Edit tour

Windows Analysis Report
uCLkYbZQoA.exe

Overview

General Information

Sample name:	uCLkYbZQoA.exe renamed because original name is a hash value
Original sample name:	36cba9f836266dd47c2629af72d7fa24.exe
Analysis ID:	1447638
MD5:	36cba9f836266dd47c2629af72d7fa24
SHA1:	277628e74f7f1dc7aa16412d5c476f62bab39e89
SHA256:	3ce9fcec1c68c11c4502acdd2c0f0e18c5b5593cb0dbe8ca2fd7ac42189617cc
Tags:	exe
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Contains functionality for read data from the clipboard

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential key logger detected (key state polling based)

Program does not show much activity (idle)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

uCLkYbZQoA.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\uCLkYbZQoA.exe" MD5: 36CBA9F836266DD47C2629AF72D7FA24)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://47.110.247.171/chdyz/chdyz.dll	Avira URL Cloud: Label: malware
Source: http://47.110.247.171/chdyz/chdyz.exe	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: http://47.110.247.171/chdyz/chdyz.7z.tmpSuper-EC	Virustotal: Detection: 9%	Perma Link
Source: http://47.110.247.171/chdyz/chdyz.7z	Virustotal: Detection: 11%	Perma Link
Source: http://47.110.247.171/login/verup.php	Virustotal: Detection: 9%	Perma Link
Source: http://47.110.247.171/login/login.php	Virustotal: Detection: 9%	Perma Link
Source: http://47.110.247.171/chdyz/chdyz.dll	Virustotal: Detection: 14%	Perma Link
Source: http://47.110.247.171/	Virustotal: Detection: 9%	Perma Link
Source: http://47.110.247.171/chdyz/chdyz.exe	Virustotal: Detection: 15%	Perma Link

Multi AV Scanner detection for submitted file

Source: uCLkYbZQoA.exe	ReversingLabs: Detection: 58%
Source: uCLkYbZQoA.exe	Virustotal: Detection: 65%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 77.5% probability

Machine Learning detection for sample

Source: uCLkYbZQoA.exe

Joe Sandbox ML: detected

Source: uCLkYbZQoA.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004234C0 FindNextFileA,FindClose,FindFirstFileA,FindClose,	0_2_004234C0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0042B8A0 FindFirstFileA,FindClose,	0_2_0042B8A0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004B60FD __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	0_2_004B60FD
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00419130 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,	0_2_00419130

Source: Joe Sandbox View

IP Address: 47.110.247.171 47.110.247.171

Source: global traffic	HTTP traffic detected: POST /login/verup.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html, application/xhtml+xml, /Accept-Encoding: gbk, GB2312Accept-Language: zh-cnUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)Content-Length: 26Host: 47.110.247.171
Source: global traffic	HTTP traffic detected: POST /login/login.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html, application/xhtml+xml, /Accept-Encoding: gbk, GB2312Accept-Language: zh-cnUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)Content-Length: 12Host: 47.110.247.171

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_00436A20 ioctlsocket,recvfrom,

0_2_00436A20

Source: unknown

HTTP traffic detected: POST /login/verup.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: text/html, application/xhtml+xml, */*Accept-Encoding: gbk, GB2312Accept-Language: zh-cnUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)Content-Length: 26Host: 47.110.247.171

Source: uCLkYbZQoA.exe, 00000000.00000003.1699111246.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.110.247.171/
Source: uCLkYbZQoA.exe	String found in binary or memory: http://47.110.247.171/chdyz/chdyz.7z
Source: uCLkYbZQoA.exe	String found in binary or memory: http://47.110.247.171/chdyz/chdyz.7z.tmpSuper-EC
Source: uCLkYbZQoA.exe	String found in binary or memory: http://47.110.247.171/chdyz/chdyz.dll
Source: uCLkYbZQoA.exe	String found in binary or memory: http://47.110.247.171/chdyz/chdyz.exe
Source: uCLkYbZQoA.exe	String found in binary or memory: http://47.110.247.171/login/login.php
Source: uCLkYbZQoA.exe, 00000000.00000003.1699111246.00000000005D3000.00000004.00000020.00020000.00000000.sdmp, uCLkYbZQoA.exe, 00000000.00000003.1699235413.00000000005D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.110.247.171/login/login.phpl_
Source: uCLkYbZQoA.exe	String found in binary or memory: http://47.110.247.171/login/verup.php
Source: uCLkYbZQoA.exe	String found in binary or memory: http://47.110.247.171/login/verup.php0-1
Source: uCLkYbZQoA.exe, 00000000.00000003.1699111246.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.110.247.171/wR
Source: uCLkYbZQoA.exe	String found in binary or memory: http://www.eyuyan.com)DVarFileInfo$
Source: uCLkYbZQoA.exe, 00000000.00000003.1699053207.0000000000600000.00000004.00000020.00020000.00000000.sdmp, uCLkYbZQoA.exe, 00000000.00000003.2300427638.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, uCLkYbZQoA.exe, 00000000.00000003.1699280374.0000000000601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pan.baidu.com/s/1D28osmCWE-A_Oote3X5wsg?pwd=985d

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_0043FAE0 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0043FAE0

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_0043FAE0 GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0043FAE0

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_0043FC40 OpenClipboard,GetClipboardData,CloseClipboard,GlobalSize,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0043FC40

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_004782B0 GetWindowRect,GetWindowDC,CreateCompatibleDC,SetBkMode,CreateCompatibleBitmap,SelectObject,BitBlt,

0_2_004782B0

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004BA7D4 GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_004BA7D4
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0042BA50 GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_0042BA50

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00421760	0_2_00421760
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004B7F51	0_2_004B7F51
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045E149	0_2_0045E149
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0042C110	0_2_0042C110
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00452120	0_2_00452120
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004481C0	0_2_004481C0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045024D	0_2_0045024D
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0044A2C0	0_2_0044A2C0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00460290	0_2_00460290
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045E606	0_2_0045E606
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0043A740	0_2_0043A740
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045A780	0_2_0045A780
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004507B2	0_2_004507B2
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0046E8E0	0_2_0046E8E0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045E8F1	0_2_0045E8F1
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0046A9D0	0_2_0046A9D0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00470A30	0_2_00470A30
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045EAA4	0_2_0045EAA4
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0046CBF0	0_2_0046CBF0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045ACC0	0_2_0045ACC0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00464D4E	0_2_00464D4E
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00450D10	0_2_00450D10
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045ED1E	0_2_0045ED1E
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00456DB0	0_2_00456DB0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0046EE60	0_2_0046EE60
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00424FC0	0_2_00424FC0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00464F9E	0_2_00464F9E
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004570C0	0_2_004570C0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045F150	0_2_0045F150
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004AD276	0_2_004AD276
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045D3F0	0_2_0045D3F0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0046B470	0_2_0046B470
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004574F0	0_2_004574F0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045F620	0_2_0045F620
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004B163D	0_2_004B163D
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0044D7F0	0_2_0044D7F0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045F850	0_2_0045F850
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00423AD0	0_2_00423AD0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0044DB20	0_2_0044DB20
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045DC30	0_2_0045DC30
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0045BF70	0_2_0045BF70
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0042DF30	0_2_0042DF30

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: String function: 004567F0 appears 73 times
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: String function: 00456570 appears 37 times
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: String function: 004563E0 appears 73 times
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: String function: 004A7C38 appears 70 times
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: String function: 004B7011 appears 44 times

Source: uCLkYbZQoA.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_00470ED0 CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification,

0_2_00470ED0

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_0040F400 LoadTypeLib,GetUserDefaultLCID,LHashValOfNameSys,RegisterTypeLib,CoCreateInstance,CoCreateInstance,CoCreateInstance,OleRun,CoCreateInstance,CoCreateInstance,

0_2_0040F400

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_004B6785 __EH_prolog,FindResourceA,LoadResource,LockResource,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow,

0_2_004B6785

Source: uCLkYbZQoA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: uCLkYbZQoA.exe	ReversingLabs: Detection: 58%
Source: uCLkYbZQoA.exe	Virustotal: Detection: 65%

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F4DACA4-160D-11D2-A8E9-00104B365C9F}\InprocServer32

Jump to behavior

Source: uCLkYbZQoA.exe

Static file information: File size 1056768 > 1048576

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_00422D50 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,

0_2_00422D50

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004A5030 push eax; ret		0_2_004A505E
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004A7C38 push eax; ret		0_2_004A7C56

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00421760 IsWindow,IsIconic,SetActiveWindow,IsWindow,IsWindow,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,DestroyAcceleratorTable,DestroyMenu,KiUserCallbackDispatcher,SetWindowPos,IsWindow,SendMessageA,SendMessageA,DestroyAcceleratorTable,IsWindow,IsWindow,IsWindow,IsWindow,IsWindow,GetParent,GetFocus,IsWindow,SendMessageA,IsWindow,GetFocus,SetFocus,	0_2_00421760
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00426B30 DestroyIcon,IsWindowVisible,IsIconic,IsZoomed,GetWindowRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMenu,DeleteMenu,GetSystemMenu,	0_2_00426B30
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0042AF20 IsIconic,IsZoomed,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,SystemParametersInfoA,IsWindow,ShowWindow,	0_2_0042AF20
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004A356F MonitorFromWindow,IsIconic,GetWindowPlacement,GetWindowRect,	0_2_004A356F

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

API coverage: 8.7 %

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe TID: 7292

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004234C0 FindNextFileA,FindClose,FindFirstFileA,FindClose,	0_2_004234C0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_0042B8A0 FindFirstFileA,FindClose,	0_2_0042B8A0
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_004B60FD __EH_prolog,GetFullPathNameA,lstrcpynA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	0_2_004B60FD
Source: C:\Users\user\Desktop\uCLkYbZQoA.exe	Code function: 0_2_00419130 FindFirstFileA,SendMessageA,SendMessageA,FindNextFileA,FindClose,SendMessageA,	0_2_00419130

Source: uCLkYbZQoA.exe, 00000000.00000002.2893370678.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWph^%SystemRoot%\system32\mswsock.dllkt
Source: uCLkYbZQoA.exe, 00000000.00000003.1699235413.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, uCLkYbZQoA.exe, 00000000.00000003.2300396487.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, uCLkYbZQoA.exe, 00000000.00000002.2893579159.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, uCLkYbZQoA.exe, 00000000.00000003.2300427638.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_00422D50 GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,FreeLibrary,FreeLibrary,

0_2_00422D50

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_00449020 GetProcessHeap,OleInitialize,GetModuleFileNameA,SetCurrentDirectoryA,LoadCursorA,GetStockObject,GetCurrentThreadId,

0_2_00449020

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_004A65E0 GetLocalTime,GetSystemTime,GetTimeZoneInformation,

0_2_004A65E0

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_004B005F GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_004B005F

Source: C:\Users\user\Desktop\uCLkYbZQoA.exe

Code function: 0_2_004B7F51 __EH_prolog,GetVersion,

0_2_004B7F51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	1 Input Capture	2 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	3 Clipboard Data	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
uCLkYbZQoA.exe	58%	ReversingLabs	Win32.Trojan.Zusy
uCLkYbZQoA.exe	65%	Virustotal		Browse
uCLkYbZQoA.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://pan.baidu.com/s/1D28osmCWE-A_Oote3X5wsg?pwd=985d	0%	Avira URL Cloud	safe
http://47.110.247.171/login/login.phpl_	0%	Avira URL Cloud	safe
http://47.110.247.171/chdyz/chdyz.7z.tmpSuper-EC	0%	Avira URL Cloud	safe
http://47.110.247.171/login/login.php	0%	Avira URL Cloud	safe
http://www.eyuyan.com)DVarFileInfo$	0%	Avira URL Cloud	safe
http://47.110.247.171/chdyz/chdyz.7z	0%	Avira URL Cloud	safe
http://47.110.247.171/login/verup.php0-1	0%	Avira URL Cloud	safe
http://47.110.247.171/wR	0%	Avira URL Cloud	safe
https://pan.baidu.com/s/1D28osmCWE-A_Oote3X5wsg?pwd=985d	0%	Virustotal		Browse
http://47.110.247.171/chdyz/chdyz.7z.tmpSuper-EC	10%	Virustotal		Browse
http://47.110.247.171/login/verup.php	0%	Avira URL Cloud	safe
http://47.110.247.171/chdyz/chdyz.7z	12%	Virustotal		Browse
http://47.110.247.171/login/verup.php0-1	3%	Virustotal		Browse
http://47.110.247.171/login/verup.php	10%	Virustotal		Browse
http://47.110.247.171/chdyz/chdyz.dll	100%	Avira URL Cloud	malware
http://47.110.247.171/	0%	Avira URL Cloud	safe
http://47.110.247.171/chdyz/chdyz.exe	100%	Avira URL Cloud	malware
http://47.110.247.171/login/login.php	10%	Virustotal		Browse
http://47.110.247.171/chdyz/chdyz.dll	15%	Virustotal		Browse
http://47.110.247.171/	10%	Virustotal		Browse
http://47.110.247.171/chdyz/chdyz.exe	16%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://47.110.247.171/login/login.php	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://47.110.247.171/login/verup.php	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.eyuyan.com)DVarFileInfo$	uCLkYbZQoA.exe	false	Avira URL Cloud: safe	unknown
https://pan.baidu.com/s/1D28osmCWE-A_Oote3X5wsg?pwd=985d	uCLkYbZQoA.exe, 00000000.00000003.1699053207.0000000000600000.00000004.00000020.00020000.00000000.sdmp, uCLkYbZQoA.exe, 00000000.00000003.2300427638.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, uCLkYbZQoA.exe, 00000000.00000003.1699280374.0000000000601000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://47.110.247.171/chdyz/chdyz.7z.tmpSuper-EC	uCLkYbZQoA.exe	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://47.110.247.171/login/login.phpl_	uCLkYbZQoA.exe, 00000000.00000003.1699111246.00000000005D3000.00000004.00000020.00020000.00000000.sdmp, uCLkYbZQoA.exe, 00000000.00000003.1699235413.00000000005D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://47.110.247.171/login/verup.php0-1	uCLkYbZQoA.exe	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://47.110.247.171/chdyz/chdyz.7z	uCLkYbZQoA.exe	false	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://47.110.247.171/wR	uCLkYbZQoA.exe, 00000000.00000003.1699111246.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://47.110.247.171/chdyz/chdyz.dll	uCLkYbZQoA.exe	false	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://47.110.247.171/	uCLkYbZQoA.exe, 00000000.00000003.1699111246.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://47.110.247.171/chdyz/chdyz.exe	uCLkYbZQoA.exe	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
47.110.247.171	unknown	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447638
Start date and time:	2024-05-26 08:39:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uCLkYbZQoA.exe renamed because original name is a hash value
Original Sample Name:	36cba9f836266dd47c2629af72d7fa24.exe
Detection:	MAL
Classification:	mal72.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 62 Number of non-executed functions: 249
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.31.169.57
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, iris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.com, ctldl.windowsupdate.com, arc.trafficmanager.net, 6.d.a.8.b.e.f.b.0.0.0.0.0.0.0.0.4.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, arc.msn.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
02:39:59	API Interceptor	2x Sleep call for process: uCLkYbZQoA.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
47.110.247.171	WIxlt6C9uz.exe	Get hash	malicious	Unknown	Browse	47.110.247.171/login/login.php
	WIxlt6C9uz.exe	Get hash	malicious	Unknown	Browse	47.110.247.171/login/login.php
	SecuriteInfo.com.Win32.MalwareX-gen.16608.3922.dll	Get hash	malicious	Unknown	Browse	47.110.247.171/login/t.php
	SecuriteInfo.com.Win32.MalwareX-gen.16608.3922.dll	Get hash	malicious	Unknown	Browse	47.110.247.171/login/t.php
	XSpitaNHqG.exe	Get hash	malicious	Unknown	Browse	47.110.247.171/login/login.php
	t3CNhrFqlK.dll	Get hash	malicious	Unknown	Browse	47.110.247.171/login/t.php
	XSpitaNHqG.exe	Get hash	malicious	Unknown	Browse	47.110.247.171/login/login.php
	t3CNhrFqlK.dll	Get hash	malicious	Unknown	Browse	47.110.247.171/login/t.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	BEddZjSb7A.elf	Get hash	malicious	Unknown	Browse	47.108.217.163
	hgVOQGUGqk.elf	Get hash	malicious	Unknown	Browse	8.185.61.106
	QN5PrDr5St.elf	Get hash	malicious	Unknown	Browse	106.14.214.192
	M2Vf6ASl3g.elf	Get hash	malicious	Unknown	Browse	114.215.215.188
	msjYmnMpqK.exe	Get hash	malicious	Unknown	Browse	47.104.173.216
	msjYmnMpqK.exe	Get hash	malicious	Unknown	Browse	47.104.173.216
	VWOm7n5MsV.elf	Get hash	malicious	Unknown	Browse	8.184.34.215
	hs1vfUvu3u.elf	Get hash	malicious	Mirai	Browse	223.7.237.162
	venom.exe	Get hash	malicious	Metasploit	Browse	47.120.44.103
	http://toenpocket.pro/	Get hash	malicious	HTMLPhisher	Browse	203.107.62.140

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.425515175081969
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	uCLkYbZQoA.exe
File size:	1'056'768 bytes
MD5:	36cba9f836266dd47c2629af72d7fa24
SHA1:	277628e74f7f1dc7aa16412d5c476f62bab39e89
SHA256:	3ce9fcec1c68c11c4502acdd2c0f0e18c5b5593cb0dbe8ca2fd7ac42189617cc
SHA512:	02801256dd4341ee4f8ec46a363ad5271bab9db110253a1ac79dc1612b860703ab669e03b653f9f935d56c19b7c35eaa3d118e52f17ebfbdc10e115040a6b776
SSDEEP:	24576:F0MgCdHTUzZJdlevZPamfhE/Um7D1fUggepjfJ+gaELmecS:F0MgCdHTkJAUmfhtIaEJB
TLSH:	1425AF01B68282F5E64A197004F66737EB3A96870B12CFD7E7A4DD385C33691E13B25E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M._.M._.M._.R._.M._.R._.M._3Q._.M._.Q._.M._.R._.M._.R._.M._.M._.O._3E._.M._.k._nM._.k._.M._XR._.M._XR._.M._.M._.M._wK._.M.

File Icon


Icon Hash:	043b697071334422

Static PE Info

General

Entrypoint:	0x4a3970
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x665212BC [Sat May 25 16:33:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	de6a340ccaab4aa62f1436825c99450b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 004D5548h
push 004A69F4h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [004C51A0h]
xor edx, edx
mov dl, ah
mov dword ptr [00533E14h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [00533E10h], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [00533E0Ch], ecx
shr eax, 10h
mov dword ptr [00533E08h], eax
push 00000001h
call 00007F729D30592Fh
pop ecx
test eax, eax
jne 00007F729D3001DAh
push 0000001Ch
call 00007F729D300298h
pop ecx
call 00007F729D30563Ah
test eax, eax
jne 00007F729D3001DAh
push 00000010h
call 00007F729D300287h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007F729D305468h
call dword ptr [004C5364h]
mov dword ptr [00539064h], eax
call 00007F729D305326h
mov dword ptr [00533D80h], eax
call 00007F729D3050CFh
call 00007F729D305011h
call 00007F729D303676h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [004C51E8h]
call 00007F729D304FA2h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F729D3001D8h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168
[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdded8	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x13a000	0x61bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc5000	0x7b4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc3ee2	0xc4000	e6514cb2f624df5f913e520897e6c164	False	0.5231883769132653	data	6.578377247668283	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc5000	0x1b552	0x1c000	91aac68872a5e18200263327d9bf6034	False	0.3055943080357143	data	4.641371332156871	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe1000	0x5806a	0x1a000	848ca09a905e3ac9849f53de0979ca13	False	0.326904296875	data	5.367706592968136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x13a000	0x61bc	0x7000	ba0877a18db5765095f0668697aa3e05	False	0.26810128348214285	data	5.164274086382286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TEXTINCLUDE	0x13abf4	0xb	ASCII text, with no line terminators	Chinese	China	1.7272727272727273
TEXTINCLUDE	0x13ac00	0x16	data	Chinese	China	1.3636363636363635
TEXTINCLUDE	0x13ac18	0x151	C source, ASCII text, with CRLF line terminators	Chinese	China	0.6201780415430267
RT_CURSOR	0x13ad6c	0x134	data	Chinese	China	0.5811688311688312
RT_CURSOR	0x13aea0	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x13afd4	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x13b108	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_BITMAP	0x13b1bc	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	Chinese	China	0.3598901098901099
RT_BITMAP	0x13b328	0x248	Device independent bitmap graphic, 64 x 15 x 4, image size 480	Chinese	China	0.3407534246575342
RT_BITMAP	0x13b570	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.4444444444444444
RT_BITMAP	0x13b6b4	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.26453488372093026
RT_BITMAP	0x13b80c	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2616279069767442
RT_BITMAP	0x13b964	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2441860465116279
RT_BITMAP	0x13babc	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.24709302325581395
RT_BITMAP	0x13bc14	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2238372093023256
RT_BITMAP	0x13bd6c	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.19476744186046513
RT_BITMAP	0x13bec4	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.20930232558139536
RT_BITMAP	0x13c01c	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.18895348837209303
RT_BITMAP	0x13c174	0x5e4	Device independent bitmap graphic, 70 x 39 x 4, image size 1404	Chinese	China	0.34615384615384615
RT_BITMAP	0x13c758	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x13c810	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	Chinese	China	0.28296703296703296
RT_BITMAP	0x13c97c	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x13cac0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.26344086021505375
RT_ICON	0x13cda8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.41216216216216217
RT_ICON	0x13ced0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.18738273921200752
RT_MENU	0x13df78	0xc	data	Chinese	China	1.5
RT_MENU	0x13df84	0x284	data	Chinese	China	0.5
RT_DIALOG	0x13e208	0x98	data	Chinese	China	0.7171052631578947
RT_DIALOG	0x13e2a0	0x17a	data	Chinese	China	0.5185185185185185
RT_DIALOG	0x13e41c	0xfa	data	Chinese	China	0.696
RT_DIALOG	0x13e518	0xea	data	Chinese	China	0.6239316239316239
RT_DIALOG	0x13e604	0x8ae	data	Chinese	China	0.39603960396039606
RT_DIALOG	0x13eeb4	0xb2	data	Chinese	China	0.7359550561797753
RT_DIALOG	0x13ef68	0xcc	data	Chinese	China	0.7647058823529411
RT_DIALOG	0x13f034	0xb2	data	Chinese	China	0.6629213483146067
RT_DIALOG	0x13f0e8	0xe2	data	Chinese	China	0.6637168141592921
RT_DIALOG	0x13f1cc	0x18c	data	Chinese	China	0.5227272727272727
RT_STRING	0x13f358	0x50	data	Chinese	China	0.85
RT_STRING	0x13f3a8	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x13f3d4	0x78	data	Chinese	China	0.925
RT_STRING	0x13f44c	0x1c4	data	Chinese	China	0.8141592920353983
RT_STRING	0x13f610	0x12a	data	Chinese	China	0.5201342281879194
RT_STRING	0x13f73c	0x146	data	Chinese	China	0.6288343558282209
RT_STRING	0x13f884	0x40	data	Chinese	China	0.65625
RT_STRING	0x13f8c4	0x64	data	Chinese	China	0.73
RT_STRING	0x13f928	0x1d8	data	Chinese	China	0.6758474576271186
RT_STRING	0x13fb00	0x114	data	Chinese	China	0.6376811594202898
RT_STRING	0x13fc14	0x24	data	Chinese	China	0.4444444444444444
RT_GROUP_CURSOR	0x13fc38	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x13fc4c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x13fc60	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_ICON	0x13fc84	0x14	data			1.2
RT_GROUP_ICON	0x13fc98	0x14	data	Chinese	China	1.2
RT_GROUP_ICON	0x13fcac	0x14	data	Chinese	China	1.25
RT_VERSION	0x13fcc0	0x240	data	Chinese	China	0.5642361111111112
RT_MANIFEST	0x13ff00	0x2b9	XML 1.0 document, ASCII text, with very long lines (697), with no line terminators			0.5279770444763271

Imports

DLL	Import
WINMM.dll	midiStreamOut, midiOutPrepareHeader, waveOutWrite, waveOutPause, waveOutReset, waveOutClose, waveOutGetNumDevs, waveOutOpen, midiOutUnprepareHeader, midiStreamOpen, midiStreamProperty, midiStreamStop, midiOutReset, midiStreamClose, midiStreamRestart, waveOutUnprepareHeader, waveOutRestart, waveOutPrepareHeader
WS2_32.dll	socket, bind, htons, WSAAsyncSelect, closesocket, send, WSACleanup, WSAStartup, gethostbyname, inet_ntoa, inet_addr, gethostname, ntohl, recvfrom, ioctlsocket, connect, recv, listen, getpeername, accept, getsockname, __WSAFDIsSet, select, ntohs, WSAGetLastError
KERNEL32.dll	SetLastError, GetTimeZoneInformation, GetVersion, TerminateThread, lstrcmpiA, MapViewOfFile, CreateFileMappingA, UnmapViewOfFile, FormatMessageA, CreateMutexA, ReleaseMutex, SuspendThread, UnhandledExceptionFilter, GetACP, HeapSize, ExitThread, RaiseException, GetLocalTime, GetSystemTime, RtlUnwind, GetStartupInfoA, GetOEMCP, GetCPInfo, GetProcessVersion, SetErrorMode, GlobalFlags, GetCurrentThread, GetFileTime, TlsGetValue, LocalReAlloc, TlsSetValue, TlsFree, GlobalHandle, TlsAlloc, LocalAlloc, lstrcmpA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, DuplicateHandle, lstrcpynA, FileTimeToLocalFileTime, FileTimeToSystemTime, InterlockedDecrement, InterlockedIncrement, TerminateProcess, GetCurrentProcess, GetFileSize, SetFilePointer, CreateToolhelp32Snapshot, Process32First, Process32Next, CreateSemaphoreA, ResumeThread, ReleaseSemaphore, EnterCriticalSection, LeaveCriticalSection, GetProfileStringA, WriteFile, WaitForMultipleObjects, CreateFileA, SetEvent, FindResourceA, LoadResource, LockResource, ReadFile, lstrlenW, GetModuleFileNameA, WideCharToMultiByte, MultiByteToWideChar, GetCurrentThreadId, ExitProcess, GlobalSize, GlobalFree, DeleteCriticalSection, InitializeCriticalSection, lstrcatA, lstrlenA, WinExec, lstrcpyA, FindNextFileA, GlobalReAlloc, HeapFree, InterlockedExchange, HeapReAlloc, GetProcessHeap, HeapAlloc, GetUserDefaultLCID, GetFullPathNameA, FreeLibrary, LoadLibraryA, GetLastError, GetVersionExA, WritePrivateProfileStringA, GetPrivateProfileStringA, CreateThread, CreateEventA, Sleep, GlobalAlloc, GlobalLock, GlobalUnlock, FindFirstFileA, FindClose, GetFileAttributesA, DeleteFileA, SetCurrentDirectoryA, GetVolumeInformationA, GetModuleHandleA, GetProcAddress, MulDiv, GetCommandLineA, GetTickCount, CreateProcessA, WaitForSingleObject, CloseHandle, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, SetEnvironmentVariableA, LCMapStringA, LCMapStringW, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, CompareStringA, CompareStringW, IsBadReadPtr, IsBadCodePtr, SetStdHandle, LocalFree
USER32.dll	PostQuitMessage, IsZoomed, GetClassInfoA, DefWindowProcA, GetSystemMenu, DeleteMenu, GetMenu, SetMenu, PeekMessageA, IsIconic, SetFocus, GetActiveWindow, GetWindow, DestroyAcceleratorTable, CopyAcceleratorTableA, GetKeyState, TranslateAcceleratorA, IsWindowEnabled, ShowWindow, SystemParametersInfoA, LoadImageA, LoadStringA, GetMenuCheckMarkDimensions, GetMenuState, SetMenuItemBitmaps, CheckMenuItem, MoveWindow, ModifyMenuA, AppendMenuA, CreatePopupMenu, DrawIconEx, CreateIconFromResource, CreateIconFromResourceEx, RegisterClipboardFormatA, SetRectEmpty, DispatchMessageA, WindowFromPoint, DrawFocusRect, DrawEdge, DrawFrameControl, TranslateMessage, LoadIconA, UnregisterClassA, GetDesktopWindow, SetWindowRgn, GetMessagePos, ScreenToClient, ChildWindowFromPointEx, CopyRect, LoadBitmapA, WinHelpA, KillTimer, SetTimer, ReleaseCapture, GetCapture, SetCapture, GetScrollRange, SetScrollRange, SetScrollPos, SetRect, InflateRect, IntersectRect, SetWindowTextA, IsDialogMessageA, EnumDisplaySettingsA, DestroyIcon, PtInRect, OffsetRect, IsWindowVisible, EnableWindow, RedrawWindow, GetWindowLongA, SetWindowLongA, GetSysColor, SetActiveWindow, SetCursorPos, LoadCursorA, SetCursor, GetDC, FillRect, IsRectEmpty, ReleaseDC, IsChild, DestroyMenu, SetForegroundWindow, GetWindowRect, EqualRect, UpdateWindow, ValidateRect, InvalidateRect, GetClientRect, GetFocus, GetParent, GetTopWindow, PostMessageA, IsWindow, SetParent, DestroyCursor, SendMessageA, SetWindowPos, MessageBoxA, GetCursorPos, GetSystemMetrics, EmptyClipboard, SetClipboardData, OpenClipboard, GetClipboardData, CloseClipboard, wsprintfA, WaitForInputIdle, ClientToScreen, GetClassNameA, GetDlgItem, GetWindowTextA, DrawTextA, SetWindowsHookExA, UnhookWindowsHookEx, EnumThreadWindows, GetWindowTextLengthA, EnumChildWindows, CallNextHookEx, CallWindowProcA, GetWindowDC, GetSysColorBrush, FrameRect, EnableMenuItem, GetSubMenu, GetDlgCtrlID, CreateAcceleratorTableA, ScrollWindowEx, CreateMenu, GetMessageA, CharUpperA, BeginPaint, EndPaint, TabbedTextOutA, GrayStringA, DestroyWindow, CreateDialogIndirectParamA, EndDialog, GetNextDlgTabItem, GetWindowPlacement, RegisterWindowMessageA, GetForegroundWindow, GetLastActivePopup, GetMessageTime, RemovePropA, GetPropA, SetPropA, GetClassLongA, CreateWindowExA, GetMenuItemID, GetMenuItemCount, RegisterClassA, GetScrollPos, AdjustWindowRectEx, MapWindowPoints, SendDlgItemMessageA
GDI32.dll	ExtSelectClipRgn, ExcludeClipRect, GetClipBox, ScaleWindowExtEx, SetWindowExtEx, SetWindowOrgEx, ScaleViewportExtEx, Ellipse, Rectangle, LPtoDP, DPtoLP, GetCurrentObject, RoundRect, Arc, GetTextExtentPoint32A, GetDeviceCaps, BeginPath, GetWindowOrgEx, GetWindowExtEx, GetDIBits, RealizePalette, SelectPalette, StretchBlt, CreatePalette, GetSystemPaletteEntries, CreateDIBitmap, DeleteObject, SelectClipRgn, CreatePolygonRgn, GetClipRgn, SetStretchBltMode, SetPixel, CreateRectRgnIndirect, SetBkColor, SetBkMode, LineTo, MoveToEx, SetTextColor, CreateEllipticRgnIndirect, GetTextMetricsA, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SetROP2, SetPolyFillMode, RestoreDC, SaveDC, GetViewportExtEx, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, CreateCompatibleDC, GetPixel, BitBlt, StartPage, StartDocA, DeleteDC, EndDoc, EndPage, GetObjectA, GetStockObject, CreateFontIndirectA, CreateSolidBrush, FillRgn, CreateRectRgn, CombineRgn, PatBlt, CreatePen, SelectObject, CreateBitmap, CreateDCA, CreateCompatibleBitmap, GetPolyFillMode, GetStretchBltMode, GetROP2, GetBkColor, EndPath, GetTextColor, CreateRoundRectRgn, CreateEllipticRgn, GetViewportOrgEx, GetBkMode, PathToRegion
MSIMG32.dll	GradientFill
WINSPOOL.DRV	OpenPrinterA, DocumentPropertiesA, ClosePrinter
ADVAPI32.dll	RegOpenKeyExA, RegSetValueExA, RegQueryValueA, RegCreateKeyExA, RegCloseKey
SHELL32.dll	Shell_NotifyIconA, ShellExecuteA
ole32.dll	CLSIDFromProgID, OleRun, CoCreateInstance, CLSIDFromString, OleUninitialize, OleInitialize
OLEAUT32.dll	UnRegisterTypeLib, LoadTypeLib, LHashValOfNameSys, RegisterTypeLib, SafeArrayPutElement, SafeArrayCreate, SafeArrayDestroy, SysAllocString, VariantInit, VariantCopyInd, SafeArrayGetElement, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayGetDim, SafeArrayGetLBound, SafeArrayGetUBound, VariantChangeType, VariantClear, VariantCopy
COMCTL32.dll	ImageList_GetIcon, ImageList_GetImageCount, ImageList_SetBkColor, _TrackMouseEvent, ImageList_Destroy, ImageList_Read, ImageList_Duplicate
comdlg32.dll	ChooseColorA, GetFileTitleA, GetSaveFileNameA, GetOpenFileNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 26, 2024 08:39:55.654582024 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:39:55.659555912 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:39:55.659648895 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:39:55.659770966 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:39:55.659806013 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:39:55.701304913 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:39:55.701319933 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:00.639497995 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:00.695543051 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:40:01.182554007 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:40:01.182554960 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:40:01.190354109 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:01.196198940 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:01.993457079 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:01.995601892 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:01.995800018 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:40:02.000853062 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.054856062 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:40:02.241645098 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.243351936 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.243464947 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:40:02.248493910 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.251183033 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.251250029 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:40:02.255156040 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.304968119 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:40:02.496406078 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.498560905 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.498801947 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:40:02.503348112 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.503364086 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:40:02.503424883 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:41:02.630690098 CEST	49732	80	192.168.2.4	47.110.247.171
May 26, 2024 08:41:02.636858940 CEST	80	49732	47.110.247.171	192.168.2.4
May 26, 2024 08:41:02.636998892 CEST	49732	80	192.168.2.4	47.110.247.171

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 26, 2024 08:40:44.938066959 CEST	53	54219	162.159.36.2	192.168.2.4
May 26, 2024 08:40:45.536604881 CEST	53	58325	1.1.1.1	192.168.2.4

HTTP Request Dependency Graph

47.110.247.171

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	47.110.247.171	80	7268	C:\Users\user\Desktop\uCLkYbZQoA.exe

Timestamp	Bytes transferred	Direction	Data
May 26, 2024 08:39:55.659770966 CEST	359	OUT	POST /login/verup.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: text/html, application/xhtml+xml, / Accept-Encoding: gbk, GB2312 Accept-Language: zh-cn User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Content-Length: 26 Host: 47.110.247.171
May 26, 2024 08:39:55.659806013 CEST	26	OUT	Data Raw: 26 74 79 70 65 3d 67 65 74 75 70 26 76 65 72 3d 32 30 32 34 30 35 32 36 30 31 Data Ascii: &type=getup&ver=2024052601
May 26, 2024 08:40:00.639497995 CEST	373	IN	HTTP/1.1 200 OK Server: nginx/1.15.11 Date: Sun, 26 May 2024 06:40:00 GMT Content-Type: text/html;charset=utf8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.4 Set-Cookie: PHPSESSID=a2gmqfsfo4oeec85s471qq5a7j; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Data Raw: 31 0d 0a 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 110
May 26, 2024 08:40:01.182554007 CEST	359	OUT	POST /login/login.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: text/html, application/xhtml+xml, / Accept-Encoding: gbk, GB2312 Accept-Language: zh-cn User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Content-Length: 12 Host: 47.110.247.171
May 26, 2024 08:40:01.182554960 CEST	12	OUT	Data Raw: 26 74 79 70 65 3d 4e 6f 74 69 63 65 Data Ascii: &type=Notice
May 26, 2024 08:40:01.993457079 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.15.11 Date: Sun, 26 May 2024 06:40:01 GMT Content-Type: text/html;charset=utf8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.3.4 Set-Cookie: PHPSESSID=e84fv8985osm9slv4kd88rfh8m; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Data Raw: 31 66 30 66 0d 0a 20 e4 bd 9c e8 80 85 51 51 ef bc 9a 37 31 35 31 32 33 35 37 31 20 20 20 20 63 68 64 79 7a e2 91 a0 e7 be a4 ef bc 9a 33 30 36 35 36 31 36 34 32 0d 0a 20 e8 be 85 e5 8a a9 e4 b8 8b e8 bd bd e5 9c b0 e5 9d 80 3a 68 74 74 70 73 3a 2f 2f 70 61 6e 2e 62 61 69 64 75 2e 63 6f 6d 2f 73 2f 31 44 32 38 6f 73 6d 43 57 45 2d 41 5f 4f 6f 74 65 33 58 35 77 73 67 3f 70 77 64 3d 39 38 35 64 20 e6 8f 90 e5 8f 96 e7 a0 81 3a 20 39 38 35 64 20 0d 0a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a 20 32 30 32 34 e5 b9 b4 35 e6 9c 88 32 36 e6 97 a5 0d 0a 20 0d 0a 20 63 68 64 79 7a 20 76 32 2e 31 35 2e 30 0d 0a 0d 0a 20 31 2e e6 96 b0 e5 a2 9e e8 bf 9e e7 bb ad e6 8c 87 e4 bb a4 e5 8a 9f e8 83 bd 28 e9 87 8c e9 9d a2 e6 9c 89 e6 89 93 e5 bc 80 4e 50 43 e7 9a 84 e6 8c 87 e4 bb a4 [TRUNCATED] Data Ascii: 1f0f QQ715123571 chdyz306561642 :https://pan.baidu.com/s/1D28osmCWE-A_Oote3X5wsg?pwd=985d : 985d ----------------------------------------------------------------------------------------- 2024526 chdyz v2.15.0 1.(NPC) ----------------------------------------------------------------------------------------- 2024524 chdyz v2.14.42 1.-> 2. ----------------------------------------------------------------------------------------- 2024523 chdyz v2.14.41 1. 2.1
May 26, 2024 08:40:01.995601892 CEST	1236	IN	Data Raw: 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d Data Ascii: ----------------------------------------------------------------------------------------- 2024522 chdyz v2.14.40 1. 2. -------------
May 26, 2024 08:40:02.000853062 CEST	448	IN	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a 20 32 30 32 34 e5 b9 b4 31 e6 9c 88 33 30 e6 97 a5 0d 0a 20 0d 0a 20 63 68 64 79 7a 20 76 32 2e 31 34 2e 33 35 0d 0a 0d 0a 20 31 2e e4 bf ae e5 a4 8d e6 8d a1 e7 89 Data Ascii: ------------------------- 2024130 chdyz v2.14.35 1. 2.V6V7 3.
May 26, 2024 08:40:02.241645098 CEST	1236	IN	Data Raw: bb a4 e9 a2 84 e8 a7 88 e4 b8 80 e7 9b b4 e5 88 b7 e5 b1 8f e7 9a 84 e9 97 ae e9 a2 98 0d 0a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d Data Ascii: ----------------------------------------------------------------------------------------- 2023119 chdyz v2.14.33 1. -------------------------------------
May 26, 2024 08:40:02.243351936 CEST	1236	IN	Data Raw: 8b e7 bb a7 e7 bb ad e5 88 a4 e6 96 ad ef bc 8c e8 a7 92 e8 89 b2 e4 b8 ba e7 ab 99 e7 ab 8b e6 88 96 e8 80 85 e5 80 92 e5 9c b0 e6 89 8d e4 bc 9a e5 88 a4 e6 96 ad e4 b8 ba e6 ad bb e4 ba a1 0d 0a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d Data Ascii: ----------------------------------------------------------------------------------------- 20231024 chdyz v2.14.27 1.Y
May 26, 2024 08:40:02.248493910 CEST	1236	IN	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a 20 32 30 32 33 e5 b9 b4 31 30 e6 9c 88 32 30 e6 97 a5 0d 0a Data Ascii: ------------------------------------------------------------ 20231020 chdyz v2.14.22 1.-> --------------------------------------
May 26, 2024 08:40:02.251183033 CEST	1236	IN	Data Raw: e6 9c 88 31 35 e6 97 a5 0d 0a 20 0d 0a 20 63 68 64 79 7a 20 76 32 2e 31 34 2e 31 38 0d 0a 0d 0a 20 31 2e e4 bf ae e5 a4 8d e6 92 9e e5 a2 99 e4 b8 8d e5 9b 9e e5 a4 b4 e7 9a 84 e9 97 ae e9 a2 98 0d 0a 0d 0a 20 32 2e e4 bf ae e5 a4 8d e8 84 9a e6 Data Ascii: 15 chdyz v2.14.18 1. 2. 3. 4.2
May 26, 2024 08:40:02.255156040 CEST	896	IN	Data Raw: 32 30 32 33 e5 b9 b4 31 30 e6 9c 88 31 30 e6 97 a5 0d 0a 20 0d 0a 20 63 68 64 79 7a 20 76 32 2e 31 34 2e 31 33 0d 0a 0d 0a 20 31 2e e6 97 a0 e8 a7 86 e8 ba ab e5 90 8e e6 80 aa e7 89 a9 e7 9a 84 e8 af 86 e5 88 ab e8 8c 83 e5 9b b4 e4 bb 8e e6 94 Data Ascii: 20231010 chdyz v2.14.13 1. 2. 3.
May 26, 2024 08:40:02.496406078 CEST	1236	IN	Data Raw: 20 33 2e e4 bc 98 e5 8c 96 e6 8a 80 e8 83 bd e9 87 8a e6 94 be 0d 0a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d Data Ascii: 3. ----------------------------------------------------------------------------------------- 2023106 chdyz v2.14.10 1. 2. --------------

Target ID:	0
Start time:	02:39:54
Start date:	26/05/2024
Path:	C:\Users\user\Desktop\uCLkYbZQoA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uCLkYbZQoA.exe"
Imagebase:	0x400000
File size:	1'056'768 bytes
MD5 hash:	36CBA9F836266DD47C2629AF72D7FA24
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.4%
Total number of Nodes:	1436
Total number of Limit Nodes:	78

Executed Functions

Function 00421760 Relevance: 53.5, APIs: 29, Strings: 1, Instructions: 979windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004217D2
IsIconic.USER32(?), ref: 0042180A
SetActiveWindow.USER32(?,?,?), ref: 00421833
IsWindow.USER32(?), ref: 0042185D
IsWindow.USER32(?), ref: 00421B2E
DestroyAcceleratorTable.USER32(?), ref: 00421C7E
DestroyMenu.USER32(?), ref: 00421C89
DestroyAcceleratorTable.USER32(?), ref: 00421CA3
DestroyMenu.USER32(?), ref: 00421CB2
DestroyAcceleratorTable.USER32(?), ref: 00421D12
DestroyMenu.USER32(?,000003EA,00000000,00000000,?,?,00000000,?,000007D9,00000000,00000000), ref: 00421D21
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00421DA3
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?), ref: 00421EBB
IsWindow.USER32(?), ref: 00421FEC
SendMessageA.USER32(?,0000806F,00000000,00000000), ref: 00422001
SendMessageA.USER32(?,00008004,00000000,00000000), ref: 0042201E
DestroyAcceleratorTable.USER32(?), ref: 0042206C
IsWindow.USER32(?), ref: 004220E1
IsWindow.USER32(?), ref: 00422131
IsWindow.USER32(?), ref: 00422181
IsWindow.USER32(?), ref: 004221BE
IsWindow.USER32(?), ref: 00422241
GetParent.USER32(?), ref: 0042224F
GetFocus.USER32 ref: 00422290

Part of subcall function 00421650: IsWindow.USER32(?), ref: 004216CB
Part of subcall function 00421650: GetFocus.USER32 ref: 004216D5
Part of subcall function 00421650: IsChild.USER32(?,00000000), ref: 004216E7

IsWindow.USER32(?), ref: 004222EF
SendMessageA.USER32(?,00008076,00000000,00000000), ref: 00422304
IsWindow.USER32(00000000), ref: 00422317
GetFocus.USER32 ref: 00422321
SetFocus.USER32(00000000), ref: 0042232C

Strings

d, xrefs: 00421773

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$Destroy$AcceleratorFocusTable$MenuMessageSend$ActiveCallbackChildDispatcherIconicParentUser
String ID: d
API String ID: 2657180179-2564639436
Opcode ID: bce9c1e1d35da9f0e2e315b5fdd9b62544558f2c8067c7d3750e0471321cbfd9
Instruction ID: 3c623462867fe7dbeff1e68f21300f799ac28584cbe19ae046ca4885b47a1525
Opcode Fuzzy Hash: bce9c1e1d35da9f0e2e315b5fdd9b62544558f2c8067c7d3750e0471321cbfd9
Instruction Fuzzy Hash: C472CC71604310AFD320DF26D880BAFB7E9AF98704F51491EF94997351DB78E841CBAA

Function 00422D50 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 287
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,004F6A94), ref: 00422DB7
LoadLibraryA.KERNEL32(?,?,00506F58), ref: 00422EA9
LoadLibraryA.KERNELBASE(?,?), ref: 00422EEF
LoadLibraryA.KERNELBASE(?,?,00506E60,00000001), ref: 00422F37
LoadLibraryA.KERNELBASE(00000001), ref: 00422F4D
GetProcAddress.KERNEL32(00000000,?), ref: 00422F5F
FreeLibrary.KERNEL32(00000000), ref: 00422FF2

Strings

tJN, xrefs: 00422FD4
\JN, xrefs: 00422F81

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Library$Load$AddressProc$Free
String ID: \JN$tJN
API String ID: 3120990465-3611533410
Opcode ID: 8b05d4873c513e53de8059f67577ffe87b4323e1540e1b9ac2f28b6736706ade
Instruction ID: fb4683d244ad199c4a5a20a41523227095524d447b61870dcfc54f1cfcf397ce
Opcode Fuzzy Hash: 8b05d4873c513e53de8059f67577ffe87b4323e1540e1b9ac2f28b6736706ade
Instruction Fuzzy Hash: D5A1E0B1B00751ABC314DF65D981FABF3A8BF98304F44062EF81997341D778A9158BAA

Function 00449020 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 370
commemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00449049
OleInitialize.OLE32(00000000), ref: 00449085
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004490A3
SetCurrentDirectoryA.KERNEL32(024652B8,?), ref: 004490FD
LoadCursorA.USER32(00000000,00007F00), ref: 00449158
GetStockObject.GDI32(00000005), ref: 00449179
GetCurrentThreadId.KERNEL32 ref: 004491A1

Strings

L, xrefs: 004494AD, 004494B0
L, xrefs: 00449548
_EL_HideOwner, xrefs: 00449183
(^L, xrefs: 00449295, 004492C0

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Current$CursorDirectoryFileHeapInitializeLoadModuleNameObjectProcessStockThread
String ID: (^L$_EL_HideOwner$L$L
API String ID: 3783217854-1457404285
Opcode ID: 6cf5b118e1feb9d67705a535834a44117c0fff9c55ccb3d09bb4b7ee6cc97157
Instruction ID: d71d463b8c7ba89159945fdd0e5682355096ed7bf7f99b927bbec32d6b78fdc7
Opcode Fuzzy Hash: 6cf5b118e1feb9d67705a535834a44117c0fff9c55ccb3d09bb4b7ee6cc97157
Instruction Fuzzy Hash: 30E1BF70A00605AFDB54DF95CC81FEEB7B5BF44304F14416EE909AB292DB786981CBA8

Function 0040F400 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158
comregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadTypeLib.OLEAUT32(00000000), ref: 0040F45F

Part of subcall function 0042D080: lstrlenA.KERNEL32(00000000,00000000,00423A33,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0042D08E

GetUserDefaultLCID.KERNEL32(00000000,?,?,00000001), ref: 0040F49B
LHashValOfNameSys.OLEAUT32(00000001,00000000), ref: 0040F4A4
RegisterTypeLib.OLEAUT32(?,00000000), ref: 0040F509
CoCreateInstance.OLE32(?,00000000,00000017,004D30B8,00000000), ref: 0040F569
CoCreateInstance.OLE32(?,00000000,00000007,004D30B8,00000000), ref: 0040F585
OleRun.OLE32(00000000), ref: 0040F590

Strings

Pou, xrefs: 0040F5B4

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CreateInstanceType$DefaultHashLoadNameRegisterUserlstrlen
String ID: Pou
API String ID: 2910728731-1565865998
Opcode ID: f53eef73561ccd602d85ed3aa0b6a7182d9f7d00f04489f1cfa804a2957fb853
Instruction ID: a28f896cdccbbf2c8610f76e7cda259450322900c8795761e1f536f319cdafa4
Opcode Fuzzy Hash: f53eef73561ccd602d85ed3aa0b6a7182d9f7d00f04489f1cfa804a2957fb853
Instruction Fuzzy Hash: 94514670204342AFD710DF61DC84EABB7E8EF84748F40483EF94597291E779E9498BA6

Function 004234C0 Relevance: 6.1, APIs: 4, Instructions: 94fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 00423512
FindClose.KERNEL32 ref: 00423521
FindFirstFileA.KERNELBASE(?,?), ref: 0042352D
FindClose.KERNELBASE(00000000), ref: 0042358B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 91aa74e0d0df918907ec7399e7c0fbb8ce1eac8e5a628843f6f8ebf43310eeb1
Instruction ID: a8354ff52896a06a1f038fcb7e21b975d269c8a9a1f27655c99b93bab4979936
Opcode Fuzzy Hash: 91aa74e0d0df918907ec7399e7c0fbb8ce1eac8e5a628843f6f8ebf43310eeb1
Instruction Fuzzy Hash: 28212232704730A7D3319E64E84477B7374AB84727F950626ED2D87340E77DDE854689

Function 00470ED0 Relevance: 6.1, APIs: 4, Instructions: 72processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00470EEB
Process32First.KERNEL32 ref: 00470F02
Process32Next.KERNEL32(00000000,?), ref: 00470F59
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,00000000,?), ref: 00470F63

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 0860be7b14fb76ad25953722d2b4c6e0adc7a8c72f4ade93b78fead007b50d58
Instruction ID: 8a874fc9a6131c9dcab8faa5d5505eccab677faca0dc05679c7963befe0472c1
Opcode Fuzzy Hash: 0860be7b14fb76ad25953722d2b4c6e0adc7a8c72f4ade93b78fead007b50d58
Instruction Fuzzy Hash: A32181715053009FC324DF6AC941ADBB7E4FF89354F00892EF94987251DB79B508CB95

Function 004B7F51 Relevance: 3.4, APIs: 2, Instructions: 422COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004B7F56
GetVersion.KERNEL32(00000007,?,?,00000000,00000000,?,0000C000,00000000,00000000,00000007), ref: 004B8109

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: H_prologVersion
String ID:
API String ID: 1836448879-0
Opcode ID: 2f3cb3af199070009e43619a9dbb43ffabc7f258801c412f8064391277b124c1
Instruction ID: 9a374fdb2de93d36692136d346ab99611067c6ef9ec53f457a604a9a9c5324e4
Opcode Fuzzy Hash: 2f3cb3af199070009e43619a9dbb43ffabc7f258801c412f8064391277b124c1
Instruction Fuzzy Hash: BAE16A70604209EFDB14EF65CC80AFE77E9AF44715F10851BF806AA291DB39D902EB79

Function 0042B8A0 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,?), ref: 0042B8B0
FindClose.KERNEL32(00000000), ref: 0042B8BC

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 30aac6d0fc90dd826a4b263166dee06c7b9cfdd3258f0bec508900e93e543466
Instruction ID: 62439c59dd59895b7baa3f1d1b59f2a679750a15c30dfc3e533e2b94d365c6e4
Opcode Fuzzy Hash: 30aac6d0fc90dd826a4b263166dee06c7b9cfdd3258f0bec508900e93e543466
Instruction Fuzzy Hash: 0BD05EB55005405BD3159BB4ED09AAA3798AB44311FC40A38B92DC52F0E77ED8588551

Function 0047A520 Relevance: 93.4, APIs: 52, Strings: 1, Instructions: 621
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32(00000000,?), ref: 0047A579
GetWindowTextA.USER32(?,?,00000100), ref: 0047A58C
GetTextExtentPoint32A.GDI32(?,yiyuyan,00000000,?), ref: 0047A5C5
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 0047A5E4
SelectObject.GDI32(?,00000000), ref: 0047A5F0
GetTextExtentPoint32A.GDI32(?,?,00000000,?), ref: 0047A617
GetWindowLongA.USER32(?,000000F0), ref: 0047A62F
FillRect.USER32(?,?,?), ref: 0047A6AC
FillRect.USER32(?,?,?), ref: 0047A6DC
FillRect.USER32 ref: 0047A704
FillRect.USER32(?,?,?), ref: 0047A72F
FillRect.USER32(?,?,?), ref: 0047A75A
CreateSolidBrush.GDI32(00BFB8BF), ref: 0047A75D
FrameRect.USER32(?,?,00000000), ref: 0047A770
DeleteObject.GDI32(00000000), ref: 0047A777
GetPixel.GDI32(?,00000000,00000000), ref: 0047A784
SetPixel.GDI32(?,00000000,?,00000000), ref: 0047A79F
SetPixel.GDI32(?,00000000,?,?), ref: 0047A7B1
SetPixel.GDI32(?,00000000,?,?), ref: 0047A7C5
SetPixel.GDI32(?,00000001,?,?), ref: 0047A7D7
SetPixel.GDI32(?,00000002,?,?), ref: 0047A7E9
SetPixel.GDI32(?,00000002,?,00BFB8BF), ref: 0047A7F9
SetPixel.GDI32(?,00000001,?,00BFB8BF), ref: 0047A80B
SetPixel.GDI32(?,?,?,?), ref: 0047A821
SetPixel.GDI32(?,?,?,?), ref: 0047A839
SetPixel.GDI32(?,?,?,?), ref: 0047A851
SetPixel.GDI32(?,?,?,?), ref: 0047A868
SetPixel.GDI32(?,?,?,?), ref: 0047A881
SetPixel.GDI32(?,?,?,00BFB8BF), ref: 0047A897
SetPixel.GDI32(?,?,?,00BFB8BF), ref: 0047A8AF
SetPixel.GDI32(?,00000000,?,?), ref: 0047A8C1
SetPixel.GDI32(?,00000000,?,?), ref: 0047A8D5
SetPixel.GDI32(?,00000000,?,?), ref: 0047A8E9
SetPixel.GDI32(?,00000001,?,?), ref: 0047A8FC
SetPixel.GDI32(?,00000002,?,?), ref: 0047A90F
SetPixel.GDI32(?,00000001,?,00BFB8BF), ref: 0047A921
SetPixel.GDI32(?,00000002,?,00BFB8BF), ref: 0047A933
SetPixel.GDI32(?,?,?,?), ref: 0047A94A
SetPixel.GDI32(?,?,?,?), ref: 0047A963
SetPixel.GDI32(?,?,?,?), ref: 0047A97C
SetPixel.GDI32(?,?,?,?), ref: 0047A995
SetPixel.GDI32(?,?,?,?), ref: 0047A9AE
SetPixel.GDI32(?,?,?,00BFB8BF), ref: 0047A9C6
SetPixel.GDI32(?,?,?,00BFB8BF), ref: 0047A9DE
GetTextMetricsA.GDI32(?,?), ref: 0047AA00
GetWindowLongA.USER32(?,000000F0), ref: 0047AA18
SetPixel.GDI32(?,00000008,?,?), ref: 0047AA60
SetPixel.GDI32(?,?,?,?), ref: 0047AABA
SetTextColor.GDI32(?,?), ref: 0047AAD4
DrawTextA.USER32(?,?,000000FF,?,?), ref: 0047AAF2
SelectObject.GDI32(?,?), ref: 0047AB0D
SetPixel.GDI32(?,?,?,?), ref: 0047AB73

Strings

yiyuyan, xrefs: 0047A5A5, 0047A5BF

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Pixel$Rect$Text$Fill$ObjectWindow$ExtentLongPoint32Select$BrushClientColorCreateDeleteDrawFrameMessageMetricsSendSolid
String ID: yiyuyan
API String ID: 2337496717-4001923938
Opcode ID: b4d305355b89f1695586bb8cd0837cc543bd842609343fe3e2b5dcc1e5c5d3d9
Instruction ID: 25989655adfb1a243e7e6da8bed62b42ad9fff6ee3ad28fc3b7312b82885e18e
Opcode Fuzzy Hash: b4d305355b89f1695586bb8cd0837cc543bd842609343fe3e2b5dcc1e5c5d3d9
Instruction Fuzzy Hash: 1422F5B4608705AFD204CF28C884D6FBBF9EFC8754F148A1EB99583390D675EC458BA6

Function 004790C0 Relevance: 65.0, APIs: 43, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32(?,?), ref: 0047941E
FillRect.USER32(?,?,?), ref: 00479432
GetSysColorBrush.USER32(0000000F), ref: 0047943A
FrameRect.USER32(?,?,00000000), ref: 00479451
GetSysColor.USER32(0000000F), ref: 0047945B
InflateRect.USER32(?,000000FF,000000FF), ref: 00479478
CreateSolidBrush.GDI32(00733C00), ref: 00479485
FrameRect.USER32(?,?,00000000), ref: 00479494
DeleteObject.GDI32(00000000), ref: 0047949D
InflateRect.USER32(?,000000FF,000000FF), ref: 004794A8
CreateSolidBrush.GDI32(00EAF4F5), ref: 004794BD
FillRect.USER32(?,?,00000000), ref: 004794CC
DeleteObject.GDI32(00000000), ref: 004794D3
InflateRect.USER32(?,000000FE,000000FE), ref: 00479533
GetSysColor.USER32(0000000F), ref: 00479584
SetPixel.GDI32(?,00000001,00000001,00000000), ref: 00479598
SetPixel.GDI32(?,00000001,00733BFE,00000000), ref: 004795AA
SetPixel.GDI32(?,?,00733BFE,00000000), ref: 004795C2
SetPixel.GDI32(?,00733BFE,00000001,00000000), ref: 004795D4
GetSysColor.USER32(0000000F), ref: 004795DE
SetPixel.GDI32(?,00000002,00000002,00733C00), ref: 004795F8
SetPixel.GDI32(?,00000002,00733C01,00733C00), ref: 00479608
SetPixel.GDI32(?,?,00733C01,00733C00), ref: 0047961C
SetPixel.GDI32(?,00733C01,00000002,00733C00), ref: 0047962C
GetSysColor.USER32(0000000F), ref: 00479636
SetPixel.GDI32(?,00000001,00000002,00733C00), ref: 00479650
SetPixel.GDI32(?,00000002,00000001,00733C00), ref: 0047965C
SetPixel.GDI32(?,00733C01,00000001,00733C00), ref: 0047966C
SetPixel.GDI32(?,00733BFE,00000002,00733C00), ref: 0047967E
SetPixel.GDI32(?,?,00733BFE,00733C00), ref: 00479694
SetPixel.GDI32(?,?,00733C01,00733C00), ref: 004796AA
SetPixel.GDI32(?,00000002,00733BFE,00733C00), ref: 004796BC
SetPixel.GDI32(?,00000001,00733C01,00733C00), ref: 004796CC
InflateRect.USER32(?,00000001,00000001), ref: 004796E3
DrawFocusRect.USER32(?,?), ref: 004796EF
InflateRect.USER32(?,000000FF,000000FF), ref: 004796FE
GetWindowTextA.USER32(?,?,00000100), ref: 00479711
OffsetRect.USER32(?,00000001,00000001), ref: 0047972E
SetTextColor.GDI32(?,0094A2A5), ref: 00479751
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 00479761
SelectObject.GDI32(?,00000000), ref: 00479773
GetWindowLongA.USER32(?,000000F0), ref: 0047977D
SelectObject.GDI32(?,00000000), ref: 004797AC

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Pixel$Rect$Color$Inflate$Object$Brush$CreateDeleteFillFrameSelectSolidTextWindow$ClientDrawFocusLongMessageOffsetSend
String ID:
API String ID: 3464004264-0
Opcode ID: 0d43308a02b2e82aad2ed3dd2546cdbd88eee0d65237bce28e2a636991aa93ed
Instruction ID: 0a65b32dd5fb7d65735255953d9b4feed0785f0b01ed6e88c9e4f02048ad4c55
Opcode Fuzzy Hash: 0d43308a02b2e82aad2ed3dd2546cdbd88eee0d65237bce28e2a636991aa93ed
Instruction Fuzzy Hash: 981236B1508385AFD364CF19C889FABBBE9FBC8714F108A1EF58897290D7749841CB56

Function 004797D0 Relevance: 40.8, APIs: 27, Instructions: 303
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004782B0: GetWindowRect.USER32(?,00000000), ref: 004782C0
Part of subcall function 004782B0: GetWindowDC.USER32(?,?,?), ref: 004782C9
Part of subcall function 004782B0: CreateCompatibleDC.GDI32(00000000), ref: 004782D3
Part of subcall function 004782B0: SetBkMode.GDI32(00000000,00000001), ref: 004782DF
Part of subcall function 004782B0: SelectObject.GDI32(?,00000000), ref: 00478329
Part of subcall function 004782B0: BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00478365

GetClientRect.USER32(00000000,?), ref: 00479807
FillRect.USER32(?,?,?), ref: 0047983B
GetSysColor.USER32(0000000F), ref: 00479849
GetWindowLongA.USER32(?,000000F0), ref: 00479863
CreateSolidBrush.GDI32(00845118), ref: 004798ED
FrameRect.USER32(?,?,00000000), ref: 004798FC
DeleteObject.GDI32(00000000), ref: 00479909
InflateRect.USER32(000000F0,000000FF,000000FF), ref: 0047991A
GetStockObject.GDI32(00000000), ref: 00479925
FillRect.USER32(?,000000F0,00000000), ref: 00479932
InflateRect.USER32(000000F0,000000FE,000000FE), ref: 00479968
CreateSolidBrush.GDI32(-00E7E7E6), ref: 004799BF
FillRect.USER32(?,?,00000000), ref: 004799CE
DeleteObject.GDI32(00000000), ref: 004799D5
CreatePen.GDI32(00000000,00000001,-0021A220), ref: 004799FA
SelectObject.GDI32(?,00000000), ref: 00479A02
MoveToEx.GDI32(?,?,00000002,00000000), ref: 00479A34
LineTo.GDI32(?,?,00000005), ref: 00479A55
SelectObject.GDI32(?,?), ref: 00479A6E
DeleteObject.GDI32(00000000), ref: 00479A71
GetWindowTextA.USER32(00000001,?,00000100), ref: 00479A8C
GetSysColor.USER32(00000011), ref: 00479AA2
SetTextColor.GDI32(?,?), ref: 00479AAF
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 00479ABE
SelectObject.GDI32(?,00000000), ref: 00479AC6

Part of subcall function 00476C30: GetTextExtentPoint32A.GDI32(?,004EEAE0,?,?), ref: 00476CC3

SelectObject.GDI32(?,00000000), ref: 00479AF2
DrawFocusRect.USER32(?,?), ref: 00479B22

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ObjectRect$Select$CreateWindow$ColorDeleteFillText$BrushInflateSolid$ClientCompatibleDrawExtentFocusFrameLineLongMessageModeMovePoint32SendStock
String ID:
API String ID: 1573148217-0
Opcode ID: cf21932e35af7efec8d322b1c417f93303789ac446cc8c9f980ddc9f054a1fbd
Instruction ID: 036afe5a9b9211688522975ad6c4fc7ca7c1552a38b579f9aee58cb3b5083440
Opcode Fuzzy Hash: cf21932e35af7efec8d322b1c417f93303789ac446cc8c9f980ddc9f054a1fbd
Instruction Fuzzy Hash: 9BB19CB1504301AFD710DF64CC89EAB77E8EB85704F044A2EF95596351DB38EC45CBAA

Function 004B7382 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 170
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BF1AC: TlsGetValue.KERNEL32(00533A2C,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000,?,004B2B99,00000000,00000000,00000000,00000000), ref: 004BF1EB

CallNextHookEx.USER32(?,00000003,?,?), ref: 004B73AC
GetClassLongA.USER32(?,000000E6), ref: 004B73F3
GlobalGetAtomNameA.KERNEL32(?,?,00000005), ref: 004B741F
lstrcmpiA.KERNEL32(?,ime), ref: 004B742E
GetWindowLongA.USER32(?,000000FC), ref: 004B74A1
SetWindowLongA.USER32(?,000000FC,00000000), ref: 004B74C2

Strings

ime, xrefs: 004B7428
AfxOldWndProc423, xrefs: 004B7503, 004B7508, 004B7513, 004B751B, 004B7524

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Long$Window$AtomCallClassGlobalHookNameNextValuelstrcmpi
String ID: AfxOldWndProc423$ime
API String ID: 3731301195-104836986
Opcode ID: ee81e3665157fa4558f6ba5636a5f2fa78d4e1f2b96e66bc9660506799f428cc
Instruction ID: ba4b23ff377a09fc51956bf3ec3e04cc6fba849956f0b01beb78c865f94a0973
Opcode Fuzzy Hash: ee81e3665157fa4558f6ba5636a5f2fa78d4e1f2b96e66bc9660506799f428cc
Instruction Fuzzy Hash: 4251B231608615BBCB219F64DC48FEF7BB8BF44361F104626F815A7291D738E940CBA8

Function 004B8FAE Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 174
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004B9917: GetWindowLongA.USER32(?,000000F0), ref: 004B9923

GetParent.USER32(?), ref: 004B8FD9
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 004B8FFC
GetWindowRect.USER32(?,?), ref: 004B9015
GetWindowLongA.USER32(00000000,000000F0), ref: 004B9028
CopyRect.USER32(?,?), ref: 004B9075
CopyRect.USER32(?,?), ref: 004B907F
GetWindowRect.USER32(00000000,?), ref: 004B9088

Part of subcall function 004A356F: MonitorFromWindow.USER32(?,?), ref: 004A3584

Part of subcall function 004A35DA: GetMonitorInfoA.USER32(?,?), ref: 004A35F1

CopyRect.USER32(?,?), ref: 004B90A4

Strings

(, xrefs: 004B9040
@, xrefs: 004B9017

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: RectWindow$Copy$LongMonitor$FromInfoMessageParentSend
String ID: ($@
API String ID: 1450647913-1311469180
Opcode ID: 29c69ca4fc461ef26552fce18aeaad799c0142078290217224758bba322d8832
Instruction ID: 6b61da9f4a9475aa66ea50615522f7c95b9c55bdeb10e55200cbbd3193589d9e
Opcode Fuzzy Hash: 29c69ca4fc461ef26552fce18aeaad799c0142078290217224758bba322d8832
Instruction Fuzzy Hash: 46519371904619AFDB10DFA8CC85EEE7BB9AF48314F15411AFA01F3284DA34AD458B68

Function 00412260 Relevance: 19.9, APIs: 13, Instructions: 372
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa95f5c9634e95ace5587c858fa463133f43b910a6c7a0733d0a92a73764444
Instruction ID: 77ddc0c8141847474fc48481f2d9f00bb8efc886da69bfb7fe9a5323f81997b8
Opcode Fuzzy Hash: 7fa95f5c9634e95ace5587c858fa463133f43b910a6c7a0733d0a92a73764444
Instruction Fuzzy Hash: 4CD18174204B019FD724CF24CD80EABB7E9EB48718F14492EE566C7790D6B8EC91CB29

Function 00473BD0 Relevance: 19.9, APIs: 13, Instructions: 371
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,00001036,00000000,00000000), ref: 00473DF8
SendMessageA.USER32(?,00001003,00000000,00000124), ref: 00473E52
SendMessageA.USER32(?,00001003,00000002,0000012C), ref: 00473E98
ImageList_SetBkColor.COMCTL32(?,00000000), ref: 00473F01
SendMessageA.USER32(?,00001208,00000000,00000000), ref: 00473F31
SendMessageA.USER32(?,00001024,00000000,?), ref: 00473F48
IsWindow.USER32(00000000), ref: 00473EBD

Part of subcall function 00411510: GetSysColor.USER32(0000000F), ref: 0041151D

SendMessageA.USER32(?,00001026,00000000,00000000), ref: 00473F62
SendMessageA.USER32(?,00001001,00000000,00000000), ref: 00473F7C
LoadCursorA.USER32(00000000,00007F89), ref: 00473FAC
LoadCursorA.USER32(?,000007D8), ref: 00473FC3
LoadCursorA.USER32(00000000,00007F00), ref: 00473FD0
SendMessageA.USER32(?,0000103E,00000000,00000000), ref: 00473FDE

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$CursorLoad$Color$ImageList_Window
String ID:
API String ID: 1757432420-0
Opcode ID: 4df04aaedd92ae1719ef7d6db41138d8e19292aad1dec20fa9fe45c2dc02c879
Instruction ID: 9911d40a026578dece39b21b5812980d560856423b255e79c0ca6f52d3cbedb6
Opcode Fuzzy Hash: 4df04aaedd92ae1719ef7d6db41138d8e19292aad1dec20fa9fe45c2dc02c879
Instruction Fuzzy Hash: 7EC19F71700701AFE724DE75CC81FA7B3E8AB48745F00891DFA5AC7381EB68E9019B69

Function 00477A80 Relevance: 19.7, APIs: 13, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcA.USER32(?,?,?,?,?), ref: 00477AF0

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: fc08d72518839f9dee53def629055a8b4c42964459501e50a12e190218cf80af
Instruction ID: 808ec232c170b221e4090484f7489a0dcfd26d459f9ab10ff6861288341aafd1
Opcode Fuzzy Hash: fc08d72518839f9dee53def629055a8b4c42964459501e50a12e190218cf80af
Instruction Fuzzy Hash: EC813CB5A04609AFDB24CF59D985EBFB7B9FB88710F50852AF90593340C738AC50CBA5

Function 00477520 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 182
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameA.USER32(?,?,00000104), ref: 0047753C
lstrcmpiA.KERNEL32(?), ref: 00477557
lstrcmpiA.KERNEL32(?,ComboLBox), ref: 00477573
GetWindowLongA.USER32(?,000000F0), ref: 0047758E
GetWindowTextLengthA.USER32(?), ref: 004775CC
GetParent.USER32(?), ref: 00477647
GetClassNameA.USER32(00000000,?,00000104), ref: 00477658

Strings

(N, xrefs: 00477561
SysIPAddress32, xrefs: 00477662
N, xrefs: 0047754A
ComboLBox, xrefs: 0047756D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ClassNameWindowlstrcmpi$LengthLongParentText
String ID: (N$ComboLBox$SysIPAddress32$N
API String ID: 2554919364-3549150811
Opcode ID: c96fe09597cec5c51a4b4d61fadbb0bf7026d460b5b38a9686f3abbb7932c5cb
Instruction ID: d792f55912c5f8f7df202726247ff32c82dbe5794736e0fe01def3bd64adf23a
Opcode Fuzzy Hash: c96fe09597cec5c51a4b4d61fadbb0bf7026d460b5b38a9686f3abbb7932c5cb
Instruction Fuzzy Hash: 5841AEB778420457E224865EFCC1BEAB344E3E0731F884637EB58C5290D57FA59AC2AC

Function 004BEE45 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00533A48,00533A1C,00000000,?,00533A2C,00533A2C,004BF1E0,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000), ref: 004BEE54
GlobalAlloc.KERNELBASE(00002002,00000000,?,?,00533A2C,00533A2C,004BF1E0,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000), ref: 004BEEA9
GlobalHandle.KERNEL32(00572A58), ref: 004BEEB2
GlobalUnlock.KERNEL32(00000000,?,?,00533A2C,00533A2C,004BF1E0,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000), ref: 004BEEBB
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 004BEECD
GlobalHandle.KERNEL32(00572A58), ref: 004BEEE4
GlobalLock.KERNEL32(00000000,?,?,00533A2C,00533A2C,004BF1E0,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000), ref: 004BEEEB
LeaveCriticalSection.KERNEL32(P:J,?,?,00533A2C,00533A2C,004BF1E0,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000), ref: 004BEEF1
GlobalLock.KERNEL32(00000000,?,?,00533A2C,00533A2C,004BF1E0,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000), ref: 004BEF00
LeaveCriticalSection.KERNEL32(?), ref: 004BEF49

Strings

P:J, xrefs: 004BEEED

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID: P:J
API String ID: 2667261700-542998869
Opcode ID: d0e017c7871ca3d4b4b03fa4039172c20388eca689ce59b73d24ea527c7be92a
Instruction ID: 22cace7ae43bdf9867063131f7ac2b8a65a70413bd0ae0626515185b9ccf9d3e
Opcode Fuzzy Hash: d0e017c7871ca3d4b4b03fa4039172c20388eca689ce59b73d24ea527c7be92a
Instruction Fuzzy Hash: 80319E75200709AFD7209F69DC89AABB7E9FF84301F004A2EF852C7661E775F9448B24

Function 004B71A7 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004B71AC
GetPropA.USER32(?,AfxOldWndProc423), ref: 004B71C4
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 004B7222

Part of subcall function 004B6D8F: GetWindowRect.USER32(?,?), ref: 004B6DB4
Part of subcall function 004B6D8F: GetWindow.USER32(?,00000004), ref: 004B6DD1

SetWindowLongA.USER32(?,000000FC,?), ref: 004B7252
RemovePropA.USER32(?,AfxOldWndProc423), ref: 004B725A
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 004B7261
GlobalDeleteAtom.KERNEL32(00000000), ref: 004B7268

Part of subcall function 004B6D6C: GetWindowRect.USER32(?,?), ref: 004B6D78

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 004B72BC

Strings

AfxOldWndProc423, xrefs: 004B71BA, 004B71C2, 004B7258, 004B7260

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: 782dcf9448ea780eeef35e0e99116e28ca3f5c289d6dbde2c5fe15811426e34c
Instruction ID: 59af03746e3f86a01ddc53a3fd2876e40d2ba2d8677f1de0c51634bd9a2a993c
Opcode Fuzzy Hash: 782dcf9448ea780eeef35e0e99116e28ca3f5c289d6dbde2c5fe15811426e34c
Instruction Fuzzy Hash: 90316C7290410AAFCF15AFA5DD49DFF7AB8EF85311F00012AF501A6250C7399A519BB9

Function 0040FDBE Relevance: 15.8, APIs: 10, Instructions: 755memoryCOMMON

Download Yara Rule

APIs

LHashValOfNameSys.OLEAUT32(00000001,?,?), ref: 0040FE09
VariantCopyInd.OLEAUT32(?,00000000), ref: 0041011E
SysAllocString.OLEAUT32(00000000), ref: 00410193
VariantCopyInd.OLEAUT32(?,00000000), ref: 0041029A
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 0041043A
VariantInit.OLEAUT32(?), ref: 00410471
VariantInit.OLEAUT32(?), ref: 004104B5
VariantClear.OLEAUT32(?), ref: 00410610
VariantClear.OLEAUT32(?), ref: 0041062B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Variant$ClearCopyInit$AllocChangeHashNameStringType
String ID:
API String ID: 788266297-0
Opcode ID: 7160a28daf5edc08d3ac9d8d54643d559edffe8f254fc5c5f7a30a1b71b803c5
Instruction ID: 62ac150253534d04b7af0139cfcda0ca7848bdffebd9eaabe440c63cd221870d
Opcode Fuzzy Hash: 7160a28daf5edc08d3ac9d8d54643d559edffe8f254fc5c5f7a30a1b71b803c5
Instruction Fuzzy Hash: 3D52A274A00206CFCB24CF54C484AAEB7B5FF48314F24856EE855AB351D7B89DC6CB9A

Function 00411DA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 267
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateSolidBrush.GDI32(00000000), ref: 00411EE8
SendMessageA.USER32(?,000000C5,?,00000000), ref: 00411F79
SendMessageA.USER32(?,000000CC,?,00000000), ref: 00411F91
SendMessageA.USER32(?,00000465,00000000,?), ref: 0041205B
SendMessageA.USER32(?,000000B1,?,?), ref: 00412098
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004120A7

Strings

msctls_updown32, xrefs: 00411FEF
EDIT, xrefs: 00411F27

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$BrushCreateSolid
String ID: EDIT$msctls_updown32
API String ID: 943060551-1401569126
Opcode ID: d3cfeed82e77a9fc42afacfbcaaafe7a5748ee1258e78b2d7ef7a07441b522fd
Instruction ID: b1b9f216a52415fd64396a220c12ecf9d650ea71a5fc3f18dd298de8ba09abe3
Opcode Fuzzy Hash: d3cfeed82e77a9fc42afacfbcaaafe7a5748ee1258e78b2d7ef7a07441b522fd
Instruction Fuzzy Hash: 9A91BF70604B009FE724DB65CC81FABB7E5AB84744F10491EFB96C7390DA78E885CB59

Function 00426670 Relevance: 13.8, APIs: 9, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783f223dad066a535b3a466fafc423b40826535a21c37a9e55d282c86cc65e8b
Instruction ID: dcc2288cfbb9e8ed9a20239555211a7b5096695819132c33464ffb427127db92
Opcode Fuzzy Hash: 783f223dad066a535b3a466fafc423b40826535a21c37a9e55d282c86cc65e8b
Instruction Fuzzy Hash: BCB1A8707047109FD724DF25E884B2BBBE6AB84304F91892EF59287390DA78E841CB5A

Function 00477780 Relevance: 13.6, APIs: 9, Instructions: 150memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00477520: GetClassNameA.USER32(?,?,00000104), ref: 0047753C
Part of subcall function 00477520: lstrcmpiA.KERNEL32(?), ref: 00477557
Part of subcall function 00477520: lstrcmpiA.KERNEL32(?,ComboLBox), ref: 00477573

GetWindowLongA.USER32(?,000000F0), ref: 004777B8
GetProcessHeap.KERNEL32(00000000,00000024,?,?,?), ref: 004777C4
HeapAlloc.KERNEL32(00000000,?,?,?), ref: 004777CB
GetFocus.USER32 ref: 004777F1
SetWindowLongA.USER32(?,000000FC,Function_00077A80), ref: 0047780B
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0047783D
RedrawWindow.USER32(?,00000000,00000000,00000705,?,?,?), ref: 0047792E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$HeapLonglstrcmpi$AllocClassFocusMessageNameProcessRedrawSend
String ID:
API String ID: 409284982-0
Opcode ID: c659fabca853b11c70cd07d8e4b12b755cb20a2b8e09fd534af053c1772cd77b
Instruction ID: 3a8d8a1fee8517cc2ab1d3759b5b920076903efc274676b351dbd3b5faf8a22a
Opcode Fuzzy Hash: c659fabca853b11c70cd07d8e4b12b755cb20a2b8e09fd534af053c1772cd77b
Instruction Fuzzy Hash: 4641C3F06497019BF7309B15DD86BBB77E5EB41340F90C82FE39E866A1D778A8818709

Function 00477480 Relevance: 12.0, APIs: 8, Instructions: 46threadCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00477450,00000000), ref: 00477495
GetCurrentThreadId.KERNEL32 ref: 004774B1
EnumThreadWindows.USER32(00000000,?,00477450), ref: 004774B8
UnhookWindowsHookEx.USER32(?), ref: 004774C4
GetCurrentThreadId.KERNEL32 ref: 004774E9
EnumThreadWindows.USER32(00000000,?,00477450), ref: 004774EC
GetCurrentThreadId.KERNEL32 ref: 004774F2
SetWindowsHookExA.USER32(00000004,00477A40,00000000,00000000), ref: 004774FE

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Thread$Windows$Current$EnumHook$FreeLibraryUnhook
String ID:
API String ID: 1464911712-0
Opcode ID: c3a7d774e75ca67f9d6e2bc1a8382c7473d04f1de78e91237ebe982b7ac9b88a
Instruction ID: 257ef70855ab8c1d9ee688d173f0cbd74eb04ddd2fb398ababcfcc6d83633b2a
Opcode Fuzzy Hash: c3a7d774e75ca67f9d6e2bc1a8382c7473d04f1de78e91237ebe982b7ac9b88a
Instruction Fuzzy Hash: C601F4B6704210ABD750AF64FD48FEF3B68A715752F408836F509D7290C674E880DBAC

Function 004C0008 Relevance: 9.1, APIs: 6, Instructions: 61stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004C001E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000001), ref: 004C0045
CLSIDFromString.OLE32(?,?,?,00000001), ref: 004C004F
lstrlenA.KERNEL32(?), ref: 004C0060
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000001), ref: 004C0087
CLSIDFromProgID.OLE32(?,?,?,00000001), ref: 004C0091

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ByteCharFromMultiWidelstrlen$ProgString
String ID:
API String ID: 2475774695-0
Opcode ID: ae2da2fa097947ab5c05421e007779f6d44bf9d9fe6e462c42b7614f318fe387
Instruction ID: ebc380c350641ba79926e38ae4d30981429f6d9e4afb7e425fb9272c6d953a72
Opcode Fuzzy Hash: ae2da2fa097947ab5c05421e007779f6d44bf9d9fe6e462c42b7614f318fe387
Instruction Fuzzy Hash: FD112537004605F7DB601B52EC09FAF7FA8FF823A1F210126F91986190D734A252CBAC

Function 0041A890 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 226windowCOMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(00000000), ref: 0041A98C
DestroyIcon.USER32(?,?,?,000000B0,00000000,00000000,?,?,00000000), ref: 0041AA2C
SendMessageA.USER32(?,000000F7,00000000,?), ref: 0041AAEB
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 0041AB06

Strings

BUTTON, xrefs: 0041AA8C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$BrushCreateDestroyIconSolid
String ID: BUTTON
API String ID: 3996100863-3405671355
Opcode ID: 911a358f6e5e3bb3e03186a3ef9b75fe43274ff0aebd8bd64e2dbbed56f27e81
Instruction ID: eb91d2b4e7878bc900ec503130625ffe12125f05c3e06af5f4b404f57cdeb72d
Opcode Fuzzy Hash: 911a358f6e5e3bb3e03186a3ef9b75fe43274ff0aebd8bd64e2dbbed56f27e81
Instruction Fuzzy Hash: 3671BEB16007059FD724DF65C980FABB7E5BB84740F144A2EF58683380DB39B895CB6A

Function 00417640 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 207windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 0041774C
DestroyIcon.USER32(?,?,?,?,0000008C,00000000), ref: 004177AA
SendMessageA.USER32(?,000000F7,00000001,?), ref: 0041784C
SendMessageA.USER32(?,000000F7,00000000,?), ref: 0041787E

Strings

BUTTON, xrefs: 0041780B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$ColorDestroyIcon
String ID: BUTTON
API String ID: 1480523805-3405671355
Opcode ID: 8158d8e4a17dde55cc5de4b1fa8259406a102fb537562fea4fdea15f0eb2636d
Instruction ID: 316a5b44d6c889942aae0531e666c3bdb8591c4f45b83eb2bb10ba04e2068c7c
Opcode Fuzzy Hash: 8158d8e4a17dde55cc5de4b1fa8259406a102fb537562fea4fdea15f0eb2636d
Instruction Fuzzy Hash: 39617EB5608B059BD324DF59C880BABB7B5FB44710F50891EE59683780DB39F884CB5A

Function 00426550 Relevance: 6.1, APIs: 4, Instructions: 94windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000080,00000001,?), ref: 004265F8
SendMessageA.USER32(?,00000080,00000000,?), ref: 0042660A
DestroyIcon.USER32(?), ref: 0042661D
DestroyIcon.USER32(?), ref: 0042662A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: DestroyIconMessageSend
String ID:
API String ID: 1880505497-0
Opcode ID: 0d5ac362fd2555d630d251c0572966c6e8cb563d2c710c63a53b086b5de2db90
Instruction ID: 05e0adb148c795bc3f70db763be739ae95e0cf500fb71262f6c06c996aef4997
Opcode Fuzzy Hash: 0d5ac362fd2555d630d251c0572966c6e8cb563d2c710c63a53b086b5de2db90
Instruction Fuzzy Hash: 55316D71704311AFE720DF65E880BABB3E8AFC4710F51882EF995C3344D678E8498B66

Function 004763B0 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000030,00000030,?,00000001), ref: 004763E1
SendMessageA.USER32(?,00000030,?,00000001), ref: 004763F9
GetStockObject.GDI32(00000011), ref: 00476403
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 00476423

Part of subcall function 00411530: CreateFontIndirectA.GDI32 ref: 00411579

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$CreateFontIndirectObjectStock
String ID:
API String ID: 1613733799-0
Opcode ID: f6b9597a83f71ec073ad9d48d7d5d5bc513c359b0ce14241a10cd108ca9a75e6
Instruction ID: 347297f7a0cfc0f92444361fcd27535d3b2b8e907c173fbb8a9326f1608c5585
Opcode Fuzzy Hash: f6b9597a83f71ec073ad9d48d7d5d5bc513c359b0ce14241a10cd108ca9a75e6
Instruction Fuzzy Hash: 96018032210720BBCB549B54EC85FDB73AAAB88750F05C459B6448B291C775E882CB94

Function 004BFA1B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000000,00000000,004BB6D5,00000000,00000000,00000000,00000000,?,00000000,?,004B2B99,00000000,00000000,00000000,00000000,004A3A50), ref: 004BFA24
SetErrorMode.KERNELBASE(00000000,?,00000000,?,004B2B99,00000000,00000000,00000000,00000000,004A3A50,00000000), ref: 004BFA2B

Part of subcall function 004BFA7E: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 004BFAAF
Part of subcall function 004BFA7E: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 004BFB50
Part of subcall function 004BFA7E: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 004BFB7D

Strings

P:J, xrefs: 004BFA59

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID: P:J
API String ID: 3389432936-542998869
Opcode ID: 5013b6073d89a573a7aa502b259cee2a219b131a6d0f01f8416884f30a0bafc7
Instruction ID: 59615a0df7754170442977aa6fa97323e9c65794a27d281fa84b24886195d4a2
Opcode Fuzzy Hash: 5013b6073d89a573a7aa502b259cee2a219b131a6d0f01f8416884f30a0bafc7
Instruction Fuzzy Hash: E9F037719142109FCB14EF65D444E897BE4AF88714F05889FB4888B3A2CB78E840CB6A

Function 004BA427 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004BA43A
SetWindowsHookExA.USER32(000000FF,004BA77C,00000000,00000000), ref: 004BA44A

Part of subcall function 004BF241: __EH_prolog.LIBCMT ref: 004BF246

Strings

:S, xrefs: 004BA455

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID: :S
API String ID: 2183259885-872041131
Opcode ID: b7b1e9731b76dad66005199b03d3367f438b83bc8fa760c0149f67912659f275
Instruction ID: 524d1b5b3f7091f85482734616bcd9ed2f3c8d595917385bd82ce3a10e96ffb2
Opcode Fuzzy Hash: b7b1e9731b76dad66005199b03d3367f438b83bc8fa760c0149f67912659f275
Instruction Fuzzy Hash: D0F0A7315006405FD7603B729C0EBDF3AE0AF44715F040A6EF1515A1E2CA6C9844C77F

Function 00433680 Relevance: 4.7, APIs: 3, Instructions: 203windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(00000000,?,00000001,00030000,?,?,00000000), ref: 004337EB
CreateIconFromResource.USER32(00000000,?,00000001,00030000), ref: 0043380B
DestroyIcon.USER32(?), ref: 0043383B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Icon$CreateFromResource$Destroy
String ID:
API String ID: 4181819098-0
Opcode ID: ca83272bf22941085251e21fbfb545fe1497f073be2085ae8759393ae2542560
Instruction ID: c23e97ea943e7a5bb7f8fb97d355531a11eb6199795518b4ffa7c5856e43b6e9
Opcode Fuzzy Hash: ca83272bf22941085251e21fbfb545fe1497f073be2085ae8759393ae2542560
Instruction Fuzzy Hash: 6C61C3B1A00604AFDB24EF59C980AAEFBF5FF48711F50892EF55697340D738AA80CB55

Function 004226D0 Relevance: 4.6, APIs: 3, Instructions: 110windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 004226F9
IsWindow.USER32 ref: 00422727
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 004227F6

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessagePeek$Window
String ID:
API String ID: 1210580970-0
Opcode ID: c3ffe3552929256c8b877da439eeba5fe51c811a291dc137af15107340707615
Instruction ID: 492af7f3e8d23627a271b13aaad91611ff016a77f4fab16a4f07f8d5b0800b3b
Opcode Fuzzy Hash: c3ffe3552929256c8b877da439eeba5fe51c811a291dc137af15107340707615
Instruction Fuzzy Hash: 29319575704216BFD714DF24EA84BABB3A8FF84348F80022EE51597200D7B8ED54CBA9

Function 004B6CE9 Relevance: 4.5, APIs: 3, Instructions: 34COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,?), ref: 004B6CF2
SetWindowLongA.USER32(?,?,?), ref: 004B6D11
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004B6D2B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: f739043286b8f14f404a149eeea317cf8f3684498fcfd4fc16e45d006c00c491
Instruction ID: 54cd47236cbfeb595a8c5b8e4a26d40d01d2f9960ebddde7ed6cd7169d264c43
Opcode Fuzzy Hash: f739043286b8f14f404a149eeea317cf8f3684498fcfd4fc16e45d006c00c491
Instruction Fuzzy Hash: F4F03035210109BFDF088F60DC55CFE3B6AEB04351F444429F906C5160EB39A8A19B64

Function 00416D10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00411510: GetSysColor.USER32(0000000F), ref: 0041151D

CreateSolidBrush.GDI32(00000000), ref: 00416DA8

Strings

BUTTON, xrefs: 00416DFF

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: BrushColorCreateSolid
String ID: BUTTON
API String ID: 2798526982-3405671355
Opcode ID: b474020e32feabf3db543237a8904df547c4bf2533e024b67c9961c90e94e01e
Instruction ID: c125af5cc5c8062414b4afb9589d9c5ed64218fc37285cfb115c0059f003bacc
Opcode Fuzzy Hash: b474020e32feabf3db543237a8904df547c4bf2533e024b67c9961c90e94e01e
Instruction Fuzzy Hash: 453170B1604B009BD314DB59D841FABB7F8EF88B44F108A1EF58687790E739E845CB96

Function 00423E70 Relevance: 3.1, APIs: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00008002,00000000,00000000), ref: 00423EDE
GetParent.USER32(00000000), ref: 00423EFA

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageParentSend
String ID:
API String ID: 928151917-0
Opcode ID: 139b2d2cfec798cf370823a12007dca6f7146195654a8f00bc3fbf56d2a08cf5
Instruction ID: 374c59d4b17c0799202e9f3b3fb2b41bdd65b88899b4c2dc58e82d57c6600a01
Opcode Fuzzy Hash: 139b2d2cfec798cf370823a12007dca6f7146195654a8f00bc3fbf56d2a08cf5
Instruction Fuzzy Hash: AB1151327012216BD7209F65A804B6BB7B8BF94756F428037F904D7301D73CED4986B9

Function 004B6D8F Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 004B9917: GetWindowLongA.USER32(?,000000F0), ref: 004B9923

GetWindowRect.USER32(?,?), ref: 004B6DB4
GetWindow.USER32(?,00000004), ref: 004B6DD1

Part of subcall function 004B9AA6: IsWindowEnabled.USER32(?), ref: 004B9AB0

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$EnabledLongRect
String ID:
API String ID: 3170195891-0
Opcode ID: 6a4ea9cfe5a71900bd443b60435e94059bc08514f1ddf875aae00d03e6efbc7c
Instruction ID: 7af4c1786fdb3f6e17c8d574e1fef4805783a2ed36b9b93c4c0abda28057f735
Opcode Fuzzy Hash: 6a4ea9cfe5a71900bd443b60435e94059bc08514f1ddf875aae00d03e6efbc7c
Instruction Fuzzy Hash: 480178346006059BDF21AB31C806FEF77AAAF14314F41485AE9419B291DB3CEE41CBAC

Function 004758B0 Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000100C,000000FF,00000002), ref: 004758E8
SendMessageA.USER32(?,0000100C,00000000,00000002), ref: 004758FD

Part of subcall function 004B3BE0: SendMessageA.USER32(?,0000102B,?,?), ref: 004B3C01

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 02d01e6d1548dbce2b29c760781cd251c038fde1c54831c78689247aa7b203a7
Instruction ID: a1c08bd6310306a612dab04ae7d50f2779ab74a4fef78de4e9c98e98babc2e8c
Opcode Fuzzy Hash: 02d01e6d1548dbce2b29c760781cd251c038fde1c54831c78689247aa7b203a7
Instruction Fuzzy Hash: 97F05BB234471177E530995A9C56F9BA39C9B84B61F008A1BB355EF2C1C5F5F900873C

Function 00476B40 Relevance: 3.0, APIs: 2, Instructions: 41threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,?,00000000,00000000,?), ref: 00476B6C
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,00000000,?), ref: 00476B94

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ChangeCloseCreateFindNotificationThread
String ID:
API String ID: 4060959955-0
Opcode ID: 163c7731a8730e8b6aeaecdb87a39967873d0df2eccfcdde4984c0f5e1b95208
Instruction ID: e4f6e0bc89d2c6a623cb978349024040a443ceac403f0f58c7b088ca8487f631
Opcode Fuzzy Hash: 163c7731a8730e8b6aeaecdb87a39967873d0df2eccfcdde4984c0f5e1b95208
Instruction Fuzzy Hash: 1BF06931704B119BD724CF28D880BABB3EAAF89711F01882EE45AC7280C7B0F8458B54

Function 004A9128 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004A39CE,00000001), ref: 004A9139

Part of subcall function 004A8FE0: GetVersionExA.KERNEL32 ref: 004A8FFF

HeapDestroy.KERNEL32 ref: 004A9178

Part of subcall function 004ACA25: HeapAlloc.KERNEL32(00000000,00000140,004A9161,000003F8), ref: 004ACA32

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 803620b1493c89dbe8fd5fd19cad40cacf86cdfc05bcd1c6ae0422a101aedc3a
Instruction ID: 58e4fa7e2d4a432bf0cb6b726ec1e156ff30ca38b9d7b2f7daffcbeb3d194f34
Opcode Fuzzy Hash: 803620b1493c89dbe8fd5fd19cad40cacf86cdfc05bcd1c6ae0422a101aedc3a
Instruction Fuzzy Hash: DEF065B1E583066AEF6157719C49B7A3994DBB6795F10482BF501C82B0EB688C81E509

Function 004B7943 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 004B796A
CallWindowProcA.USER32(?,?,?,?,?), ref: 004B797F

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ProcWindow$Call
String ID:
API String ID: 2316559721-0
Opcode ID: 0baa140d9e690ff9cd039b3150138eed1ede00856d4314b832f70ccfef115cad
Instruction ID: 84bf3739d90658b901df5818db11ae97c15d5be71b18f119a11077599c6f0e49
Opcode Fuzzy Hash: 0baa140d9e690ff9cd039b3150138eed1ede00856d4314b832f70ccfef115cad
Instruction Fuzzy Hash: C8F01536104208EFDF218F94DC08DDABBB9FF083A1B048429FA4986230D732E960AB54

Function 004B7578 Relevance: 3.0, APIs: 2, Instructions: 25threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004BF1AC: TlsGetValue.KERNEL32(00533A2C,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000,?,004B2B99,00000000,00000000,00000000,00000000), ref: 004BF1EB

GetCurrentThreadId.KERNEL32 ref: 004B759A
SetWindowsHookExA.USER32(00000005,004B7382,00000000,00000000), ref: 004B75AA

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CurrentHookThreadValueWindows
String ID:
API String ID: 933525246-0
Opcode ID: 9f337f0a0a10d354d4fb413371973667d7cb539f57e55fce4657107d523fd28f
Instruction ID: 3842ae5f294e1c24c25a2ab28f9174b2db193b4bdadb54645aeec0a0c5d9e9c3
Opcode Fuzzy Hash: 9f337f0a0a10d354d4fb413371973667d7cb539f57e55fce4657107d523fd28f
Instruction Fuzzy Hash: 44E06D71604700AED7309F66AC05BAB76E4EBC0B12F504A3FE14996680D638A9458F7D

Function 0040DEC0 Relevance: 1.6, APIs: 1, Instructions: 127windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,004E121C), ref: 0040DF97

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 13eb4f6496eed27eaaa13f348869ef1cea93e0831467f58af7745beb97b687d9
Instruction ID: cdefdc7f40b9da73b0983d3f3af4e54f56ec0ddf5a354e980b44b4eb3929abc0
Opcode Fuzzy Hash: 13eb4f6496eed27eaaa13f348869ef1cea93e0831467f58af7745beb97b687d9
Instruction Fuzzy Hash: 3E41C6B5A003019FD724CA55C880A6B73E5EB99324F50883EF846D7350E77DEC89CB96

Function 0041AE20 Relevance: 1.6, APIs: 1, Instructions: 125windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0041AF53

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d77b80b31d6230efe6afd6612defda18ce87e438645cfc37b236e443d114f79f
Instruction ID: d74434adc169072959fb06c15b59540463a5052ccc34b856dbb2766aa90723d2
Opcode Fuzzy Hash: d77b80b31d6230efe6afd6612defda18ce87e438645cfc37b236e443d114f79f
Instruction Fuzzy Hash: 3E41ACB6215701CFC360CF28D480B8AB7E5BB99304F10886EE596CB790D376E892CB55

Function 0040FDF1 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

LHashValOfNameSys.OLEAUT32(00000001,?,?), ref: 0040FE09

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: HashName
String ID:
API String ID: 1228541095-0
Opcode ID: d463438882d1ddc7e7dd2e65a067b002fc5a7d45096af94e543c40184cd8a221
Instruction ID: 0d14158c46f70d88fa25aa75c0d126c84dbf41a4492909a73adb9bfa2519e6f2
Opcode Fuzzy Hash: d463438882d1ddc7e7dd2e65a067b002fc5a7d45096af94e543c40184cd8a221
Instruction Fuzzy Hash: 13418DB1A002099FCB14DF95C884AEFB7B9FF88300F14416AE809EB351DB74AC85CB95

Function 004A5375 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 004A545C

Part of subcall function 004AB7E4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB821
Part of subcall function 004AB7E4: EnterCriticalSection.KERNEL32(?,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB83C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 087e5d2c42a1596c0fc9900d931337ac9e25a80f3d7b4a0077f39a6a2f1869cc
Instruction ID: 87a085b1fc08690f34a1f92e18f49faf0f7d508f6db4ffad739e89716806c220
Opcode Fuzzy Hash: 087e5d2c42a1596c0fc9900d931337ac9e25a80f3d7b4a0077f39a6a2f1869cc
Instruction Fuzzy Hash: C2213832A44A08ABCB10DF69DD42B9EB7B4EF26764F14411BF411EB2C1C7BC99818B5D

Function 0042C7D0 Relevance: 1.6, APIs: 1, Instructions: 77windowCOMMON

Download Yara Rule

APIs

DestroyIcon.USER32(?,?,?,00000000,00000400,?,?,?,?,004C1BA8,000000FF,0042657D,?,?,00000001), ref: 0042C851

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: DestroyIcon
String ID:
API String ID: 1234817797-0
Opcode ID: 288769db827adbeb185b24f30365d82b654c532ab73b93b9a0baec17c42d23ef
Instruction ID: af0c17d78dbfc4b1caa24f08de3222e5e57fd1951be43fb623a4d72fe74618a8
Opcode Fuzzy Hash: 288769db827adbeb185b24f30365d82b654c532ab73b93b9a0baec17c42d23ef
Instruction Fuzzy Hash: 6D2171B1500B109FC320EF1AC8C1A5BFBE4FB94721F548A2EF4A683790D7389444CB65

Function 0040E0B4 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(?,?,?,?,00002800), ref: 0040E14E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 811eddbb30c5a3afdc9075c364f93e0be3e4d2dda71a1b3fd4954263e3205cd5
Instruction ID: 749c06c4ce40c2e7c2fe181fc0f50faff86e6b687cfc7481a7c9b8c0b817133b
Opcode Fuzzy Hash: 811eddbb30c5a3afdc9075c364f93e0be3e4d2dda71a1b3fd4954263e3205cd5
Instruction Fuzzy Hash: 8E21D6B51003009BD310EB26DC41DABB3D8EF94748F004D3EF95ADB252EB38E859879A

Function 004B6EDF Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004B6EE4

Part of subcall function 004BF1AC: TlsGetValue.KERNEL32(00533A2C,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000,?,004B2B99,00000000,00000000,00000000,00000000), ref: 004BF1EB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: H_prologValue
String ID:
API String ID: 3700342317-0
Opcode ID: c8bc0e15e925f4a8241bede1c3112d15d6eda5c38626daec1c4d4ed96a2cbcb0
Instruction ID: caa6d6acd617a7d0f127dcfb45afb396b5cb633f98dfadc1dfbe8910953f3a31
Opcode Fuzzy Hash: c8bc0e15e925f4a8241bede1c3112d15d6eda5c38626daec1c4d4ed96a2cbcb0
Instruction Fuzzy Hash: 66216972A00209EFCF15DF54C881AEE7BB9FF44314F01406AF819AB241D779AE44CBA4

Function 004B7606 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,00000080,004491A1,?,?,?,?,?,?,?,?,?), ref: 004B76A4

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 03e6440eaeeb199509578c2c617990f078ffb6a382f4bcc17f62967802785abc
Instruction ID: 9561726801ae14c21e42eb382ff20db8df423693a3992f93604be57ee33581f7
Opcode Fuzzy Hash: 03e6440eaeeb199509578c2c617990f078ffb6a382f4bcc17f62967802785abc
Instruction Fuzzy Hash: EE31AC75A00219AFCF01DFA8C844ADEBBF1BF4C314B00406AF908E7320D735AA509FA4

Function 004BB120 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004BB125

Part of subcall function 004BAE88: __EH_prolog.LIBCMT ref: 004BAE8D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8a555d967e679d23c81b1fe13d08cd6131c939f55d3f19fd9ad7e495baf775f5
Instruction ID: 087f57bf1baf22394069d9899a93f8b5e01ed3a72817d9b44a07f4d7d73b1565
Opcode Fuzzy Hash: 8a555d967e679d23c81b1fe13d08cd6131c939f55d3f19fd9ad7e495baf775f5
Instruction Fuzzy Hash: CC11A275600700ABC730AF29C9A1AEBB7F4FF65398B10442EE45287641E7B8E901CBB4

Function 004B6E08 Relevance: 1.5, APIs: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B9917: GetWindowLongA.USER32(?,000000F0), ref: 004B9923

SendMessageