l.p...c.h.m.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.........*................@Z\|...K.J.........`.......X.......172892...........hT..CrF.f4... .E\|2=.b...,...W..hT..CrF.f4... .E\|2=.b...,...W..............1SPS.XF.L8C....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Capture\FastStone Capture.lnk

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Aug 20 23:18:26 2024, mtime=Mon Oct 7 08:00:32 2024, atime=Tue Aug 20 23:18:26 2024, length=7563656, window=hide
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	4.620172167775995
Encrypted:	false
SSDEEP:	24:8mxRuH46EtdOEBucOUUAk81UdQVOgdL/oUUlnqygm:8mxRuH4ttdOAu5Qk8Kd+OgdL/9nyg
MD5:	E47563E0521E7CD09C71F30FE4148EB2
SHA1:	5746B853BE57193AD7610DFBF3CFB7466DDE9294
SHA-256:	31048B149FC77727839B540647E36C3F429A1ECCA236D4E2616DEC3559555A2F
SHA-512:	9A7DE3DBA93EC70998A007D4AB65A99D2D2BC7360E2C47270E9FE86F1475B512895F1A7BC4EB1EC24F1015044CE2CA13E40477A9AE5A8F7E6B1C825593963918
Malicious:	false
Preview:	L..................F.... ......._.....]........_....is..........................P.O. .:i.....+00.../C:\.....................1.....GY.H..PROGRA~2.........O.IGY.H....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....l.1.....GY.H..FASTST~1..T......GY.HGY.H...........................3..F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.....h.2..is..YM. .FSCAPT~1.EXE..L.......YM.GY.H..............................F.S.C.a.p.t.u.r.e...e.x.e.......e...............-.......d...........c........C:\Program Files (x86)\FastStone Capture\FSCapture.exe..E.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.\.F.S.C.a.p.t.u.r.e...e.x.e.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.........*................@Z\|...K.J.........`.......X.......172892...........hT..CrF.f4... .@\|2=.b...,...W..hT..CrF.f4... .@\|2=.b...,...W..............1SPS.XF.L8C....&.m.q............/..

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Capture\Uninstall FastStone Capture.lnk

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Aug 20 23:36:40 2024, mtime=Mon Oct 7 08:00:34 2024, atime=Tue Aug 20 23:36:40 2024, length=86264, window=hide
Category:	dropped
Size (bytes):	1149
Entropy (8bit):	4.622070953552665
Encrypted:	false
SSDEEP:	24:8meTYf6EtdOEgVPR8ADcdCGgdL/oUUl/qygm:8mZttdOlVPR7DcdCGgdL/9nyg
MD5:	371919597AB41E2BFA7B9BF59E738960
SHA1:	9212A1574D8E5EBE8912D520B69BDEAB828CED7C
SHA-256:	BF6B7E2ADB081AFF4C26E8B9DF968D2B017B56A0393C56C8EE5CB44F125B3BF1
SHA-512:	19F7BF73D91E0C500DB137258914C64F824F7AC2A7817B9DEA1BB2932B7C34153B4CEAC30A3136591AA98AE7DD889E2F3FE0E3F60E88337E2DC0906DCCC8F6D3
Malicious:	false
Preview:	L..................F.... ......0b....$.^.......0b....P...........................P.O. .:i.....+00.../C:\.....................1.....GY.H..PROGRA~2.........O.IGY.H....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....l.1.....GY.H..FASTST~1..T......GY.HGY.H............................}.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.....`.2..P...Y.. .uninst.exe..F.......Y..GY.H....!.........................u.n.i.n.s.t...e.x.e.......b...............-.......a...........c........C:\Program Files (x86)\FastStone Capture\uninst.exe..B.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.\.u.n.i.n.s.t...e.x.e.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.........*................@Z\|...K.J.........`.......X.......172892...........hT..CrF.f4... .J\|2=.b...,...W..hT..CrF.f4... .J\|2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Capture\Visit www.FastStone.org.lnk

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Oct 7 08:00:35 2024, mtime=Mon Oct 7 08:00:35 2024, atime=Mon Oct 7 08:00:35 2024, length=50, window=hide
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.594823221399007
Encrypted:	false
SSDEEP:	24:8mE/6EtdOEBVUubAKQrd6CdL/oUUlHqygm:8mQttdOABMKQrd6CdL/93yg
MD5:	6A3CCFE69685308213004BE9A25B7932
SHA1:	F28C847D2074DA3D5E8A19472CCA8D140A7B1460
SHA-256:	07F608EA42ED8FD05C82A08FAFB06CFD095DF3F8093563B962D5DE022BB460EE
SHA-512:	9AE55746FB2468C9EBD9A3E593FED165C9B11B67764E17CA7A82456410D08E655F61B7239D8446E738F48E6FD4B2899A56208EAA0B5C5BF7B1E9598CE71AF7E9
Malicious:	false
Preview:	L..................F.... ...G.._....G.._....G.._....2............................P.O. .:i.....+00.../C:\.....................1.....GY.H..PROGRA~2.........O.IGY.H....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....l.1.....GY.H..FASTST~1..T......GY.HGY.H...........................3..F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.....b.2.2...GY.H .Website.url.H......GY.HGY.H....X.......................}.W.e.b.s.i.t.e...u.r.l.......c...............-.......b...........c........C:\Program Files (x86)\FastStone Capture\Website.url..C.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.\.W.e.b.s.i.t.e...u.r.l.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.........*................@Z\|...K.J.........`.......X.......172892...........hT..CrF.f4... .H\|2=.b...,...W..hT..CrF.f4... .H\|2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-

C:\Users\Public\Desktop\FastStone Capture.lnk

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Aug 20 23:18:26 2024, mtime=Mon Oct 7 08:00:35 2024, atime=Tue Aug 20 23:18:26 2024, length=7563656, window=hide
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.6376238162703665
Encrypted:	false
SSDEEP:	24:8mx+46EtdOEBucOUUAk81RdQVOgdL/oUUlnqygm:8mx+4ttdOAu5Qk8fd+OgdL/9nyg
MD5:	E55FF78CE489A03302829FD09F6DE135
SHA1:	36083C821B2F413C36A0C1FCA9B8B0943E0C0311
SHA-256:	71DA05C757C034CEA473650219927AD23B3053BF0C90287EB162249119AF468B
SHA-512:	88BAAB8C8647F9504C4C675124EE7E15C8D62EB1AD558281A3B35DAD332241E352388AD219F5372B42A3B2E7119E0E3CD7910B535E0F9D78C3C094C4BC0BA3FC
Malicious:	false
Preview:	L..................F.... ......._...z.._........_....is..........................P.O. .:i.....+00.../C:\.....................1.....GY.H..PROGRA~2.........O.IGY.H....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....l.1.....GY.H..FASTST~1..T......GY.HGY.H...........................3..F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.....h.2..is..YM. .FSCAPT~1.EXE..L.......YM.GY.H..............................F.S.C.a.p.t.u.r.e...e.x.e.......e...............-.......d...........c........C:\Program Files (x86)\FastStone Capture\FSCapture.exe..<.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.\.F.S.C.a.p.t.u.r.e...e.x.e.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e.........*................@Z\|...K.J.........`.......X.......172892...........hT..CrF.f4... .@\|2=.b...,...W..hT..CrF.f4... .@\|2=.b...,...W..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-

C:\Users\user\AppData\Local\Temp\nsf6353.tmp\InstallOptions.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.471852540236525
Encrypted:	false
SSDEEP:	384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
MD5:	ECE25721125D55AA26CDFE019C871476
SHA1:	B87685AE482553823BF95E73E790DE48DC0C11BA
SHA-256:	C7FEF6457989D97FECC0616A69947927DA9D8C493F7905DC8475C748F044F3CF
SHA-512:	4E384735D03C943F5EB3396BB3A9CB42C9D8A5479FE2871DE5B8BC18DB4BBD6E2C5F8FD71B6840512A7249E12A1C63E0E760417E4BAA3DC30F51375588410480
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.px.q.+.q.+.q.+.q.+[q.+.~C+.q.+^R.+.q.+^R/+.q.+.w.+.q.+.Q.+.q.+Rich.q.+........PE..L....Oa...........!.........`.......+.......0............................................@..........................8......X1..................................X....................................................0..X............................text............................... ..`.rdata..G....0......."..............@..@.data...DL...@.......,..............@....rsrc................6..............@..@.reloc..x............8..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ShellExecAsUser.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	5.825224158327635
Encrypted:	false
SSDEEP:	768:SA49ATJ9ONLkh9J5lDYDzG8yVAf7hiJFkkAqnTEDlV4vihdk:SA4CJ9OFpXf0AfNiTkIMrhdk
MD5:	552CBA3C6C9987E01BE178E1EE22D36B
SHA1:	4C0AB0127453B0B53AEB27E407859BCCB229EA1B
SHA-256:	1F17E4D5FFE7B2C9A396EE9932AC5198F0C050241E5F9CCD3A56E576613D8A29
SHA-512:	9BCF47B62CA8FFA578751008CAE523D279CDB1699FD916754491899C31ACE99F18007ED0E2CBE9902ABF132D516259B5FB283379D2FEAD37C76B19E2E835E95A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..\.j...j...j....n..j....[..j....o.Jj....F..j....V..j...j..nj..\I...j....j..j....^..j....X..j..Rich.j..........PE..L....z.[...........!.....V...R......T........p............................................@.........................0...V............................................................................................p...............................text....U.......V.................. ..`.rdata...0...p...2...Z..............@..@.data...............................@....rsrc...............................@..@.reloc..f...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsf6353.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ioSpecial.ini

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	3.6739774731888986
Encrypted:	false
SSDEEP:	24:Q+sxvtSSAD5ylSjqWCs7y6PaGk9nUvO6k8l6yCxG/wCk6ZEcbYpPm8aH65OESC+d:rsx9AQSjqQtaGq8l6Jwgg/8aNEo
MD5:	34A7D2A7AF0A88E8363F46E5BA8DBDF9
SHA1:	0141380A908310D2BFDF09A38F4A5C7191175874
SHA-256:	C010E479C847960AE3EF4B9C1E4ED67E0E5A40D82B2199749012584AB65C189D
SHA-512:	BFF2104C25B7CA3093E1AFD7731B8EA84C5A2D94AEBD7F90E9E911AD3C11873FDD66F1D9E0D6AECF4CDF20B25D820EB60615B5011127DA91C8145AC2F7FFA6D1
Malicious:	false
Preview:	..[.S.e.t.t.i.n.g.s.].....R.e.c.t.=.1.0.4.4.....N.u.m.F.i.e.l.d.s.=.4.....R.T.L.=.0.....N.e.x.t.B.u.t.t.o.n.T.e.x.t.=.&.F.i.n.i.s.h.....C.a.n.c.e.l.E.n.a.b.l.e.d.=.....S.t.a.t.e.=.0.....[.F.i.e.l.d. .1.].....T.y.p.e.=.b.i.t.m.a.p.....L.e.f.t.=.0.....R.i.g.h.t.=.1.0.9.....T.o.p.=.0.....B.o.t.t.o.m.=.1.9.3.....F.l.a.g.s.=.R.E.S.I.Z.E.T.O.F.I.T.....T.e.x.t.=.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.n.s.f.6.3.5.3...t.m.p.\.m.o.d.e.r.n.-.w.i.z.a.r.d...b.m.p.....H.W.N.D.=.3.2.8.7.5.8.....[.F.i.e.l.d. .2.].....T.y.p.e.=.l.a.b.e.l.....L.e.f.t.=.1.2.0.....R.i.g.h.t.=.3.1.5.....T.o.p.=.1.0.....T.e.x.t.=.C.o.m.p.l.e.t.i.n.g. .F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e. .1.0...7. .S.e.t.u.p.....B.o.t.t.o.m.=.3.8.....H.W.N.D.=.1.3.2.1.6.6.....[.F.i.e.l.d. .3.].....T.y.p.e.=.l.a.b.e.l.....L.e.f.t.=.1.2.0.....R.i.g.h.t.=.3.1.5.....T.o.p.=.4.5.....B.o.t.t.o.m.=.8.5.....T.e.x.t.=.F.a.s.t.S.t.o.n.e. .C.a.p.t.u.r.e. .1.0...7. .h.a.s. .b.e.e.n. .i.n.s.t.a.l.l.e.d. .o.n. .y.o.u.r. .c.o.

C:\Users\user\AppData\Local\Temp\nsf6353.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nsk6323.tmp

Download File

Process:	C:\Users\user\Desktop\FSCaptureSetup107.exe
File Type:	data
Category:	dropped
Size (bytes):	32544867
Entropy (8bit):	6.641357634400061
Encrypted:	false
SSDEEP:	393216:0NyDxBnY6BEwDaqOO2tAmSIbejC8MsaO8spyg372iQdbGEsKKhIkDUogGf:VZ5p2tAmlejX7xfKKNXf
MD5:	C27BCBE5BEC8D7934E99409F7C488115
SHA1:	E5161EBBAFE61B18CB73A9CFDB02E67F889A8D22
SHA-256:	59DD410C628ECCD245E06C78CAC3FBAF892D8C3B155C750BDBFF10584D19A259
SHA-512:	918475FF4355404EF00EDD5042C1B6992F0B89E2EBC612E7DFD12CA8141C5CD571443627A01ABB6D415E7B02FC4C5C1149736E2B1951E73B334599330F86E698
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\nsk6323.tmp, Author: Joe Security
Preview:	L.......,...................h...T^.......t..............................................................F.......(...........$...................................................................................................................................................................................................C...............................................f.......D...I...M.......#.......................%...............g.......N...S...T.......#.......................................j.......U...Z...[.......#...............................................................................................................g...............#...................................................N.......v{..................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999592105471024
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FSCaptureSetup107.exe
File size:	9'173'144 bytes
MD5:	28627a37983f5dc8e00d9c03c7b2dec6
SHA1:	dcfdb2464c29de44c6df1c1c0f5cf4a5342cfadb
SHA256:	762463fe496836bc1e6c6a58703f45182575b29494753df3145cd5c563e07f8c
SHA512:	78b25654eb1a3bc4a8912363dcf9d29c43228b0d8f55c8650c3c5995f950bcff25c3c7a38da07a589d1f95f08c8703b97bb7f4f7bcae697d9bcd2f98d1c7d79b
SSDEEP:	196608:L7yoYklb5pQI7m0XROHSUwwP9295bYiB+Y4NMQXIld:L7LD95pQIrEvJP9295bRB+Y4od
TLSH:	2D963348A4130C9CEE223135CD21560E6FA93B8177F6EE7737610F2DB411958BE94BEA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*.....

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x403640
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x614F9B1F [Sat Sep 25 21:56:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	61259b55b8912888e90f516ca08dc514

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	15/12/2023 01:00:00 13/02/2027 00:59:59
Subject Chain	CN=FastStone Corporation, O=FastStone Corporation, L=Calgary, S=Alberta, C=CA, SERIALNUMBER=2023017896, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Alberta, OID.1.3.6.1.4.1.311.60.2.1.3=CA
Version:	3
Thumbprint MD5:	AB94EFC876100EC3D079F9D89BD41FAC
Thumbprint SHA-1:	BA12BAAAC329C2CF0196B8BE73D529CFD13C621D
Thumbprint SHA-256:	90FDFFC9FAB65412F1BB5CBCD27B874F48E448DD088BC700EBF2E49C39505962
Serial:	0B617EE9ED189A94423BE7BB7564F0BF

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A230h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080C8h]
mov esi, dword ptr [004080CCh]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007F069C4FD17Ah
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007F069C4FD14Ah
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [0042A318h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3d000	0x2e28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8bcf10	0x2988
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6676	0x6800	6f5abe9eeda26ee84b3c1ed1a6c82001	False	0.6568134014423077	data	6.4174599871908855	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	8c5edfd8ff9cc0135e197611be38ca18	False	0.4498046875	data	5.141066817170598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	4b2421975c21b032f7ea000f5e7f9fbf	False	0.509765625	data	4.110582127654237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x12000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3d000	0x2e28	0x3000	6cc7344ca24af0ae995c058bd4b01acf	False	0.2158203125	data	3.6865643644558053	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3d628	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_ICON	0x3d910	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.3952702702702703
RT_DIALOG	0x3da38	0xb4	data	English	United States	0.6111111111111112
RT_DIALOG	0x3daf0	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x3dc10	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x3de18	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x3df10	0xee	data	English	United States	0.6302521008403361
RT_DIALOG	0x3e000	0xa0	data	English	United States	0.6
RT_DIALOG	0x3e0a0	0x10c	data	English	United States	0.5111940298507462
RT_DIALOG	0x3e1b0	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x3e3a0	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x3e488	0xda	data	English	United States	0.6467889908256881
RT_DIALOG	0x3e568	0xa4	data	English	United States	0.6158536585365854
RT_DIALOG	0x3e610	0x110	data	English	United States	0.5183823529411765
RT_DIALOG	0x3e720	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x3e918	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x3ea00	0xde	data	English	United States	0.6621621621621622
RT_DIALOG	0x3eae0	0xa0	data	English	United States	0.60625
RT_DIALOG	0x3eb80	0x10c	data	English	United States	0.5111940298507462
RT_DIALOG	0x3ec90	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x3ee80	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x3ef68	0xda	data	English	United States	0.6513761467889908
RT_DIALOG	0x3f048	0xac	data	English	United States	0.6337209302325582
RT_DIALOG	0x3f0f8	0x118	data	English	United States	0.5321428571428571
RT_DIALOG	0x3f210	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x3f410	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x3f500	0xe6	data	English	United States	0.6652173913043479
RT_GROUP_ICON	0x3f5e8	0x22	data	English	United States	0.9705882352941176
RT_VERSION	0x3f610	0x324	data	English	United States	0.417910447761194
RT_MANIFEST	0x3f938	0x4ec	XML 1.0 document, ASCII text, with very long lines (1260), with no line terminators	English	United States	0.4857142857142857

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	05:00:22
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\FSCaptureSetup107.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FSCaptureSetup107.exe"
Imagebase:	0x400000
File size:	9'173'144 bytes
MD5 hash:	28627A37983F5DC8E00D9C03C7B2DEC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:00:41
Start date:	07/10/2024
Path:	C:\Program Files (x86)\FastStone Capture\FSCapture.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\FastStone Capture\FSCapture.exe"
Imagebase:	0x710000
File size:	7'563'656 bytes
MD5 hash:	D5AC941C445B6EB907D0B96D84F15FE7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	28.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.6%
Total number of Nodes:	1392
Total number of Limit Nodes:	48

Executed Functions

Function 00403640 Relevance: 93.2, APIs: 34, Strings: 19, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403663
GetVersionExW.KERNEL32(?), ref: 0040368C
GetVersionExW.KERNEL32(0000011C), ref: 004036A3
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
OleInitialize.OLE32(00000000), ref: 0040377D
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
CharNextW.USER32(00000000,"C:\Users\user\Desktop\FSCaptureSetup107.exe",00000020,"C:\Users\user\Desktop\FSCaptureSetup107.exe",00000000), ref: 004037E9
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
DeleteFileW.KERNELBASE(1033), ref: 00403982
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\FSCaptureSetup107.exe",00000000,?), ref: 00403A69
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\FSCaptureSetup107.exe",00000000,?), ref: 00403A78

Part of subcall function 00405C16: CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\FSCaptureSetup107.exe",00000000,?), ref: 00403A83
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\FSCaptureSetup107.exe",00000000,?), ref: 00403A8F
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
DeleteFileW.KERNEL32(00420F08,00420F08,?,success,?), ref: 00403B0E
CopyFileW.KERNEL32(C:\Users\user\Desktop\FSCaptureSetup107.exe,00420F08,00000001), ref: 00403B21
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
ExitProcess.KERNEL32(?), ref: 00403B6C
CoUninitialize.COMBASE(?), ref: 00403B71
ExitProcess.KERNEL32 ref: 00403B8B
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
ExitProcess.KERNEL32 ref: 00403C1F

Strings

NSIS Error, xrefs: 004037A1
.tmp, xrefs: 00403A7D
C:\Program Files (x86)\FastStone Capture, xrefs: 00403A3B
TEMP, xrefs: 00403961
C:\Users\user\Desktop\FSCaptureSetup107.exe, xrefs: 00403B1C
C:\Users\user\Desktop, xrefs: 00403A88, 00403A8D, 00403AC0
~nsu, xrefs: 00403A61
TMP, xrefs: 00403969
UXTHEME, xrefs: 0040372E, 00403733, 00403739
"C:\Users\user\Desktop\FSCaptureSetup107.exe", xrefs: 004037B6, 004037BC, 004037D1, 004039A8, 004039B4, 00403A02, 00403A0C
1033, xrefs: 0040397D
Error launching installer, xrefs: 00403A12
Low, xrefs: 0040394F
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403659
SeShutdownPrivilege, xrefs: 00403BB4
C:\Users\user\AppData\Local\Temp\, xrefs: 00403911, 00403916, 0040392C, 00403938, 00403947, 00403954, 00403960, 00403968, 00403A66, 00403A77, 00403A82, 00403A8E, 00403A9F, 00403AAE, 00403B64
C:\Program Files (x86)\FastStone Capture, xrefs: 00403901, 00403A30, 00403AB7, 00403AC1
\Temp, xrefs: 00403933
success, xrefs: 00403ACE

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\Desktop\FSCaptureSetup107.exe"$.tmp$1033$C:\Program Files (x86)\FastStone Capture$C:\Program Files (x86)\FastStone Capture$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\FSCaptureSetup107.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$success$~nsu
API String ID: 2292928366-3313118889
Opcode ID: ed5248a912319d130effd7f05a4d843c659f0a5d51aace41cf0d3086d1e01474
Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
Opcode Fuzzy Hash: ed5248a912319d130effd7f05a4d843c659f0a5d51aace41cf0d3086d1e01474
Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D

Function 00405809 Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405867
GetDlgItem.USER32(?,000003EE), ref: 00405876
GetClientRect.USER32(?,?), ref: 004058B3
GetSystemMetrics.USER32(00000002), ref: 004058BA
SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
ShowWindow.USER32(?,00000008), ref: 00405956
GetDlgItem.USER32(?,000003EC), ref: 00405977
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
GetDlgItem.USER32(?,000003F8), ref: 00405885

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

GetDlgItem.USER32(?,000003EC), ref: 004059C9
CreateThread.KERNELBASE(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
CloseHandle.KERNELBASE(00000000), ref: 004059DE
ShowWindow.USER32(00000000), ref: 00405A02
ShowWindow.USER32(?,00000008), ref: 00405A07
ShowWindow.USER32(00000008), ref: 00405A51
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
CreatePopupMenu.USER32 ref: 00405A96
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405AAA
GetWindowRect.USER32(?,?), ref: 00405ACA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
OpenClipboard.USER32(00000000), ref: 00405B2B
EmptyClipboard.USER32 ref: 00405B31
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
GlobalLock.KERNEL32(00000000), ref: 00405B47
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
SetClipboardData.USER32(0000000D,00000000), ref: 00405B86
CloseClipboard.USER32 ref: 00405B8C

Strings

H7B, xrefs: 00405AF7
|!Q, xrefs: 00405A5B
{, xrefs: 00405A6F

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${$|!Q
API String ID: 590372296-799588519
Opcode ID: 153ff5dc364a6c7c2e50f1b489f7107bf33a64f1d0900c26a8f10ec1720b826b
Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
Opcode Fuzzy Hash: 153ff5dc364a6c7c2e50f1b489f7107bf33a64f1d0900c26a8f10ec1720b826b
Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68

Function 00404AB5 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 275
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404B04
SetWindowTextW.USER32(00000000,?), ref: 00404B2E
SHAutoComplete.SHLWAPI(00000000,00000001,00000008,00000000,?,00000014,?,?,00000001,?), ref: 00404B68
SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
CoTaskMemFree.OLE32(00000000), ref: 00404BEA
lstrcmpiW.KERNEL32(Remove folder: ,00423748,00000000,?,?), ref: 00404C1C
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404C28
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C3A

Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF

Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
Part of subcall function 004068EF: CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
Part of subcall function 004068EF: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

GetDiskFreeSpaceExW.KERNELBASE(00421718,?,?,?,00000001,00421718,?,?,000003FB,?), ref: 00404CB1
GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18

Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
Part of subcall function 00404E71: SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

H7B, xrefs: 00404BB2
A, xrefs: 00404BD8
C:\Program Files (x86)\FastStone Capture, xrefs: 00404C05
Remove folder: , xrefs: 00404C16, 00404C1B, 00404C26
success, xrefs: 00404ACE
|!Q, xrefs: 00404ABB

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CharItemText$FreeNext$DiskSpace$AutoBrowseCompleteFolderPrevTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Program Files (x86)\FastStone Capture$H7B$Remove folder: $success$|!Q
API String ID: 4039761011-4119755730
Opcode ID: 8fe5d6185855569599b0147f93014e69bfe7dcd8b72b59fe1028842fc76bdad0
Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
Opcode Fuzzy Hash: 8fe5d6185855569599b0147f93014e69bfe7dcd8b72b59fe1028842fc76bdad0
Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75923420,75922EE0,00000000), ref: 00405D9D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf6353.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsf6353.tmp\*.*,?,?,75923420,75922EE0,00000000), ref: 00405DE5
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsf6353.tmp\*.*,?,?,75923420,75922EE0,00000000), ref: 00405E08
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsf6353.tmp\*.*,?,?,75923420,75922EE0,00000000), ref: 00405E0E
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsf6353.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsf6353.tmp\*.*,?,?,75923420,75922EE0,00000000), ref: 00405E1E
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
FindClose.KERNEL32(00000000), ref: 00405ECD

Strings

., xrefs: 00405E43
., xrefs: 00405E2F
C:\Users\user\AppData\Local\Temp\nsf6353.tmp\*.*, xrefs: 00405DCD, 00405DD3, 00405DE4, 00405E1D
\*.*, xrefs: 00405DDF

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\nsf6353.tmp\*.*$\*.*
API String ID: 2035342205-1041090185
Opcode ID: 474154096caf6e50bc49cf7df5fd00662d051eb5e935454ecd5fbb37efa04323
Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
Opcode Fuzzy Hash: 474154096caf6e50bc49cf7df5fd00662d051eb5e935454ecd5fbb37efa04323
Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE

Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45

Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Strings

C:\Program Files (x86)\FastStone Capture, xrefs: 00402269

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Program Files (x86)\FastStone Capture
API String ID: 542301482-2214226362
Opcode ID: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
Opcode Fuzzy Hash: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94

Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(75923420,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0), ref: 004069A9
FindClose.KERNEL32(00000000), ref: 004069B5

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC

Function 004040C5 Relevance: 63.4, APIs: 34, Strings: 2, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
ShowWindow.USER32(?), ref: 00404121
GetWindowLongW.USER32(?,000000F0), ref: 00404133
ShowWindow.USER32(?,00000004), ref: 0040414C
DestroyWindow.USER32 ref: 00404160
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404179
GetDlgItem.USER32(?,?), ref: 00404198
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
IsWindowEnabled.USER32(00000000), ref: 004041B3
GetDlgItem.USER32(?,00000001), ref: 0040425E
GetDlgItem.USER32(?,00000002), ref: 00404268
SetClassLongW.USER32(?,000000F2,?), ref: 00404282
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
GetDlgItem.USER32(?,00000003), ref: 00404379
ShowWindow.USER32(00000000,?), ref: 0040439A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004043AC
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004043C7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
EnableMenuItem.USER32(00000000), ref: 004043E4
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
SetWindowTextW.USER32(?,00423748), ref: 0040444D
ShowWindow.USER32(?,0000000A), ref: 00404581

Strings

H7B, xrefs: 00404429
|!Q, xrefs: 0040449B

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: H7B$|!Q
API String ID: 3964124867-864814464
Opcode ID: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
Opcode Fuzzy Hash: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E

Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403D98
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files (x86)\FastStone Capture,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,75923420), ref: 00403E18
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files (x86)\FastStone Capture,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
GetFileAttributesW.KERNEL32(Remove folder: ,?,00000000,?), ref: 00403E36
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\FastStone Capture), ref: 00403E7F

Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC

RegisterClassW.USER32(00429200), ref: 00403EBC
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ED4
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F09
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403F6B
GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403F78
RegisterClassW.USER32(00429200), ref: 00403F81
DialogBoxParamW.USER32(?,00000000,004040C5,00000000), ref: 00403FA0

Strings

_Nb, xrefs: 00403E9B, 00403F03
.exe, xrefs: 00403E25
Remove folder: , xrefs: 00403DDF, 00403DE8, 00403DF6, 00403E45, 00403E4B
1033, xrefs: 00403D37, 00403D93
RichEd32, xrefs: 00403F53
H7B, xrefs: 00403D43
C:\Users\user\AppData\Local\Temp\, xrefs: 00403D1C
C:\Program Files (x86)\FastStone Capture, xrefs: 00403DA7, 00403DAF, 00403E52, 00403E58, 00403E68
.DEFAULT\Control Panel\International, xrefs: 00403D83
RichEdit20W, xrefs: 00403F63, 00403F69
RichEd20, xrefs: 00403F45
RichEdit, xrefs: 00403F72
Control Panel\Desktop\ResourceLocale, xrefs: 00403D4B

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Program Files (x86)\FastStone Capture$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$H7B$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3023262966
Opcode ID: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
Opcode Fuzzy Hash: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D

Function 00404783 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
GetDlgItem.USER32(?,000003E8), ref: 00404835
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
GetSysColor.USER32(?), ref: 00404863
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
lstrlenW.KERNEL32(?), ref: 00404884
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
GetDlgItem.USER32(?,0000040A), ref: 004048FF
SendMessageW.USER32(00000000), ref: 00404906
GetDlgItem.USER32(?,000003E8), ref: 00404931
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
LoadCursorW.USER32(00000000,00007F02), ref: 00404982
SetCursor.USER32(00000000), ref: 00404985
LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
SetCursor.USER32(00000000), ref: 004049A1
SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2

Strings

Remove folder: , xrefs: 00404960
N, xrefs: 0040491F
|!Q, xrefs: 004048DF

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$Remove folder: $|!Q
API String ID: 3103080414-4179745596
Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9

Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004030E4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\FSCaptureSetup107.exe,00000400), ref: 00403100

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\FSCaptureSetup107.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FSCaptureSetup107.exe,C:\Users\user\Desktop\FSCaptureSetup107.exe,80000000,00000003), ref: 00403149
GlobalAlloc.KERNELBASE(00000040,?), ref: 0040328B

Strings

Inst, xrefs: 004031B5
Error launching installer, xrefs: 00403120
soft, xrefs: 004031BE
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D4
C:\Users\user\Desktop\FSCaptureSetup107.exe, xrefs: 004030EA, 004030F9, 0040310D, 0040312A
C:\Users\user\Desktop, xrefs: 0040312B, 00403130, 00403136
C:\Users\user\AppData\Local\Temp\, xrefs: 004030DA, 004032A3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403322
Null, xrefs: 004031C7

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\FSCaptureSetup107.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-31469039
Opcode ID: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
Opcode Fuzzy Hash: 0724999653b3e73eed60d379075ff5ac069807c872a81a0186dc1bcbf61f2663
Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D

Function 004066A5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 196
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 004067C0
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,?,00405701,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000,00000000), ref: 004067D3
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,?,00405701,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000), ref: 004068A4

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406844
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040678E
Remove folder: , xrefs: 004066CF, 00406782, 00406789, 0040678D, 004067AA, 004067BF, 004067D2, 004067E7, 00406814, 00406849, 0040684F, 0040686C, 0040687F, 0040689D, 004068A3, 004068AC, 004068E2
success, xrefs: 00406879
Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\, xrefs: 004066CA

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$success
API String ID: 4260037668-1758713299
Opcode ID: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
Opcode Fuzzy Hash: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,ShellExecAsUser,C:\Program Files (x86)\FastStone Capture,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,ShellExecAsUser,ShellExecAsUser,00000000,00000000,ShellExecAsUser,C:\Program Files (x86)\FastStone Capture,?,?,00000031), ref: 004017D5

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 004056CA: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,004030A8,004030A8,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Strings

C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ShellExecAsUser.dll, xrefs: 00401835, 00401851
C:\Program Files (x86)\FastStone Capture, xrefs: 0040179E
ShellExecAsUser, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsf6353.tmp, xrefs: 00401821, 0040183F

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files (x86)\FastStone Capture$C:\Users\user\AppData\Local\Temp\nsf6353.tmp$C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ShellExecAsUser.dll$ShellExecAsUser
API String ID: 1941528284-1219136727
Opcode ID: ae146eaacdef0e831c8dd449aef3ef234919e16d41b91f58e4b486bba6a2989e
Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
Opcode Fuzzy Hash: ae146eaacdef0e831c8dd449aef3ef234919e16d41b91f58e4b486bba6a2989e
Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E

Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
lstrlenW.KERNEL32(004030A8,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,004030A8,004030A8,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000), ref: 00405725
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\), ref: 00405737
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

Part of subcall function 004066A5: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,?,00405701,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000), ref: 004068A4

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\, xrefs: 004056EB, 004056FB, 00405701, 00405724, 00405730

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\
API String ID: 1495540970-2867763728
Opcode ID: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
Opcode Fuzzy Hash: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68

Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
wsprintfW.USER32 ref: 00406A17
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B

Strings

UXTHEME, xrefs: 004069CE
%s%S.dll, xrefs: 00406A11
\, xrefs: 004069ED

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98

Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
wsprintfW.USER32 ref: 00404F1B
SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E

Strings

%u.%u%s%s, xrefs: 00404EFC
H7B, xrefs: 00404F04

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
Opcode Fuzzy Hash: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8

Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
GetLastError.KERNEL32 ref: 00405BF0
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
GetLastError.KERNEL32 ref: 00405C0F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-823278215
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98

Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf6353.tmp,00000023,00000011,00000002), ref: 004024D5
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsf6353.tmp,00000000,00000011,00000002), ref: 00402515
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsf6353.tmp,00000000,00000011,00000002), ref: 004025FD

Strings

C:\Users\user\AppData\Local\Temp\nsf6353.tmp, xrefs: 004024C6, 004024D4, 004024EB, 004024FF, 0040250A

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsf6353.tmp
API String ID: 2655323295-1243876532
Opcode ID: ccbced7c383fe36513b27ab0f3831983de96ef15fa0590e398bf5cccbf7e4235
Instruction ID: a516967871aadb8e7373f7254d3c24ec0cdbd982f2b4049ed7d94b0996b6da2b
Opcode Fuzzy Hash: ccbced7c383fe36513b27ab0f3831983de96ef15fa0590e398bf5cccbf7e4235
Instruction Fuzzy Hash: 4011AF71E00108BEEF10AFA1CE49EAEB6B8EB44354F11443AF404B61C1DBB98D409658

Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004061A5
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040618C
nsa, xrefs: 00406194

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768

Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A
C:\Users\user\AppData\Local\Temp\nsf6353.tmp\, xrefs: 00403C5B

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsf6353.tmp\
API String ID: 2962429428-3831294090
Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405B99: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC

SetCurrentDirectoryW.KERNELBASE(?,C:\Program Files (x86)\FastStone Capture,?,00000000,000000F0), ref: 0040164D

Strings

C:\Program Files (x86)\FastStone Capture, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Program Files (x86)\FastStone Capture
API String ID: 1892508949-2214226362
Opcode ID: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
Opcode Fuzzy Hash: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E

Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675

Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0,00000000), ref: 00405FF0
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0,00000000), ref: 00406098
GetFileAttributesW.KERNELBASE(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,75923420,?,75922EE0,00405D94,?,75923420,75922EE0), ref: 004060A8

Strings

P_B, xrefs: 00406045

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E

Function 00406536 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000000,?,00000000,?,?,Remove folder: ,?,?,0040679D,80000002), ref: 0040657C
RegCloseKey.KERNELBASE(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\), ref: 00406587

Strings

Remove folder: , xrefs: 0040653D

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CloseQueryValue
String ID: Remove folder:
API String ID: 3356406503-1958208860
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4

Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45

Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45

Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05

Function 00406BB0 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45

Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05

Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05

Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45

Function 00403479 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040348D

Part of subcall function 004035F8: SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
SetFilePointer.KERNELBASE(01F09863,00000000,00000000,00414EF0,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D

Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402103

Part of subcall function 004056CA: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,004030A8,004030A8,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 49624561057d65463e648c025d3924b1173f5861ada87d1c47d5b8f7605275f5
Instruction ID: 1e7e134340f86907485d462c64894228b35b3344cd4f3d252167f9901203d809
Opcode Fuzzy Hash: 49624561057d65463e648c025d3924b1173f5861ada87d1c47d5b8f7605275f5
Instruction Fuzzy Hash: C521C231904104FADF11AFA5CF48A9D7A70BF48354F60413BF605B91E0DBBD8A929A5D

Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C0B
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C1D

Part of subcall function 004066A5: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,?,00405701,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000), ref: 004068A4

Strings

ShellExecAsUser, xrefs: 00401BC2, 00401BC8, 00401BE2

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Global$AllocFreelstrcatlstrlen
String ID: ShellExecAsUser
API String ID: 3292104215-4107788475
Opcode ID: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
Instruction ID: d74cddccbdd50a14e5bf5e3e63826a63b2a65df0fd836753f00777670cd3b466
Opcode Fuzzy Hash: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
Instruction Fuzzy Hash: 5321D872904210DBDB20EFA4DEC4E5E73A4AB047157150A3BF542F72D0D6BD9C518BAD

Function 00405D2C Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406133: GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
Part of subcall function 00406133: SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040614C

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405F0E), ref: 00405D47
DeleteFileW.KERNELBASE(?,?,?,00000000,00405F0E), ref: 00405D4F
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D67

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction ID: f7500ddcb6900c42920b0fa7cdf939b3a50fd8fb6693fff67202f671924a8b23
Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
Instruction Fuzzy Hash: 6DE0E531218A9156C3207734AD0CB5B2A98EF86314F09893FF5A2B11E0D77885078AAD

Function 0040459D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000408,?,00000000,004041FC), ref: 004045BB

Strings

x, xrefs: 0040459D

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: a4e2778218c9fdeab8ae4952123a6e605dd424a78c20075fb3486bdcc909a4f1
Instruction ID: 271d720e87c3080f9bc4c684b425461430c88a900e0fa794081ec75d4c8aeb56
Opcode Fuzzy Hash: a4e2778218c9fdeab8ae4952123a6e605dd424a78c20075fb3486bdcc909a4f1
Instruction Fuzzy Hash: 58C01271646200FBCB208B00EE00F067A21B7A4B02F2088B9FB81240B48A314822DB2D

Function 00403371 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D

Function 0040579D Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004057AD

Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

CoUninitialize.COMBASE(00000404,00000000,?,00000000,?), ref: 004057F9

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: b14588aebbadd05bc97f1dd14ffe2b6982532d9bfcd69c4411fdff16e8679f7d
Instruction ID: 683c9d360a8619809caff371317e20043972a5eac84f98be19084c03997f3dfe
Opcode Fuzzy Hash: b14588aebbadd05bc97f1dd14ffe2b6982532d9bfcd69c4411fdff16e8679f7d
Instruction Fuzzy Hash: 84F09072600600CBD6215B54AD01B17B764EB84304F45447FFF89732F0DB7A48529A6E

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: d682e64da976263d74778dcd61bd470f9ad8341d2b96c4d867934af8fae03e48
Instruction ID: 74d914ea4967392a65d1c9fdd8f91c6329c2dde8704c14122971abf6b6e16597
Opcode Fuzzy Hash: d682e64da976263d74778dcd61bd470f9ad8341d2b96c4d867934af8fae03e48
Instruction Fuzzy Hash: 14E0D872908201CFE705EBA4EE485AD73F0EF40315710097FE401F11D0DBB54C00862D

Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
GetProcAddress.KERNEL32(00000000,?), ref: 00406A62

Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
Part of subcall function 004069C5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
Opcode Fuzzy Hash: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79

Function 00402C05 Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,00000001), ref: 00402C14
InvalidateRect.USER32(?), ref: 00402C24

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: f432a0a30971dc187192fe2491b4b63328d533872b60b8ab23492fb2b34197a6
Instruction ID: c061831bd97a7b49b699665abee3b6b910fafb94a2d14f64d6e35fdc86e4b588
Opcode Fuzzy Hash: f432a0a30971dc187192fe2491b4b63328d533872b60b8ab23492fb2b34197a6
Instruction Fuzzy Hash: 36E08C72700408FFEB11CBA4EE84DAEB7B9FB40315F00007AF502A00A0D7300D51CA28

Function 00403C82 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,75923420,00000000,75922EE0,00403C59,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C9C
GlobalFree.KERNEL32(?), ref: 00403CA3

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
Instruction ID: 1b4b668df254a36c82b8f96f79c5ae0e05fb6c29bd97d86a5de4613e9375b038
Opcode Fuzzy Hash: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
Instruction Fuzzy Hash: 0AE08C335052205BD6211F55EA0875A7768AF94B26F06006AE980BB26087781C424BC8

Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\FSCaptureSetup107.exe,80000000,00000003), ref: 0040615C
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
SetFileAttributesW.KERNELBASE(?,00000000), ref: 0040614C

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98

Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
GetLastError.KERNEL32 ref: 00405C2A

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D

Function 004023B2 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004023E9

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 498f41ba95d1dc934bc83887be66b3af98def7cf3aba53834c7129a1bd888199
Instruction ID: de4cb5ca612a6b97b91745c8380e1d92b079ec7b797fcdaf288f77766e75fad7
Opcode Fuzzy Hash: 498f41ba95d1dc934bc83887be66b3af98def7cf3aba53834c7129a1bd888199
Instruction Fuzzy Hash: FAE04F31900124BBDF603AB11F8DEAE205C6FC6744B18013EF911BA1C2E9FC8C4146AD

Function 00406503 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 0040652C

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 390987c888b9fe28ccc3a202ccefe0e129b8fdbaba7b34d45eb5723cdb444700
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: C1E0ECB2010109BEEF099F90EC0ADBB372DEB04704F41492EF907E4091E6B5AE70AA34

Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000000,00000000,00000000,00000000,00413D82,0040CEF0,00403579,0040CEF0,00413D82,00414EF0,00004000,?,00000000,004033A3,00000004), ref: 0040621E

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5

Function 004061DB Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,004035F5,?,?,004034F9,00414EF0,00004000,?,00000000,004033A3), ref: 004061EF

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8

Function 004023F4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402425

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 7d71ac8ddd31db18f378b319f763d6172168bca54096192b0f97eaa7b6b6bd09
Instruction ID: 209997e2e20356d43fdb77e3237b303e11e03b8f2c16ee2f2baf27e4b220ec87
Opcode Fuzzy Hash: 7d71ac8ddd31db18f378b319f763d6172168bca54096192b0f97eaa7b6b6bd09
Instruction Fuzzy Hash: 05E01A30C00229FADB10AFA0CD09EAD3668BF41340F14052AF510AA0D1E7F889409789

Function 004064D5 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,00406563,?,00000000,?,?,Remove folder: ,?), ref: 004064F9

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: 5036765eb4ab6e58186d81024f5778724aa2024cd81e2e1d5ca813995cf5404a
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: BAD0123210020DBBDF115F90AD01FAB375DAB08310F018426FE06A4092D775D534A728

Function 004045C4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

Part of subcall function 004066A5: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,?,00405701,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000), ref: 004068A4

SetDlgItemTextW.USER32(?,?,00000000), ref: 004045DE

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: ItemTextlstrcatlstrlen
String ID:
API String ID: 281422827-0
Opcode ID: 73b3e70f26523695344aa313222f8106b15ff01fe64d2e6c86eba35ea0453547
Instruction ID: ac81fd1055ba0297197cac3df011722fda0f302089e5b839fe348bc6695a069d
Opcode Fuzzy Hash: 73b3e70f26523695344aa313222f8106b15ff01fe64d2e6c86eba35ea0453547
Instruction Fuzzy Hash: 77C04C7554C300BFE641A755CC42F1FB799EF94319F04C92EB19DE11D1C63984309A2A

Function 00404610 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction ID: 1d0f09303225af8c469e983b8f6ba21d59f3f36861eec243a4bc5be8392dea83
Opcode Fuzzy Hash: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction Fuzzy Hash: 9EC09B71741700FBDE209B509F45F077794A754701F154979B741F60E0D775D410D62D

Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,004032F6,?), ref: 00403606

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Function 004045F9 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction ID: 26063d6d883ff380d2e1d7f9fe2b9d631bf033e6200e0a233fd0d302f8c02db7
Opcode Fuzzy Hash: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction Fuzzy Hash: 5BB01235286A00FBDE614B00DE09F457E62F764B01F048078F741240F0CAB300B5DF19

Function 004045E6 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004043BD), ref: 004045F0

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction ID: 97f05af551d2e904d84950d91e3a9b28448307360fbef328a82585e9573e9e03
Opcode Fuzzy Hash: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction Fuzzy Hash: DBA001B6604500ABDE129F61EF09D0ABB72EBA4B02B418579A28590034CA365961FB1D

Non-executed Functions

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 81649c9ef60b362743358cc04841f69d280dec374dabcafdd230337d8cd45dd0
Instruction ID: b84bdfeecc4e8c0803ac0e71b8711fc90ef1d688bdc4be786e729a17b55638d3
Opcode Fuzzy Hash: 81649c9ef60b362743358cc04841f69d280dec374dabcafdd230337d8cd45dd0
Instruction Fuzzy Hash: 47F05E71A04105EBDB01DBB4EE49AAEB378EF14314F60457BE101F21D0E7B88E529B29

Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00405049
GetDlgItem.USER32(?,00000408), ref: 00405054
GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 004050B5
SetWindowLongW.USER32(?,000000FC,0040563E), ref: 004050CE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
DeleteObject.GDI32(00000000), ref: 0040512B
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D

Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
GetWindowLongW.USER32(?,000000F0), ref: 0040526F
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040527D
ShowWindow.USER32(?,00000005), ref: 0040528D
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
ImageList_Destroy.COMCTL32(?), ref: 0040545B
GlobalFree.KERNEL32(?), ref: 0040546B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
ShowWindow.USER32(?,00000000), ref: 00405615
GetDlgItem.USER32(?,000003FE), ref: 00405620
ShowWindow.USER32(00000000), ref: 00405627

Strings

M, xrefs: 004051E5
N, xrefs: 004052C6
, xrefs: 004055FF

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
Opcode Fuzzy Hash: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18

Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2

Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
wsprintfA.USER32 ref: 0040632D
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
GlobalFree.KERNEL32(00000000), ref: 00406416
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D

Part of subcall function 00406158: GetFileAttributesW.KERNELBASE(00000003,00403113,C:\Users\user\Desktop\FSCaptureSetup107.exe,80000000,00000003), ref: 0040615C
Part of subcall function 00406158: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E

Strings

mB, xrefs: 004062D7
uB, xrefs: 0040630B
[Rename], xrefs: 00406397, 004063A9
%ls=%ls, xrefs: 00406323
uB, xrefs: 00406304

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
Opcode Fuzzy Hash: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4

Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404648
GetSysColor.USER32(00000000), ref: 00404686
SetTextColor.GDI32(?,00000000), ref: 00404692
SetBkMode.GDI32(?,?), ref: 0040469E
GetSysColor.USER32(?), ref: 004046B1
SetBkColor.GDI32(?,?), ref: 004046C1
DeleteObject.GDI32(?), ref: 004046DB
CreateBrushIndirect.GDI32(?), ref: 004046E5

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58

Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004068F0
*?|<>/":, xrefs: 00406941

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1201062745
Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD

Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00403049
GetTickCount.KERNEL32 ref: 00403067
wsprintfW.USER32 ref: 00403095

Part of subcall function 004056CA: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
Part of subcall function 004056CA: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,004030A8,004030A8,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000,00000000,00000000), ref: 00405725
Part of subcall function 004056CA: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\), ref: 00405737
Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785

CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 004030B9
ShowWindow.USER32(00000000,00000005), ref: 004030C7

Part of subcall function 00403012: MulDiv.KERNEL32(00000000,00000064,00006E92), ref: 00403027

Strings

... %d%%, xrefs: 0040308F

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: eb5829c7fffbc7bf65dde30d15e1f0a96a9438333430517d581b7dc81546266b
Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
Opcode Fuzzy Hash: eb5829c7fffbc7bf65dde30d15e1f0a96a9438333430517d581b7dc81546266b
Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE

Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
GetMessagePos.USER32 ref: 00404FA2
ScreenToClient.USER32(?,?), ref: 00404FBC
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4

Strings

f, xrefs: 00404FD0

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5

Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 004066A5: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
Part of subcall function 004066A5: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,?,00405701,Remove folder: C:\Users\user\AppData\Local\Temp\nsf6353.tmp\,00000000), ref: 004068A4

CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Strings

MS Shell Dlg, xrefs: 00401EB9

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID: MS Shell Dlg
API String ID: 2584051700-76309092
Opcode ID: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
Opcode Fuzzy Hash: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED

Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
wsprintfW.USER32 ref: 00402FE5
SetWindowTextW.USER32(?,?), ref: 00402FF5
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403007

Strings

unpacking data: %d%%, xrefs: 00402FD3, 00402FE3
verifying installer: %d%%, xrefs: 00402FDA

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
Opcode Fuzzy Hash: cc682eb677fc0cdddcbf9664361c627099a0f91e8e9c012db3e8b517a211182c
Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
Opcode Fuzzy Hash: 2f5760c81b9bdb573da93a40119b3bcbbfe2770e9a6cbc48a05e82d61b54c679
Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98

Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
lstrcatW.KERNEL32(?,0040A014), ref: 00405F59

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED

Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ShellExecAsUser.dll), ref: 00402695

Strings

C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ShellExecAsUser.dll, xrefs: 00402659, 0040267E, 00402690, 004026DC
C:\Users\user\AppData\Local\Temp\nsf6353.tmp, xrefs: 00402683

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsf6353.tmp$C:\Users\user\AppData\Local\Temp\nsf6353.tmp\ShellExecAsUser.dll
API String ID: 1659193697-191493504
Opcode ID: 8c6554b53cfcec5e2f07c2cef93b4325bcb2464f26661cdf6029d648463e49ea
Instruction ID: f1e3379d491753f9d96dc3c217618d2e64da59e9cc8309568291ba5d2d488428
Opcode Fuzzy Hash: 8c6554b53cfcec5e2f07c2cef93b4325bcb2464f26661cdf6029d648463e49ea
Instruction Fuzzy Hash: D511C472A00205EBCB10BBB18E4AA9E76619F44758F21483FE402B61C1DAFD8891965F

Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040566D
CallWindowProcW.USER32(?,?,?,?), ref: 004056BE

Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622

Strings

, xrefs: 0040564E

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D

Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040313C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FSCaptureSetup107.exe,C:\Users\user\Desktop\FSCaptureSetup107.exe,80000000,00000003), ref: 00405F89
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040313C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\FSCaptureSetup107.exe,C:\Users\user\Desktop\FSCaptureSetup107.exe,80000000,00000003), ref: 00405F99

Strings

C:\Users\user\Desktop, xrefs: 00405F83

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9

Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004060E5
CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF

Memory Dump Source

Source File: 00000000.00000002.2336496055.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2336466395.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336540152.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336579015.000000000043B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2336854413.000000000043D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FSCaptureSetup107.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

Analysis Process: FSCapture.exePID: 5960, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	49.2%
Signature Coverage:	0.8%
Total number of Nodes:	120
Total number of Limit Nodes:	4

Executed Functions

Function 077D523C Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,077D419F,00000001,?,?,?,077D4318,?,?,?,077E6030,0000000C,077D43D3), ref: 077D5251

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 0e7f6d0a46ae9e56dae0a5300bc4edcc59edce43b566f097fd47835910376a97
Instruction ID: 7947ec3d27d608d49b91464ff236fc22dec30db7f63378ead07fa2505b0c734b
Opcode Fuzzy Hash: 0e7f6d0a46ae9e56dae0a5300bc4edcc59edce43b566f097fd47835910376a97
Instruction Fuzzy Hash: FCD05E76954349DBDF005F74680AB623BEC938C6D5F15C836F90CCA150F678D560C900

Function 1005DEA6 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,1005AEEF,00000001,?,?,?,1005B068,?,?,?,10074150,0000000C,1005B123), ref: 1005DEBB

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 735fb80c808726fb600b7528066a7df35ee7ea53d6a4c649e5dcde6238633a11
Instruction ID: 8dfb91ae570739790c816bb2e1dda111b62e5bb18bd715a04582d98cca31d61a
Opcode Fuzzy Hash: 735fb80c808726fb600b7528066a7df35ee7ea53d6a4c649e5dcde6238633a11
Instruction Fuzzy Hash: 5BD05E329A03559EF710AF709C497233BDCE784799F084536F94CD6160F574C980D650

Function 0076CE91 Relevance: .2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3389880451.000000000076C000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0076C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76c000_FSCapture.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef5c717b336019f4170949ce05a1710a435065059c3ef29e005e1d0ff0c6b5a
Instruction ID: bef145573693023861790f066d1f2f181686abb9bcbc3e87aad5b7cce37bf63a
Opcode Fuzzy Hash: 7ef5c717b336019f4170949ce05a1710a435065059c3ef29e005e1d0ff0c6b5a
Instruction Fuzzy Hash: 77512A74B10205EFDB10EFA8C996AAEB7B5FF49700F5144A4F901A77A1CB39AD41CB50

Function 0076C9A4 Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3389880451.000000000076C000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0076C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76c000_FSCapture.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01cdab7c3a0c4810512813d753864d155dd449fb76f1e4487b3c9a4d76ee78e
Instruction ID: 9809c2982ca54d95d3363318baded4d673839ac7977b5a9bac38df17c5f28572
Opcode Fuzzy Hash: b01cdab7c3a0c4810512813d753864d155dd449fb76f1e4487b3c9a4d76ee78e
Instruction Fuzzy Hash: 0201CC70210208AFDB15EFACDD81AAA37FDEB09300B9044A0FD44C7292DA79EC419B90

Function 0076CA49 Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3389880451.000000000076C000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0076C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76c000_FSCapture.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dfbd01d0c66457f1beeae8932f1ea4fe977684b603a95db0e5f8f577e2eaa63
Instruction ID: c1242d9f43c4d8cbbd0ef9e4fbb88f62bbf0e8f2b1968c643ad15bc11f0fa4ed
Opcode Fuzzy Hash: 3dfbd01d0c66457f1beeae8932f1ea4fe977684b603a95db0e5f8f577e2eaa63
Instruction Fuzzy Hash: 94012D70A10608EFDB06EFA8D85286EB7F9EB4970079284A5F801E3761D6786E00DB54

Function 0076D03B Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3389880451.000000000076C000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0076C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76c000_FSCapture.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315bfb93e07e5c621ddb273d6e0335617357a7006b5ef222bdb93c19f43c5e81
Instruction ID: 8ea4508e67ecff9763956f8eaf474668c082b864ac711aa1f94f1c1dababbeac
Opcode Fuzzy Hash: 315bfb93e07e5c621ddb273d6e0335617357a7006b5ef222bdb93c19f43c5e81
Instruction Fuzzy Hash: 03C02B75B1C208DFA718CB84E40242C73F0E7C8320BB140F1E80093240C6395D018508

Function 0076D059 Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3389880451.000000000076C000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0076C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76c000_FSCapture.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfa533c8135af29c9923ffd3d82fef57fa725cf1decd71ba63591a6ce210cb5
Instruction ID: dfe4f364c766a868bce5b2dfeb9d2ae997444083a35250f18c8b00943ea3c6ba
Opcode Fuzzy Hash: 1dfa533c8135af29c9923ffd3d82fef57fa725cf1decd71ba63591a6ce210cb5
Instruction Fuzzy Hash: 47B00234F1414CE78F24D795C55585D77716B85310FA145D0584663115867D5E455540

Function 0076C73C Relevance: .0, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3389880451.000000000076C000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0076C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_76c000_FSCapture.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaef350a031b0f30ea73a90b24e8774050fcc671b9a2ea6f4c83847aafd68f8
Instruction ID: 0e9b711aacc6cdd48f8b0dc5c9a4c62fdfb8ef129deb08c538e778335052d4f7
Opcode Fuzzy Hash: cbaef350a031b0f30ea73a90b24e8774050fcc671b9a2ea6f4c83847aafd68f8
Instruction Fuzzy Hash: 3AA00224810204CDDB97669A844A77431546F50325FC5B094D8C2098924BBC5448CE16

Non-executed Functions

Function 10023AF6 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 320COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10023E49
_memset.LIBCMT ref: 10023E60
_memset.LIBCMT ref: 10023EC0
_memset.LIBCMT ref: 10023ED7

Strings

`, xrefs: 10023DA3
, xrefs: 10023D9E

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID: $`
API String ID: 2102423945-2069241612
Opcode ID: 57a5f1e5baab0a65e52a6123cc5f8729c428fea9b7a39412b9a0e8449ba4de70
Instruction ID: e4dc857d105607d2b205f713aadfbeb6f1f12d4c7ebf97a5af00b084650b19ce
Opcode Fuzzy Hash: 57a5f1e5baab0a65e52a6123cc5f8729c428fea9b7a39412b9a0e8449ba4de70
Instruction Fuzzy Hash: 3AD1A375D287825BE711CB38D882BABF7A4BFEA244F00DB1EB9D4A2501E7709644C791

Function 10020D36 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 320COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10021089
_memset.LIBCMT ref: 100210A0
_memset.LIBCMT ref: 10021100
_memset.LIBCMT ref: 10021117

Strings

`, xrefs: 10020FE3
, xrefs: 10020FDE

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID: $`
API String ID: 2102423945-2069241612
Opcode ID: ccd9499090af09c85c04ec9fcdce32d70e66f4838ceecefe8fe831ae5d51b1dd
Instruction ID: f909171aaf54837c8d4177ea7f0f542c6b82b8bd7d832a495eab585f6e80004f
Opcode Fuzzy Hash: ccd9499090af09c85c04ec9fcdce32d70e66f4838ceecefe8fe831ae5d51b1dd
Instruction Fuzzy Hash: 40D1A675D287865BE311CB38D882BABF7A4FFEA244F009B1EB9D472501E770A644C791

Function 10023AF4 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10023E49
_memset.LIBCMT ref: 10023E60
_memset.LIBCMT ref: 10023EC0
_memset.LIBCMT ref: 10023ED7

Strings

`, xrefs: 10023DA3
, xrefs: 10023D9E

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID: $`
API String ID: 2102423945-2069241612
Opcode ID: 559a11ae3c362d57d20c4b2f77cf23b2b867b9e3afda963b3244522fca701c95
Instruction ID: 8b308d0ea5d6410fcdff0544da820f75256ba29b7dd258b56083f009eca2d96f
Opcode Fuzzy Hash: 559a11ae3c362d57d20c4b2f77cf23b2b867b9e3afda963b3244522fca701c95
Instruction Fuzzy Hash: FAD1B375D287825BE311CB38D882BABF7A4BFEA244F00DB1EB9D4B2501E7709644C791

Function 10020D34 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10021089
_memset.LIBCMT ref: 100210A0
_memset.LIBCMT ref: 10021100
_memset.LIBCMT ref: 10021117

Strings

`, xrefs: 10020FE3
, xrefs: 10020FDE

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID: $`
API String ID: 2102423945-2069241612
Opcode ID: 8240b824b76b6e7e043e9d9b77cc4b9726abde0e0f70c5d2921ee51842823a00
Instruction ID: 1a17436abc254abaf7b1250ad2183e49d63d0b39834bf5d18dbbae975391660a
Opcode Fuzzy Hash: 8240b824b76b6e7e043e9d9b77cc4b9726abde0e0f70c5d2921ee51842823a00
Instruction Fuzzy Hash: 08D1A675D287865BE311CB38D882BABF7A4FFEA244F009B1EB9D472501E770A644C791

Function 10022507 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 318COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10022859
_memset.LIBCMT ref: 10022870
_memset.LIBCMT ref: 100228D0
_memset.LIBCMT ref: 100228E7

Strings

, xrefs: 100227AE
@, xrefs: 100227B3

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID: $@
API String ID: 2102423945-1077428164
Opcode ID: 6c55a1752f4a56a0111544179d296faa80b4bfe61d411f1f329c6262af8b801c
Instruction ID: a46a56116740031f42a158213e9a38b88f21a0d11e0112c91194021a809ed74a
Opcode Fuzzy Hash: 6c55a1752f4a56a0111544179d296faa80b4bfe61d411f1f329c6262af8b801c
Instruction Fuzzy Hash: 7ED1B575D287825BE311CB39D882AABF7A4FFEA244F00DB1EB8D4B2511E7309644C791

Function 10022509 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 318COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10022859
_memset.LIBCMT ref: 10022870
_memset.LIBCMT ref: 100228D0
_memset.LIBCMT ref: 100228E7

Strings

, xrefs: 100227AE
@, xrefs: 100227B3

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID: $@
API String ID: 2102423945-1077428164
Opcode ID: 73b9f25d1614c113d866a7efcdb9099228939aa956b54bb9cd6dc1be725492a1
Instruction ID: 180bca3fa0391e14ae0d945cc8ee57e797c3becee5dbdaf8617eea16931955d0
Opcode Fuzzy Hash: 73b9f25d1614c113d866a7efcdb9099228939aa956b54bb9cd6dc1be725492a1
Instruction Fuzzy Hash: 59D1A475D287825BE311CB39D882AABF7A4AFEA244F00DB1EB8D4B2511E7309644C791

Function 1001F5C6 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1001F919
_memset.LIBCMT ref: 1001F930
_memset.LIBCMT ref: 1001F990
_memset.LIBCMT ref: 1001F9A7

Strings

, xrefs: 1001F86E

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: 93c18c4b91f60976479a1f22aa3a31f06d51aae6008522914339c599d1eff7d8
Instruction ID: 976ca29b1e4bad2d6155b7328af1084c43cf2bece24350da8ae42022591f3596
Opcode Fuzzy Hash: 93c18c4b91f60976479a1f22aa3a31f06d51aae6008522914339c599d1eff7d8
Instruction Fuzzy Hash: 06D1B475D287825BE311CB39D882BABF7A4FFEA244F00CB1EB9D4A2501E7709644C791

Function 1001FDA6 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100200F9
_memset.LIBCMT ref: 10020110
_memset.LIBCMT ref: 10020170
_memset.LIBCMT ref: 10020187

Strings

, xrefs: 1002004E

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: a2020f5417437e3846193ad97c6e2fe11a9b6d97a36c2db749b5ba489b519138
Instruction ID: 582062d1836a380d1efa821823b8e23e6d7197cd242db275f85e3d8367547a6e
Opcode Fuzzy Hash: a2020f5417437e3846193ad97c6e2fe11a9b6d97a36c2db749b5ba489b519138
Instruction Fuzzy Hash: 3AD1B475D287825BE315CB38D882BABF7A4FFEA244F00DB1EB9D4A2501E7709644C791

Function 1002152C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 319COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10021885
_memset.LIBCMT ref: 1002189C
_memset.LIBCMT ref: 100218FC
_memset.LIBCMT ref: 10021913

Strings

, xrefs: 100217DA

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: 0bc5dd8a0b52b174a2ea33ebce6a8409cf94bc04ce12d263c7c37217de5aea30
Instruction ID: 6b35d4e15ad5c3b53856fa4a9715e3374019100b05862a130d6858b3051d5170
Opcode Fuzzy Hash: 0bc5dd8a0b52b174a2ea33ebce6a8409cf94bc04ce12d263c7c37217de5aea30
Instruction Fuzzy Hash: 08D1A675D287865BE311CB39D882BABF7A4FFEA244F008B1EB9D4B2511E7309644C791

Function 1001F5C4 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 319COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1001F919
_memset.LIBCMT ref: 1001F930
_memset.LIBCMT ref: 1001F990
_memset.LIBCMT ref: 1001F9A7

Strings

, xrefs: 1001F86E

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: 5125cc39c5fe8cf838cf7d79d1e8fe6699f3a5e0c08d14157584c7396ac3350b
Instruction ID: c9b4fd9b5ace96e0969d18c2aa68e0e90a90df6d376a53d8d71422e4bd6730ee
Opcode Fuzzy Hash: 5125cc39c5fe8cf838cf7d79d1e8fe6699f3a5e0c08d14157584c7396ac3350b
Instruction Fuzzy Hash: 5BD1B475D287825BE311CB39D882AABF7A4FFEA244F00CB1EB9D4B2501E7709644C791

Function 1001FDA4 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 319COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100200F9
_memset.LIBCMT ref: 10020110
_memset.LIBCMT ref: 10020170
_memset.LIBCMT ref: 10020187

Strings

, xrefs: 1002004E

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: cc71c4c9972543f725f88c73b527772ead329f60a62df9e11a385c9af2e7c437
Instruction ID: 10edc3b494adee164b47742f9288fd3f3504a71bfcc4378bd05705179f66db09
Opcode Fuzzy Hash: cc71c4c9972543f725f88c73b527772ead329f60a62df9e11a385c9af2e7c437
Instruction Fuzzy Hash: 46D1B375D287825BE315CB38D882AABF7A4FFEA244F00DB1EB9D4B2501E7709644C791

Function 077D92A5 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 077DCB85
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 077DCB9A
UnhandledExceptionFilter.KERNEL32(077E55E0), ref: 077DCBA5
GetCurrentProcess.KERNEL32(C0000409), ref: 077DCBC1
TerminateProcess.KERNEL32(00000000), ref: 077DCBC8

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1f3785a3e5edbdee1f619e1c7cea4d2faf9d3835f502ebf6b95a395a3db1a07e
Instruction ID: ae5142d95d08fe868162a15141e436a3ea55869f59af28e90489033e001fbf0c
Opcode Fuzzy Hash: 1f3785a3e5edbdee1f619e1c7cea4d2faf9d3835f502ebf6b95a395a3db1a07e
Instruction Fuzzy Hash: EF21E2B5901205DFCF01DF18F5866683BB8FB8C390F52C519E408AE220E77E59A4CF55

Function 10059BFE Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 1005C107
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1005C11C
UnhandledExceptionFilter.KERNEL32(1006E238), ref: 1005C127
GetCurrentProcess.KERNEL32(C0000409), ref: 1005C143
TerminateProcess.KERNEL32(00000000), ref: 1005C14A

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 021af7e6aabf4a09eaaba2b27c593ae070e37e0c42dcc935f8711d2c64f30ffd
Instruction ID: ff92cdb9e8717ca309287b10ada1cee81ed65535f766f53986b20397a673cce2
Opcode Fuzzy Hash: 021af7e6aabf4a09eaaba2b27c593ae070e37e0c42dcc935f8711d2c64f30ffd
Instruction Fuzzy Hash: 3021BBB4917324DFF741DF28DD89A457BA1FB48380F00925AE68CA6270E7B869C4CF25

Function 077DF93C Relevance: 1.5, APIs: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000006,?,?,00000001,?,00000000,00000001,00000000), ref: 077DF960

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 3bf44e456b75d66c24867060e7e7b06486653a80da6ccfa3dbe277d7ddd6838f
Instruction ID: 6d97822a5e7574ce292f813a88b89168c7c7d857958e432165cf9ad79ca97f5c
Opcode Fuzzy Hash: 3bf44e456b75d66c24867060e7e7b06486653a80da6ccfa3dbe277d7ddd6838f
Instruction Fuzzy Hash: 7FF06570A0424CBFDB00DBB4D805FAE7BF9AB49368F504155E526DA1C0EA70DA148651

Function 1005C2F6 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,10074190,0000000C,1005C431,00000000,00000000,?,1005D008,?,00000001,?,?,1005D339,00000018,10074220,0000000C), ref: 1005C308
__crt_waiting_on_module_handle.LIBCMT ref: 1005C313

Part of subcall function 1005C8ED: Sleep.KERNEL32(000003E8,00000000,?,1005C21C,KERNEL32.DLL,?,1005E14D,?,1005E23D,10032967,10074240,0000000C,1005A313,?,10032967,00000000), ref: 1005C8F9
Part of subcall function 1005C8ED: GetModuleHandleW.KERNEL32(?,?,1005C21C,KERNEL32.DLL,?,1005E14D,?,1005E23D,10032967,10074240,0000000C,1005A313,?,10032967,00000000,?), ref: 1005C902

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 1005C33C
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 1005C34C
__lock.LIBCMT ref: 1005C36E
InterlockedIncrement.KERNEL32(10076510), ref: 1005C37B
__lock.LIBCMT ref: 1005C38F
___addlocaleref.LIBCMT ref: 1005C3AD

Strings

DecodePointer, xrefs: 1005C344
EncodePointer, xrefs: 1005C330
KERNEL32.DLL, xrefs: 1005C302, 1005C307, 1005C312

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: e69a2f76c7e2a554b66a8e610c509ed1dda9de9e168b4c8e7e941f2ce9dde25a
Instruction ID: 12526df81ac830b0d5f979ae89d843a525f5f20704940d33c15e3091131b1393
Opcode Fuzzy Hash: e69a2f76c7e2a554b66a8e610c509ed1dda9de9e168b4c8e7e941f2ce9dde25a
Instruction Fuzzy Hash: DB11AF75800749EEE710DF75CC41F4ABBE5EF04310F108A1AE49AE72A1DB74AA44DF65

Function 100344A0 Relevance: 16.9, APIs: 11, Instructions: 364COMMON

Download Yara Rule

APIs

WebPSafeMalloc.LIBWEBP(?,00000000,0000000C), ref: 100345F7
_memset.LIBCMT ref: 10034698

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: MallocSafe_memset
String ID:
API String ID: 1319453872-0
Opcode ID: 7b8b60c72749a277e559c6951ce262d366b25dd8b9e59b4f0af50b196b4a1e21
Instruction ID: cfe82ad5ad41359a3269638befb738efe5f0163018189e3eb14d833a593b0478
Opcode Fuzzy Hash: 7b8b60c72749a277e559c6951ce262d366b25dd8b9e59b4f0af50b196b4a1e21
Instruction Fuzzy Hash: D6D1CDB8A04702CFC311DF14D58468ABBA1FF81351F23896CD69A9E242EB35F469CF55

Function 077D2890 Relevance: 16.7, APIs: 11, Instructions: 192COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 077D299B
__floor_pentium4.LIBCMT ref: 077D29C9
__floor_pentium4.LIBCMT ref: 077D29F5
__floor_pentium4.LIBCMT ref: 077D2A15
__floor_pentium4.LIBCMT ref: 077D2A41
__floor_pentium4.LIBCMT ref: 077D2A6D
__floor_pentium4.LIBCMT ref: 077D2A99
__floor_pentium4.LIBCMT ref: 077D2AB9
__floor_pentium4.LIBCMT ref: 077D2AE7
__floor_pentium4.LIBCMT ref: 077D2B13
__floor_pentium4.LIBCMT ref: 077D2B3F

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: ddf7e0967022ea40929928ab7b403c6beeec7cf249550130ff3680c308a86922
Instruction ID: 1e6660a442d00fbc2023bac973f2732e3d1a5d72d04b37e2c6090cb443dd7908
Opcode Fuzzy Hash: ddf7e0967022ea40929928ab7b403c6beeec7cf249550130ff3680c308a86922
Instruction Fuzzy Hash: 568126B1A09705DBD7006F61E04A45ABBF8FF84790F928D5CE0C1A2164EB308974CF87

Function 10006790 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 291COMMON

Download Yara Rule

APIs

VP8CheckSignature.LIBWEBP(?,?,00000000,?,?,?,?,1000B014,00000000,?), ref: 1000689B

Strings

cannot parse filter header, xrefs: 10006A05
bad partition length, xrefs: 1000697F
cannot parse partitions, xrefs: 10006A2D
cannot parse segment header, xrefs: 100069E4
Not a key frame., xrefs: 10006A51
Frame not displayable., xrefs: 10006857
Bad code word, xrefs: 100068A7
cannot parse picture header, xrefs: 10006883

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CheckSignature
String ID: Bad code word$Frame not displayable.$Not a key frame.$bad partition length$cannot parse filter header$cannot parse partitions$cannot parse picture header$cannot parse segment header
API String ID: 572727604-1584564319
Opcode ID: db3645ff7df56713291ac16f903761a4c4de11b1f985a4c76dda64ba599c9a27
Instruction ID: 6dad7c240748b97a9885d49da9054b3874ff7dd263315a257db88db6ffcdc25f
Opcode Fuzzy Hash: db3645ff7df56713291ac16f903761a4c4de11b1f985a4c76dda64ba599c9a27
Instruction Fuzzy Hash: 1F918DB66052845EEB00CF28EC407DE7BD6EF84396F24816BF9098A247E777D249C790

Function 100326E0 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 10032706
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 1003271A
LeaveCriticalSection.KERNEL32 ref: 10032721
WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 1003272F
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 10032739
EnterCriticalSection.KERNEL32 ref: 1003273C
LeaveCriticalSection.KERNEL32 ref: 10032774
WaitForSingleObjectEx.KERNEL32(?,00000000,00000000), ref: 10032782
SetEvent.KERNEL32(?), ref: 1003278C
WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 1003279A

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CriticalSection$ObjectSingleWait$EnterLeaveReleaseSemaphore$Event
String ID:
API String ID: 1696004078-0
Opcode ID: c89da078e126cf4d1949e73a9a55d7b14c87c93db1cacb1959db1ec7001819e8
Instruction ID: 2560856507387ed1bc77269c15dbabe32accd84933b11910d0af241e19af748d
Opcode Fuzzy Hash: c89da078e126cf4d1949e73a9a55d7b14c87c93db1cacb1959db1ec7001819e8
Instruction Fuzzy Hash: 0D215C71208311ABE221DB64CC84F5BB3E9FF89365F108A18F1559B2D0D7B5E845CBA4

Function 1004BBD0 Relevance: 13.9, APIs: 9, Instructions: 390COMMON

Download Yara Rule

APIs

WebPSafeCalloc.LIBWEBP(00000001,00000000,000008AC,?,?,00000003,?), ref: 1004BBE4
WebPGetWorkerInterface.LIBWEBP(?,00000003,?), ref: 1004BC40
WebPPictureInitInternal.LIBWEBP(?,0000020F,?,?,?,00000003,?), ref: 1004BC73
WebPPictureView.LIBWEBP(?,00000000,00000000,?,00000003,?,?,?,?,?,?,?,?,?,?,00000003), ref: 1004BDD1
WebPSafeCalloc.LIBWEBP(00000001,00000000,000008AC,?,?,?,00000000,00000000,?,00000003,?), ref: 1004BE2E

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CallocPictureSafe$InitInterfaceInternalViewWorker
String ID:
API String ID: 28409060-0
Opcode ID: 212fd127f59814b15d671d10df388ebe8085d422b646f8574dbd27661c3013aa
Instruction ID: 268e8073bd406199c22482bf578f813369c71772a531da731b44359d7844b6c9
Opcode Fuzzy Hash: 212fd127f59814b15d671d10df388ebe8085d422b646f8574dbd27661c3013aa
Instruction Fuzzy Hash: 6AE18AB59043058BDB24CF24C881A9FB7E5EFC8300F15493DED899B242E734EA49CB96

Function 100411B0 Relevance: 13.7, APIs: 9, Instructions: 163COMMON

Download Yara Rule

APIs

WebPPictureInitInternal.LIBWEBP(?,0000020F), ref: 10041218
WebPPictureInitInternal.LIBWEBP(?,0000020F), ref: 10041235

Part of subcall function 1003E180: _memset.LIBCMT ref: 1003E1A4

WebPPictureView.LIBWEBP(?,00000000,00000000,?,?,?), ref: 10041257
WebPPictureView.LIBWEBP(?,00000000,00000000,?,?,?), ref: 10041279
WebPPictureYUVAToARGB.LIBWEBP(00000000), ref: 10041295
WebPPictureYUVAToARGB.LIBWEBP(00000000), ref: 100412B7
WebPPlaneDistortion.LIBWEBP(?,?,?,?,?,?,00000004,?,?,?), ref: 10041314
WebPPictureFree.LIBWEBP(?), ref: 10041386
WebPPictureFree.LIBWEBP(?,?), ref: 10041393

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: Picture$FreeInitInternalView$DistortionPlane_memset
String ID:
API String ID: 2995558887-0
Opcode ID: c30f515a5f622a8513e6d49c865f310ad7afc744113f854de2834fadf7e119e1
Instruction ID: 1465e613384ff3bbed9487ec903aa788e88ef673f2ac71a456f5d3960417b9f1
Opcode Fuzzy Hash: c30f515a5f622a8513e6d49c865f310ad7afc744113f854de2834fadf7e119e1
Instruction Fuzzy Hash: D751ABB5A043459BD720DF51DC81BEBB7E8EFC4795F10492CF988C6281E770E914C6A6

Function 100327C0 Relevance: 12.1, APIs: 8, Instructions: 86COMMON

Download Yara Rule

APIs

WebPSafeCalloc.LIBWEBP(00000001,00000000,00000028), ref: 100327E4
InitializeCriticalSection.KERNEL32(00000000), ref: 100327FA

Part of subcall function 10032420: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,00000000), ref: 1003242F
Part of subcall function 10032420: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,00000000), ref: 1003243B
Part of subcall function 10032420: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10032448

DeleteCriticalSection.KERNEL32(00000000), ref: 1003280F
EnterCriticalSection.KERNEL32(00000000), ref: 10032817
LeaveCriticalSection.KERNEL32(00000000), ref: 10032861
DeleteCriticalSection.KERNEL32(00000000), ref: 1003286C

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CriticalSection$Create$DeleteSemaphore$CallocEnterEventInitializeLeaveSafe
String ID:
API String ID: 2566476724-0
Opcode ID: ec51417fbf7ba88cd9bebc47ed62dfcdc6a8b7bf274d81a785006e9fb8c420e3
Instruction ID: 24fee2e2940300cba8b149af008ff571cecda373172db7bb3f89e08599db873e
Opcode Fuzzy Hash: ec51417fbf7ba88cd9bebc47ed62dfcdc6a8b7bf274d81a785006e9fb8c420e3
Instruction Fuzzy Hash: 7521D876A42316AFFB21DF659C86B8B3698EF00752F014436FD05AE181DFB4DC41C6A5

Function 100324E0 Relevance: 12.1, APIs: 8, Instructions: 63COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 100324F5
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 10032518
LeaveCriticalSection.KERNEL32 ref: 1003251F
WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 10032529
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 10032537
EnterCriticalSection.KERNEL32 ref: 1003253A
LeaveCriticalSection.KERNEL32 ref: 10032555
LeaveCriticalSection.KERNEL32 ref: 10032565

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore$ObjectSingleWait
String ID:
API String ID: 684405992-0
Opcode ID: 7e091b306be25a828145dae03c98d0547940ccfe0641c80d35e2938e57e5ff70
Instruction ID: 732001523a60a14ee13f0df6ce31a08f3005b52b9ed6669b7bc0eef99b3390af
Opcode Fuzzy Hash: 7e091b306be25a828145dae03c98d0547940ccfe0641c80d35e2938e57e5ff70
Instruction Fuzzy Hash: 2E118232201711AFD221DB19EC80F5BF3E9FF85762F514605F5049B291D771F942CAA4

Function 1005A0AD Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 1005A0B3

Part of subcall function 1005C268: TlsGetValue.KERNEL32(?,1005C3F4,?,1005D008,?,00000001,?,?,1005D339,00000018,10074220,0000000C,1005D3CA,?,10032958), ref: 1005C271
Part of subcall function 1005C268: __decode_pointer.LIBCMT ref: 1005C283
Part of subcall function 1005C268: TlsSetValue.KERNEL32(00000000,1005D008,?,00000001,?,?,1005D339,00000018,10074220,0000000C,1005D3CA,?,10032958,?,1005E1E6,00000004), ref: 1005C292

___fls_getvalue@4.LIBCMT ref: 1005A0BE

Part of subcall function 1005C248: TlsGetValue.KERNEL32(?,?,1005A0C3,00000000), ref: 1005C256

___fls_setvalue@8.LIBCMT ref: 1005A0D1

Part of subcall function 1005C29C: __decode_pointer.LIBCMT ref: 1005C2AD

GetLastError.KERNEL32(00000000,?,00000000), ref: 1005A0DA
ExitThread.KERNEL32 ref: 1005A0E1
GetCurrentThreadId.KERNEL32 ref: 1005A0E7
__freefls@4.LIBCMT ref: 1005A107
__IsNonwritableInCurrentImage.LIBCMT ref: 1005A11A

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 1925773019-0
Opcode ID: af643f2ce37463a8239eb2980d8b209e422e8a271c6bcb0304e183a45164ac8a
Instruction ID: f0279da8dba53748bae2c380103fca596247eef982db8b716a80329882c31206
Opcode Fuzzy Hash: af643f2ce37463a8239eb2980d8b209e422e8a271c6bcb0304e183a45164ac8a
Instruction Fuzzy Hash: D4016238410795AFD704DBA1CC49D5D3BE9EF46354F118654F8048B252DB34E8C9CBA5

Function 1004A010 Relevance: 10.7, APIs: 7, Instructions: 211COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1004A036
WebPSafeMalloc.LIBWEBP(00000039,00000000,00000010,?,00000000,00000030), ref: 1004A04F

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: MallocSafe_memset
String ID:
API String ID: 1319453872-0
Opcode ID: 10f7fd73760f901654671f25b73292092988869e825fd61b8ac255e07dc66cc5
Instruction ID: 0f5c17c53e4e2cf040a394a8b8ad54be5fdd9783ed2e6dd1c940eb26ccb9a721
Opcode Fuzzy Hash: 10f7fd73760f901654671f25b73292092988869e825fd61b8ac255e07dc66cc5
Instruction Fuzzy Hash: 0261A1B56083006FD210DB69CC81F6FB3E9EFC9640F11492CF988D7252EA31ED418BA6

Function 100495C0 Relevance: 10.7, APIs: 7, Instructions: 203COMMON

Download Yara Rule

APIs

WebPSafeCalloc.LIBWEBP(00000000,?,00000003), ref: 1004966E
WebPSafeMalloc.LIBWEBP(00000001,00000000,?), ref: 100496C8
WebPSafeMalloc.LIBWEBP(00000000,?,?,?,00000003,00000000,00000010), ref: 100496E6
_memset.LIBCMT ref: 100497E4

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: Safe$Malloc$Calloc_memset
String ID:
API String ID: 229908273-0
Opcode ID: 6ba9cca52439c3123ee9122759ef15c6881b156b638a1efb5792b5e72a2710f5
Instruction ID: 8759daa886a2391aa9aa6c3686fc48a4d92511cdb57f7dbd2bd3eee3b1bfe56e
Opcode Fuzzy Hash: 6ba9cca52439c3123ee9122759ef15c6881b156b638a1efb5792b5e72a2710f5
Instruction Fuzzy Hash: 3B618BB5A04312AFD310CF68C881A6BB7E9EBC4744F154A2DF985DB342D671E905CBA1

Function 1004C8B0 Relevance: 10.7, APIs: 7, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9ce25ce57ab2f8d8ad1611a870e2deccc83bbf2b5f2addaaeff4975aa67845
Instruction ID: 365f859c645e7268e44279f10fadeb8aa38b4fd2e9b39ec6976a5b077753f48e
Opcode Fuzzy Hash: 4c9ce25ce57ab2f8d8ad1611a870e2deccc83bbf2b5f2addaaeff4975aa67845
Instruction Fuzzy Hash: 2D5109B6E0075A6BE791CA21BC05B8B72D4EF40399F220839E841D1141FB74F965CADB

Function 1005FA80 Relevance: 10.7, APIs: 7, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 1005FA95
__calloc_crt.LIBCMT ref: 1005FAA8

Part of subcall function 1005D03C: __calloc_impl.LIBCMT ref: 1005D04D
Part of subcall function 1005D03C: Sleep.KERNEL32(00000000,10032967,?), ref: 1005D064

__calloc_crt.LIBCMT ref: 1005FB36
GetFileType.KERNEL32(00000040,?,?,?,1005B068,?,?,?,10074150,0000000C,1005B123,?), ref: 1005FBBF
GetStdHandle.KERNEL32(-000000F6,?,?,?,1005B068,?,?,?,10074150,0000000C,1005B123,?), ref: 1005FC49
GetFileType.KERNEL32(00000000,?,?,?,1005B068,?,?,?,10074150,0000000C,1005B123,?), ref: 1005FC5B
SetHandleCount.KERNEL32 ref: 1005FCB3

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: FileHandleType__calloc_crt$CountInfoSleepStartup__calloc_impl
String ID:
API String ID: 74660793-0
Opcode ID: c271c4de8132c5704054306413ab45356845747c58c680477308f9e9f5d5be27
Instruction ID: 83df2694437e95960e40664e7c7cb7967fb77505e744815597aa9c6c5d9e4caa
Opcode Fuzzy Hash: c271c4de8132c5704054306413ab45356845747c58c680477308f9e9f5d5be27
Instruction Fuzzy Hash: EC711371804759CEE710CB68CA84B697FE0EF06370F26476DD8A69B2E2D778D849CB11

Function 100325F0 Relevance: 10.5, APIs: 7, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 100324E0: EnterCriticalSection.KERNEL32 ref: 100324F5
Part of subcall function 100324E0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 10032518
Part of subcall function 100324E0: LeaveCriticalSection.KERNEL32 ref: 1003251F
Part of subcall function 100324E0: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 10032529
Part of subcall function 100324E0: ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 10032537
Part of subcall function 100324E0: EnterCriticalSection.KERNEL32 ref: 1003253A
Part of subcall function 100324E0: LeaveCriticalSection.KERNEL32 ref: 10032555

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 10032612
CloseHandle.KERNEL32(?), ref: 10032623
DeleteCriticalSection.KERNEL32 ref: 10032626
CloseHandle.KERNEL32(?), ref: 10032630
CloseHandle.KERNEL32(?), ref: 10032636
CloseHandle.KERNEL32(?), ref: 1003263C

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CriticalSection$CloseHandle$EnterLeaveObjectReleaseSemaphoreSingleWait$Delete
String ID:
API String ID: 3483831534-0
Opcode ID: 010e6a33ae73bf0945f61f0a90c48ea5424974deba126afa4a1a8e7d8d5c725d
Instruction ID: 7dbd73fd2756a6ffe14797905de3fd5bbac8aa217678330838db084c77b6f8b5
Opcode Fuzzy Hash: 010e6a33ae73bf0945f61f0a90c48ea5424974deba126afa4a1a8e7d8d5c725d
Instruction Fuzzy Hash: 61F09072100714BFE221AF659C85F4BB3ACFF88725F114A1AF9096B291D674F801CAB4

Function 100083F0 Relevance: 9.3, APIs: 6, Instructions: 346COMMON

Download Yara Rule

APIs

WebPSafeCalloc.LIBWEBP(00000118,?,00000004,?,?,?,?,?,?,?,?,?,1000A1C3,?,?,?), ref: 100085B5

Part of subcall function 1000A100: _memset.LIBCMT ref: 1000A2F0

WebPSafeMalloc.LIBWEBP(?,?,00000004,?,?,?,?,?,?,?,?,?), ref: 100084E9
_memset.LIBCMT ref: 10008527

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: Safe_memset$CallocMalloc
String ID:
API String ID: 1974006931-0
Opcode ID: 81b71ac0fff69917a3e76a2ad874eeea0b53e9f8e0de0b0a85406ed1afbfb655
Instruction ID: e7282f893bf22dcf38f9aaddd36c59fe4e705665b7645dfc78c061857c48d60b
Opcode Fuzzy Hash: 81b71ac0fff69917a3e76a2ad874eeea0b53e9f8e0de0b0a85406ed1afbfb655
Instruction Fuzzy Hash: 85D19B75A087529FE304CF28C88175BB7E5FB88384F11492DF9888B349E775EA45CB92

Function 100418C0 Relevance: 9.3, APIs: 6, Instructions: 262memoryCOMMON

Download Yara Rule

APIs

WebPPictureAlloc.LIBWEBP(?,?), ref: 10041931

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: AllocPicture
String ID:
API String ID: 3635584439-0
Opcode ID: 1738a7174341d6857ffc230c1d7690a844d975f5eb2756b4fb8aae9071addef2
Instruction ID: bfc1c8ea836457d70317f1d11ae6547896aa99cacd2cc4ac5ab1b85530fc7e10
Opcode Fuzzy Hash: 1738a7174341d6857ffc230c1d7690a844d975f5eb2756b4fb8aae9071addef2
Instruction Fuzzy Hash: D18190B57042056BD704DE59EC81FAB73E9EBC8354F108A2DFE49C7282EA31ED0587A5

Function 10041630 Relevance: 9.2, APIs: 6, Instructions: 175memoryCOMMON

Download Yara Rule

APIs

WebPPictureAlloc.LIBWEBP(?,?), ref: 100416B3

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: AllocPicture
String ID:
API String ID: 3635584439-0
Opcode ID: 8e8a7bb614388794462d9d2a7850c2877dfb722896c83da31ecf65a45bb7a51c
Instruction ID: 7a9a06683f214ef56b7768d6b37289c50b9795c89b704b434286b945ff225095
Opcode Fuzzy Hash: 8e8a7bb614388794462d9d2a7850c2877dfb722896c83da31ecf65a45bb7a51c
Instruction Fuzzy Hash: 385154B6604205AFCB04CF59DC81E9BB3E9EBC8310F198669FD58CB245E630F915CBA5

Function 100346D8 Relevance: 9.2, APIs: 6, Instructions: 158COMMON

Download Yara Rule

APIs

WebPSafeMalloc.LIBWEBP(?,?,00000004), ref: 100347E9

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: MallocSafe
String ID:
API String ID: 2976254555-0
Opcode ID: 70c92ace227f2b7325756e9dd7ac4af11b8e871ca89ac4188bc5a38782938346
Instruction ID: 9436539a8a47f44dc3a755b71ae017ca96848b00ff8a4f70418250bbacd722fb
Opcode Fuzzy Hash: 70c92ace227f2b7325756e9dd7ac4af11b8e871ca89ac4188bc5a38782938346
Instruction Fuzzy Hash: 9E51C0B8A08202DFC311CF20D58078A7BA4FF82355F37889CD6995E245E732E425CF55

Function 100413B0 Relevance: 9.1, APIs: 6, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

WebPPictureAlloc.LIBWEBP(?,?), ref: 100413E6

Part of subcall function 1003E630: WebPPictureFree.LIBWEBP(?), ref: 1003E63A

WebPCopyPlane.LIBWEBP(?,?,?,?,?,?), ref: 1004141A
WebPCopyPlane.LIBWEBP(?,?,?,?,?,?,?,?,?,?,?,?), ref: 1004143D
WebPCopyPlane.LIBWEBP(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10041460
WebPCopyPlane.LIBWEBP(?,?,?,?,?,?), ref: 10041484
WebPCopyPlane.LIBWEBP(?,?,?,?,?,?), ref: 100414B8

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CopyPlane$Picture$AllocFree
String ID:
API String ID: 4017657513-0
Opcode ID: bd1937b0bef50f7e274e96849421e453e31fc440cf4deace5360f4d3e9832a9f
Instruction ID: d23130a91ab93c57ab1d8fce40b1e99d016c1ef0bfc172e1e368a82f336c5d22
Opcode Fuzzy Hash: bd1937b0bef50f7e274e96849421e453e31fc440cf4deace5360f4d3e9832a9f
Instruction Fuzzy Hash: 043109B5200105AFDB48CF58DCC1EA773ADEB88315B198659BD498B34ADA34FC51CAA4

Function 1005A130 Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 1005A161
__calloc_crt.LIBCMT ref: 1005A16D
__getptd.LIBCMT ref: 1005A17A
CreateThread.KERNEL32(?,?,1005A0AD,00000000,?,?), ref: 1005A1B1
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 1005A1BB
__dosmaperr.LIBCMT ref: 1005A1D3

Part of subcall function 1005CFAE: __getptd_noexit.LIBCMT ref: 1005CFAE

Part of subcall function 1005D20D: __decode_pointer.LIBCMT ref: 1005D218

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
String ID:
API String ID: 1803633139-0
Opcode ID: 9b4d246db71785e21dad813a121c0c0569e9801e1acb6cc22046c45fd11a20d2
Instruction ID: 29449978f18a22f62837ac41b491c82337d59a729dd2b1c773fcc0e60cb2e0ab
Opcode Fuzzy Hash: 9b4d246db71785e21dad813a121c0c0569e9801e1acb6cc22046c45fd11a20d2
Instruction Fuzzy Hash: 1711E376504719EFDB10EFA4CC82C8F7BE5EF05360F21452AF505D2191EB31A9899BA4

Function 10032420 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,00000000), ref: 1003242F
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,00000000), ref: 1003243B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10032448
CloseHandle.KERNEL32 ref: 1003246C
CloseHandle.KERNEL32(?), ref: 10032472
CloseHandle.KERNEL32(?), ref: 10032478

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CloseCreateHandle$Semaphore$Event
String ID:
API String ID: 1779580104-0
Opcode ID: b81e3938595183dd2ea2ed055db92a0101dd1e2fc5d9806a4dfa63aa45074491
Instruction ID: 2a4c4648349e298eaf41583137ee27e37180e7016b1f71b6321bb376e7b3e557
Opcode Fuzzy Hash: b81e3938595183dd2ea2ed055db92a0101dd1e2fc5d9806a4dfa63aa45074491
Instruction Fuzzy Hash: E9F01D31790301AAF6709B69DC56F06B2E5AF88B01F214819F2599B5D0D6F5F480CA14

Function 10003040 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

WebPSafeMalloc.LIBWEBP ref: 10003178
_memset.LIBCMT ref: 100032DB
_memset.LIBCMT ref: 100032F4

Strings

no memory during frame initialization., xrefs: 1000318A

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset$MallocSafe
String ID: no memory during frame initialization.
API String ID: 1594756895-1605158098
Opcode ID: b8ced9f54a7b75c4cb07e1084b953435d5e91b845e2606bd24da0e69f7fcfbc0
Instruction ID: acffb436e00f20ea25b5f040c8e429025991b0a1d913a51de6b1cf148bafd0f8
Opcode Fuzzy Hash: b8ced9f54a7b75c4cb07e1084b953435d5e91b845e2606bd24da0e69f7fcfbc0
Instruction Fuzzy Hash: 13815CB1A047018FE318CF39C88179BB7E6FBC8354F09892EE4AA87255DB74B5458B51

Function 10059180 Relevance: 7.9, APIs: 5, Instructions: 424COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 100591C6
_memset.LIBCMT ref: 100591E0
_memset.LIBCMT ref: 100591F6
_memset.LIBCMT ref: 10059348
_memset.LIBCMT ref: 10059365

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c8a2636cd03794d8c1ab1453ba11427147ea63a6b1a48a194a87faaafa7a7ee6
Instruction ID: 56857b5e5c0371ec4218856578926faa9efad9a0299a8871cebbb9242ced0529
Opcode Fuzzy Hash: c8a2636cd03794d8c1ab1453ba11427147ea63a6b1a48a194a87faaafa7a7ee6
Instruction Fuzzy Hash: C8F11670A087029BD716EF15E58869FB7E0FBC5384F328D2DE5C592250EB358969CF82

Function 10036190 Relevance: 7.9, APIs: 5, Instructions: 424COMMON

Download Yara Rule

APIs

WebPSafeMalloc.LIBWEBP(00040000,00000000,00000004), ref: 10036237
_memset.LIBCMT ref: 1003627A

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: MallocSafe_memset
String ID:
API String ID: 1319453872-0
Opcode ID: 272e3f07acd293cdfb48b1be55c46f249da7d36baf715e8e6b19462be5d8e60f
Instruction ID: 5ecdf8fa65e879c30311a5da439d79863df8e6efb6c9b5108ae06815b8c20602
Opcode Fuzzy Hash: 272e3f07acd293cdfb48b1be55c46f249da7d36baf715e8e6b19462be5d8e60f
Instruction Fuzzy Hash: 3CF179716083029FC719CF28D890A5AB7E6EFC8344F15892DF9868B355D371EA46CB82

Function 1003C250 Relevance: 7.9, APIs: 5, Instructions: 374COMMON

Download Yara Rule

APIs

WebPSafeMalloc.LIBWEBP(?,?,00000004), ref: 1003C2A5

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: MallocSafe
String ID:
API String ID: 2976254555-0
Opcode ID: e341610a57274014662d058a4995683572cedd27edb47f5c5df2a58b639a5261
Instruction ID: 69b3eae586ea385734feeb5aeca6c7dc4dccc11e0c23a6ce9d3a36a32174d8b2
Opcode Fuzzy Hash: e341610a57274014662d058a4995683572cedd27edb47f5c5df2a58b639a5261
Instruction Fuzzy Hash: ADE156B460830ADFC705CF19C484A5ABBF1FF89345F258A2DE8959B341D731E965CB82

Function 10054830 Relevance: 7.8, APIs: 5, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44e12b18da8a4448c26557a7fdc7d618da86287a05d70a7dc318f724396a0d6
Instruction ID: f643697f330d72e2860250e3268f7eb679f085c562a9c88932abc8e1f597f9f3
Opcode Fuzzy Hash: c44e12b18da8a4448c26557a7fdc7d618da86287a05d70a7dc318f724396a0d6
Instruction Fuzzy Hash: 5AC1A8B56043849BFB21CF20CC81FE63BA4EB45308F094669EE895F186DF74664DC761

Function 10001AD0 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

WebPCopyPlane.LIBWEBP(5D5F04C4,5EC68B5B,5D5F04C4,5EC68B5B,24448DF0,74E85048,?,00000000,1000B5DD,?,?), ref: 10001B1E

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CopyPlane
String ID:
API String ID: 248045760-0
Opcode ID: f8b5cc2c85e8a36c6fee82d95ea1e6eb4cfb471e8b0a7697612413ca75bd976d
Instruction ID: 5dff8c07933219e565e6c1c9bbfb2d5bec2b89d16f7d137d069ec56e940eb6c1
Opcode Fuzzy Hash: f8b5cc2c85e8a36c6fee82d95ea1e6eb4cfb471e8b0a7697612413ca75bd976d
Instruction Fuzzy Hash: 22411BB5200902AF9265CB6DE980D67F3F9FB8C2507158A0AF55AC7A54E730FC51CBA0

Function 10031820 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 10031410: _memset.LIBCMT ref: 10031458

WebPSafeMalloc.LIBWEBP(00000001,00000000,00000010,?,?,?,00000000,00000000,?), ref: 10031894
WebPSafeMalloc.LIBWEBP(00000000,?,00000004,?,?,?,?,?,00000000,00000000,?), ref: 100318B2
WebPSafeMalloc.LIBWEBP(?,00000002,00000002,?,?,?,00000000,00000000,?), ref: 1003191A

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: MallocSafe$_memset
String ID:
API String ID: 2803130383-0
Opcode ID: f564b432df7a29338023231ae309029b7aaa4b76db37751c66f8da1aac44a3a8
Instruction ID: 8e01b7148017c202623ce846fe61901acaf0b73be91cb26370ee73774f3412c3
Opcode Fuzzy Hash: f564b432df7a29338023231ae309029b7aaa4b76db37751c66f8da1aac44a3a8
Instruction Fuzzy Hash: B83160B5A003016FD221DF59C881BABB3F9FB89710F05892DFA489B242D775F84587E5

Function 1003E670 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

WebPConfigInitInternal.LIBWEBP(?,00000000,?,0000020F), ref: 1003E6A0
_memset.LIBCMT ref: 1003E6BD
WebPEncode.LIBWEBP(?,?), ref: 1003E75B
WebPPictureFree.LIBWEBP(?), ref: 1003E775
WebPMemoryWriterClear.LIBWEBP(?), ref: 1003E787

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: ClearConfigEncodeFreeInitInternalMemoryPictureWriter_memset
String ID:
API String ID: 265483114-0
Opcode ID: 7acd576da8c905c688307ca26847a859fb2061c496bcdec7ab1e56d2236180df
Instruction ID: 257716179f5a44115cd30c9c061a6dafbdc2eae86cc777fd629b1c617c9764ed
Opcode Fuzzy Hash: 7acd576da8c905c688307ca26847a859fb2061c496bcdec7ab1e56d2236180df
Instruction Fuzzy Hash: 6E3140B55083809FE361CF54D985B9BB7E4EFC8745F404E1DF5888A281E775E908CB52

Function 1000A020 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000A069

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: ae7b7e30378d7648794ab40508840ef11d64ef6c1b01581b66c46403e5986418
Instruction ID: be14201cc4491b7fdbcb494fc888ebf960feaadea7e74db1eeb200c65c719e0c
Opcode Fuzzy Hash: ae7b7e30378d7648794ab40508840ef11d64ef6c1b01581b66c46403e5986418
Instruction Fuzzy Hash: 6F116DBA500B08AFD224DFB4D881AD7B3B8FF45340F054A0EE25A0B102DB35F555CBA1

Function 077D9F43 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 077D9F4F

Part of subcall function 077D7FD9: __getptd_noexit.LIBCMT ref: 077D7FDC
Part of subcall function 077D7FD9: __amsg_exit.LIBCMT ref: 077D7FE9

__amsg_exit.LIBCMT ref: 077D9F6F
__lock.LIBCMT ref: 077D9F7F
InterlockedDecrement.KERNEL32(?), ref: 077D9F9C
InterlockedIncrement.KERNEL32(078C1668), ref: 077D9FC7

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 5cd3ffbb998bab2818edb46a5a36228f8b0b7f957d9ff784033c83d7649ffa1f
Instruction ID: b3daa07f89a3828a9bb3c919c55284b5072976cf9910f4885ffc2b0a2b5316f2
Opcode Fuzzy Hash: 5cd3ffbb998bab2818edb46a5a36228f8b0b7f957d9ff784033c83d7649ffa1f
Instruction Fuzzy Hash: 7E01ADF1A00712EBCB25ABB4944A79D7BB0EB087E0F044515EA14AB290C738BD51CFD2

Function 100604D3 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 100604DF

Part of subcall function 1005C456: __getptd_noexit.LIBCMT ref: 1005C459
Part of subcall function 1005C456: __amsg_exit.LIBCMT ref: 1005C466

__amsg_exit.LIBCMT ref: 100604FF
__lock.LIBCMT ref: 1006050F
InterlockedDecrement.KERNEL32(?), ref: 1006052C
InterlockedIncrement.KERNEL32(07841668), ref: 10060557

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 05094d616dc56bac4cc1f4d3239fb68dee6974fc4e59e3cf8fd1970942778717
Instruction ID: ae6aa9d4fc8e83163b767d0afabfa64a435f6ca516d177f0604983e7ea31df38
Opcode Fuzzy Hash: 05094d616dc56bac4cc1f4d3239fb68dee6974fc4e59e3cf8fd1970942778717
Instruction Fuzzy Hash: 9601C036A41A21EFE751DB658C45B8FB7B5EB04760F010205F856A7291EB387D81CFE1

Function 077D389D Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 077D38BB

Part of subcall function 077D4554: __mtinitlocknum.LIBCMT ref: 077D456A
Part of subcall function 077D4554: __amsg_exit.LIBCMT ref: 077D4576
Part of subcall function 077D4554: EnterCriticalSection.KERNEL32(?,?,?,077DC79F,00000004,077E6240,0000000C,077D8378,00000001,?,00000000,00000000,00000000,?,077D7F8B,00000001), ref: 077D457E

___sbh_find_block.LIBCMT ref: 077D38C6
___sbh_free_block.LIBCMT ref: 077D38D5
HeapFree.KERNEL32(00000000,00000001,077E6010,0000000C,077D4535,00000000,077E6050,0000000C,077D456F,00000001,?,?,077DC79F,00000004,077E6240,0000000C), ref: 077D3905
GetLastError.KERNEL32(?,077DC79F,00000004,077E6240,0000000C,077D8378,00000001,?,00000000,00000000,00000000,?,077D7F8B,00000001,00000214), ref: 077D3916

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: ef823b305bae02e36ec220d74726e317d7ac2a5e3e5a7de85aa677bf00a00c84
Instruction ID: 5bc04ba7a9f9857eb2f0210020962933633655bcba2c623c59519b983cbe5e09
Opcode Fuzzy Hash: ef823b305bae02e36ec220d74726e317d7ac2a5e3e5a7de85aa677bf00a00c84
Instruction Fuzzy Hash: 930167F1901346DBDF207F70980EF5D7BB4AF053E9F154529E515AA090DF388D508A57

Function 1005A339 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 1005A357

Part of subcall function 1005D3AF: __mtinitlocknum.LIBCMT ref: 1005D3C5
Part of subcall function 1005D3AF: __amsg_exit.LIBCMT ref: 1005D3D1
Part of subcall function 1005D3AF: EnterCriticalSection.KERNEL32(10032958,10032958,?,1005E1E6,00000004,10074240,0000000C,1005A313,?,10032967,00000000,?,?,00000000,10032967,?), ref: 1005D3D9

___sbh_find_block.LIBCMT ref: 1005A362
___sbh_free_block.LIBCMT ref: 1005A371
HeapFree.KERNEL32(00000000,?,10074130,Function_0005A339,1005C447,00000000,?,1005D008,?,00000001,?,?,1005D339,00000018,10074220,0000000C), ref: 1005A3A1
GetLastError.KERNEL32(?,1005D008,?,00000001,?,?,1005D339,00000018,10074220,0000000C,1005D3CA,?,10032958,?,1005E1E6,00000004), ref: 1005A3B2

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 6914052f842f42e21be7bcb99ad71f6379c4cfd254a255a3157980634192e041
Instruction ID: 056efe86ca25bad3ec9aeb655d41facfe1a78a49170f40d0c5fcc5fb62cc701c
Opcode Fuzzy Hash: 6914052f842f42e21be7bcb99ad71f6379c4cfd254a255a3157980634192e041
Instruction Fuzzy Hash: 2401DB35901315EEEB20EF708C46B4E3BE4DF01365F114115F044A60D1DB78AAC89B95

Function 1005A0A1 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1005CB8D: _doexit.LIBCMT ref: 1005CB99

___set_flsgetvalue.LIBCMT ref: 1005A0B3

Part of subcall function 1005C268: TlsGetValue.KERNEL32(?,1005C3F4,?,1005D008,?,00000001,?,?,1005D339,00000018,10074220,0000000C,1005D3CA,?,10032958), ref: 1005C271
Part of subcall function 1005C268: __decode_pointer.LIBCMT ref: 1005C283
Part of subcall function 1005C268: TlsSetValue.KERNEL32(00000000,1005D008,?,00000001,?,?,1005D339,00000018,10074220,0000000C,1005D3CA,?,10032958,?,1005E1E6,00000004), ref: 1005C292

___fls_getvalue@4.LIBCMT ref: 1005A0BE

Part of subcall function 1005C248: TlsGetValue.KERNEL32(?,?,1005A0C3,00000000), ref: 1005C256

___fls_setvalue@8.LIBCMT ref: 1005A0D1

Part of subcall function 1005C29C: __decode_pointer.LIBCMT ref: 1005C2AD

GetLastError.KERNEL32(00000000,?,00000000), ref: 1005A0DA
ExitThread.KERNEL32 ref: 1005A0E1
GetCurrentThreadId.KERNEL32 ref: 1005A0E7
__freefls@4.LIBCMT ref: 1005A107
__IsNonwritableInCurrentImage.LIBCMT ref: 1005A11A

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 132634196-0
Opcode ID: 9c1ee79d4b8fa126ac0892ca3995595befa959fa9520c9b333a51b0f7b4be5ed
Instruction ID: 4ef15d3223001acd04499119b71d57743274634e6d7e17acf1aa4fa898ab6344
Opcode Fuzzy Hash: 9c1ee79d4b8fa126ac0892ca3995595befa959fa9520c9b333a51b0f7b4be5ed
Instruction Fuzzy Hash: 57E04F3981421E6FDB00A7F18C0AC8E366DEE41290F004600F914D3002EE24A8894BB1

Function 077D3F9D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 077D402D

Part of subcall function 077D7980: __87except.LIBCMT ref: 077D79BB

Strings

pow, xrefs: 077D4005, 077D4022

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 73db1e4ba182965e5fe5b0ea4cd4b4fa8a2148adcb9105504d1d539bb1e20752
Instruction ID: f34407f4d50c823af57f5b89116e71be26ba8ab0cce8365b80a093f709486d89
Opcode Fuzzy Hash: 73db1e4ba182965e5fe5b0ea4cd4b4fa8a2148adcb9105504d1d539bb1e20752
Instruction Fuzzy Hash: 72515EF1A1C147C6CF197B28C90537A2BB4EB417D5F248D9CE8D54A1E4EB358C9486C3

Function 1005A7DD Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 1005A86D

Part of subcall function 1005EAA0: __87except.LIBCMT ref: 1005EADB

Strings

pow, xrefs: 1005A845, 1005A862

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 3255efe292ec57b261b8eb641d1074979abef8ab492351da889213b11750a76d
Instruction ID: 5546ebd1354f2cf3b728a84e387e056f39b54941987959c4d21dcf9e6ce61959
Opcode Fuzzy Hash: 3255efe292ec57b261b8eb641d1074979abef8ab492351da889213b11750a76d
Instruction Fuzzy Hash: C0512731D0838396D749E724C94137E6BD4EF42790F20CD6DE8D5821A5EE389CCD9A43

Function 1003CD80 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

WebPSafeMalloc.LIBWEBP(?,?,00000004,00000001,?), ref: 1003CDE2

Part of subcall function 1003BFD0: WebPSafeMalloc.LIBWEBP(?,?,00000010), ref: 1003C002

Strings

d, xrefs: 1003CE47

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: MallocSafe
String ID: d
API String ID: 2976254555-2564639436
Opcode ID: 910d5d6bb1d2a06cf7e77e9a77d645a2ec748baf56f2b3b511467680816decc7
Instruction ID: 7049609f2c24c392d7668332652c0065e2a9dc60c1cab2852b912c1ce1783ccb
Opcode Fuzzy Hash: 910d5d6bb1d2a06cf7e77e9a77d645a2ec748baf56f2b3b511467680816decc7
Instruction Fuzzy Hash: B651AB75608308AFC301DB55C881E6FB7E9EFC5345F05482DF985CB252EA75E905CBA2

Function 100331A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

WebPSafeMalloc.LIBWEBP(00000001,00000000,?,00000000,00000000,?,?,?,00000000,1004C9FD,00000000), ref: 100331F5
WebPCopyPlane.LIBWEBP(?,?,00000000,?,?,?,00000000,?,?,?,00000000,1004C9FD,00000000), ref: 10033224

Strings

gfff, xrefs: 1003323C

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CopyMallocPlaneSafe
String ID: gfff
API String ID: 27801988-1553575800
Opcode ID: 23f94fa5f40e5b390a1f345ecbba24604b76ff2e55a8ab95cfec59575af22dfe
Instruction ID: ae09e90b05b7cb6fdf3a290648670da87970850440c600bfa1f788855d9700ec
Opcode Fuzzy Hash: 23f94fa5f40e5b390a1f345ecbba24604b76ff2e55a8ab95cfec59575af22dfe
Instruction Fuzzy Hash: 27418CB5604701AFD304CB19E881D6BB7E8EBC8255F44892DF949CB352E631F944CBA2

Function 077D644F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,077D399A), ref: 077D6454
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 077D6464

Strings

IsProcessorFeaturePresent, xrefs: 077D645E
KERNEL32, xrefs: 077D644F

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 004fac49c480f438180638ce828ab2d324069e81adfff92aebfb040202c093f7
Instruction ID: 15c5bf68eda5d68f88abd70dd49aa876e1d9c529d160e5aa587e94afc8178a00
Opcode Fuzzy Hash: 004fac49c480f438180638ce828ab2d324069e81adfff92aebfb040202c093f7
Instruction Fuzzy Hash: 7FF01DB0A00A4DD2DF001BA1B90F26E7A79BB847C1FD24590D1D2E0084DE7486B08295

Function 1005C023 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,10059BEA), ref: 1005C028
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 1005C038

Strings

KERNEL32, xrefs: 1005C023
IsProcessorFeaturePresent, xrefs: 1005C032

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: c87cc1015036bf67ccf5a706e9910e9112319a81e60a90f0d8c0444ac0913a05
Instruction ID: 05549967617fdd965919294ef05147626cd3cc21824378fa40f3f32a11d3435c
Opcode Fuzzy Hash: c87cc1015036bf67ccf5a706e9910e9112319a81e60a90f0d8c0444ac0913a05
Instruction Fuzzy Hash: 4BF03030900A1ED2FF405BB5AC5DAAF7ABAFB80745F920590D6D1A00D4DF708474C651

Function 10036D40 Relevance: 6.3, APIs: 4, Instructions: 318COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10036D6C
_memset.LIBCMT ref: 10036D83
WebPSafeMalloc.LIBWEBP(?,?,00000002,?,00000000,0000007C,?,00000000,0000007C), ref: 10036D97

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset$MallocSafe
String ID:
API String ID: 1594756895-0
Opcode ID: 7be61ca9a903f1eb254e13c8377f69c825722c48d59da557067e9e6e0e0dc199
Instruction ID: 9fe5d610328c52816c5c827269535c6055e6c2496fea6f08821d9dc9b4759c46
Opcode Fuzzy Hash: 7be61ca9a903f1eb254e13c8377f69c825722c48d59da557067e9e6e0e0dc199
Instruction Fuzzy Hash: E4C19675A083528FC366DF18D88066BB7E1FF88351F11896DE989DB241D735E849CB82

Function 1000A100 Relevance: 6.2, APIs: 4, Instructions: 187COMMON

Download Yara Rule

APIs

WebPSafeMalloc.LIBWEBP(00000000,?,?,?,?,00000000,00000004), ref: 1000A284
_memset.LIBCMT ref: 1000A2F0

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: MallocSafe_memset
String ID:
API String ID: 1319453872-0
Opcode ID: 0ea48e1d1aeeadb647eaa325281b9441608f95c46743acd3bcaf897c34b32c08
Instruction ID: 2e238d0a35c7d5bba853649bb69ea303134c6504c661b1ff0795defe9801bc60
Opcode Fuzzy Hash: 0ea48e1d1aeeadb647eaa325281b9441608f95c46743acd3bcaf897c34b32c08
Instruction Fuzzy Hash: FB519CB55043069FE310DF65D840BABB3E8FB89384F000A2DF94487645E7B5FA88CBA1

Function 10031FF0 Relevance: 6.2, APIs: 4, Instructions: 171COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 100320AF
__aulldiv.LIBCMT ref: 1003210B
__aulldiv.LIBCMT ref: 10032143
_memset.LIBCMT ref: 10032165

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: __aulldiv$_memset
String ID:
API String ID: 4237763252-0
Opcode ID: 9216c1dc1b941f08d4272646e905896504a96fa6d975332836243358ead63806
Instruction ID: a31d733f297547251cd012d458919a82d4191f6bbcbc4b7969dfca29620be6a2
Opcode Fuzzy Hash: 9216c1dc1b941f08d4272646e905896504a96fa6d975332836243358ead63806
Instruction Fuzzy Hash: 2B515CB5604701AFD768CF298881A2BB7FAFBC8741F50892DF489C7651D771E904CB61

Function 10032B90 Relevance: 6.1, APIs: 4, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

WebPPictureInitInternal.LIBWEBP(?,0000020F,?,?,?), ref: 10032BB3
WebPPictureAlloc.LIBWEBP ref: 10032BDF

Part of subcall function 1003E630: WebPPictureFree.LIBWEBP(?), ref: 1003E63A

WebPConfigInitInternal.LIBWEBP(?,00000000,?,0000020F), ref: 10032C2E
WebPPictureFree.LIBWEBP(?,?,?,?,00000000), ref: 10032C9A

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: Picture$FreeInitInternal$AllocConfig
String ID:
API String ID: 2539684544-0
Opcode ID: be2a6ba805ec7572d341e035e5ff8f52206af373471eca9ffe67f88cf9ef8801
Instruction ID: db1fcf7928b6367ba70eb73d7ea9da4f0233af2c2e2b12fefad03cf21d2290d1
Opcode Fuzzy Hash: be2a6ba805ec7572d341e035e5ff8f52206af373471eca9ffe67f88cf9ef8801
Instruction Fuzzy Hash: 6731A076508345AFD321CF54D881BEBB7E8FB88700F004A1DF98897282D775A958CBA2

Function 10037D20 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38e2cc6dad26e8223e798c34362fb025cf7b03264ac9fb969d933f15cd4ea6d
Instruction ID: 743d148eb505c5ada002ba56542c7e9a809b8961cc0498e3d3be23d9679d6ef7
Opcode Fuzzy Hash: c38e2cc6dad26e8223e798c34362fb025cf7b03264ac9fb969d933f15cd4ea6d
Instruction Fuzzy Hash: B13167F48156108FE758CF19E648A567EE0FB48315F4681AEE1088F3A2D3BAC548CF49

Function 077D631A Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 077D6340

Part of subcall function 077D6165: __fltout2.LIBCMT ref: 077D6191

__cftog_l.LIBCMT ref: 077D6366
__cftoe_l.LIBCMT ref: 077D6398

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: fb642ef6ce3bac23f7d77b1fc977561f9a1681bea5ade03023d90643064fe229
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 8A1148B244024EFBCF125E84CC05CEE3F72BB192D4B498815FA1899030D376D9B1AB82

Function 1005BEEE Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 1005BF14

Part of subcall function 1005BD39: __fltout2.LIBCMT ref: 1005BD65

__cftog_l.LIBCMT ref: 1005BF3A
__cftoe_l.LIBCMT ref: 1005BF6C

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 68f4a3919ead761f31bd14aab83934d9258496640c8641226989884874fbb651
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 76117B3640444EFBCF128E84CC41CEE3FA2FB08290B148464FA1958031D637EAB9EF91

Function 10004030 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

WebPFreeDecBuffer.LIBWEBP(?), ref: 10004097

Part of subcall function 10002F50: WebPGetWorkerInterface.LIBWEBP ref: 10002F64

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: BufferFreeInterfaceWorker
String ID:
API String ID: 3402948626-0
Opcode ID: d998456223a06daaca197baf90548f56b67bca61c351dc92f8f84430276b3c19
Instruction ID: e1ac2a6b6020d60ec48af013d97847cc581f3dd8141240a0b1161ab79f6836a3
Opcode Fuzzy Hash: d998456223a06daaca197baf90548f56b67bca61c351dc92f8f84430276b3c19
Instruction Fuzzy Hash: 08F06DBA9107119BE620DB709C41B5B73E8EB41281F06491DE6865710ADA35F85487A6

Function 077DA6AF Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 077DA6BB

Part of subcall function 077D7FD9: __getptd_noexit.LIBCMT ref: 077D7FDC
Part of subcall function 077D7FD9: __amsg_exit.LIBCMT ref: 077D7FE9

__getptd.LIBCMT ref: 077DA6D2
__amsg_exit.LIBCMT ref: 077DA6E0
__lock.LIBCMT ref: 077DA6F0

Memory Dump Source

Source File: 00000004.00000002.3393297664.00000000077D1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 077D0000, based on PE: true

Associated: 00000004.00000002.3393280485.00000000077D0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393330091.00000000077E1000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393352921.00000000077E7000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393370689.00000000077E8000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393389082.00000000077E9000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3393406651.00000000077EB000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_77d0000_FSCapture.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: c19845abb6a0a11456919da3fd0618cc5507dd7de0fe5056c561662922f1fb09
Instruction ID: 889ad48514210c9aaef1770168faeb7e63b272463a5a60d4b4711ff359b135fd
Opcode Fuzzy Hash: c19845abb6a0a11456919da3fd0618cc5507dd7de0fe5056c561662922f1fb09
Instruction Fuzzy Hash: A6F06DB1A40305DBDB20BBB4840975832B0BB047E9F05C54AD8419B2A0CB749E12CBA3

Function 10060C3F Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10060C4B

Part of subcall function 1005C456: __getptd_noexit.LIBCMT ref: 1005C459
Part of subcall function 1005C456: __amsg_exit.LIBCMT ref: 1005C466

__getptd.LIBCMT ref: 10060C62
__amsg_exit.LIBCMT ref: 10060C70
__lock.LIBCMT ref: 10060C80

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 0ade45ac7e3d0c595e53732a9233f60d0ef78d3e241f2c79b345d9bc94aafe48
Instruction ID: 935b3cb2ed76482d5041cadff8720df992e2e795a1b5a09fe44a78e5c2f41121
Opcode Fuzzy Hash: 0ade45ac7e3d0c595e53732a9233f60d0ef78d3e241f2c79b345d9bc94aafe48
Instruction Fuzzy Hash: 52F09036A807189FD320EBB48906F8E73B1EF04360F014319F491A7292DB347945DF96

Function 1005A02F Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 1005A042

Part of subcall function 1005C830: __FindPESection.LIBCMT ref: 1005C88B

__getptd_noexit.LIBCMT ref: 1005A052
__freeptd.LIBCMT ref: 1005A05C
ExitThread.KERNEL32 ref: 1005A065

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: 130b87610f953747d7b600629851b505d521a785ff2ae1d62af5aa09110a26ae
Instruction ID: 0c41d77596b456020636dc087564fe6366e214117bf09f83fc896c8b2ecbcdfe
Opcode Fuzzy Hash: 130b87610f953747d7b600629851b505d521a785ff2ae1d62af5aa09110a26ae
Instruction Fuzzy Hash: E7D0173442076A9AEB10A771CC09A2937DAEF0A394B405624F505890E1EFB0ECC8D9A0

Function 1003A3C0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 315COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1003A517

Strings

`, xrefs: 1003A459
(, xrefs: 1003A41A

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: _memset
String ID: ($`
API String ID: 2102423945-1967476404
Opcode ID: 9904988056d36e1ba59fc7c0ffb4820f2cd68e903ab0b14669b77e9bad955c16
Instruction ID: 2da91f8386d212c40438f94febd1fa4cc698ba8d6a8e9380ab819d739ad3b7e5
Opcode Fuzzy Hash: 9904988056d36e1ba59fc7c0ffb4820f2cd68e903ab0b14669b77e9bad955c16
Instruction Fuzzy Hash: E4C1A1B59087408FD325CF64C881B9BB3E9EFC9305F04492EF5898B251EB75E985CB92

Function 1000AC10 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

VP8GetInfo.LIBWEBP(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1000AE14
VP8LGetInfo.LIBWEBP(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1000AE4E

Strings

ALPH, xrefs: 1000AD6F

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: Info
String ID: ALPH
API String ID: 1807457897-3117416470
Opcode ID: 84d0fcb6eb2dea2ea8cde1ae898b265a4277d717c7971c325730b3277adad610
Instruction ID: 77b66d50b87e58df57ddd2e98b8341c957536e6777846b9176399e102d35009f
Opcode Fuzzy Hash: 84d0fcb6eb2dea2ea8cde1ae898b265a4277d717c7971c325730b3277adad610
Instruction Fuzzy Hash: 939107B66083858FE314CF58D88095FB7E5EBCA780F514E2EF59687214E730ED888B52

Function 1000AAF0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

VP8LCheckSignature.LIBWEBP(?,00000000,?,00000000,?,1000ADBE,?,?,?,?,?), ref: 1000AB90

Strings

VP8L, xrefs: 1000AB38
VP8 , xrefs: 1000AAFC

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: CheckSignature
String ID: VP8 $VP8L
API String ID: 572727604-4029249501
Opcode ID: 72f330742a467239ddc92276b6e5d424c04b3f0f82ec13160b8151fd185f398e
Instruction ID: 1d285487e508a45121b469d7176728d12c9325352dada906c6a30674989cca20
Opcode Fuzzy Hash: 72f330742a467239ddc92276b6e5d424c04b3f0f82ec13160b8151fd185f398e
Instruction Fuzzy Hash: 1431C8B29041A14FE70CDE7D84F4539BFD2DB432E1B0A43AEE5A74A19ACB289D809750

Function 1003E070 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

WebPSafeMalloc.LIBWEBP(?,?,00000004), ref: 1003E08E

Strings

gfff, xrefs: 1003E099

Memory Dump Source

Source File: 00000004.00000002.3393556939.0000000010001000.00000020.00000001.01000000.0000000C.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.3393538483.0000000010000000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393699115.0000000010067000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393736376.0000000010076000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000004.00000002.3393758203.0000000010079000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_FSCapture.jbxd

Similarity

API ID: MallocSafe
String ID: gfff
API String ID: 2976254555-1553575800
Opcode ID: fbf46ad3069121c69f437994dd78de115590da39bbd198971450c5a965793dcc
Instruction ID: 31b2692693949ebd8a8f342ec89fd1c5b3288246a4720ada9fdd023909be69ab
Opcode Fuzzy Hash: fbf46ad3069121c69f437994dd78de115590da39bbd198971450c5a965793dcc
Instruction Fuzzy Hash: 053135B660434A6FD314DA09EC8096BB798FBC9365F05062AF845CB381E331FD558BE2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FSCaptureSetup107.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\FastStone Capture\Credits.txt

C:\Program Files (x86)\FastStone Capture\Draw.db

C:\Program Files (x86)\FastStone Capture\FSCIcon.db

C:\Program Files (x86)\FastStone Capture\FSCPlugin01.dll

C:\Program Files (x86)\FastStone Capture\FSCPlugin02.dll

C:\Program Files (x86)\FastStone Capture\FSCPlugin03.dll

C:\Program Files (x86)\FastStone Capture\FSCPlugin04.dll

C:\Program Files (x86)\FastStone Capture\FSCPlugin05.dll

C:\Program Files (x86)\FastStone Capture\FSCPlugin06.exe

C:\Program Files (x86)\FastStone Capture\FSCPlugin07.exe

C:\Program Files (x86)\FastStone Capture\FSCapture.exe

C:\Program Files (x86)\FastStone Capture\FSCaptureHelp.chm

C:\Program Files (x86)\FastStone Capture\FSCrossHair.exe

C:\Program Files (x86)\FastStone Capture\FSFocus.exe

C:\Program Files (x86)\FastStone Capture\FSLogo.png

C:\Program Files (x86)\FastStone Capture\FSRecorder.exe

C:\Program Files (x86)\FastStone Capture\Languages\FSC02.fslang

C:\Program Files (x86)\FastStone Capture\Languages\FSC03.fslang

C:\Program Files (x86)\FastStone Capture\Languages\FSC05.fslang

C:\Program Files (x86)\FastStone Capture\Languages\FSC06.fslang

C:\Program Files (x86)\FastStone Capture\Languages\FSC07.fslang

Windows Analysis Report
FSCaptureSetup107.exe

Function 00403640 Relevance: 93.2, APIs: 34, Strings: 19, Instructions: 450
stringfilecomCOMMON

Function 00405809 Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 284
windowclipboardmemoryCOMMON

Function 00404AB5 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 275
stringCOMMON

Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON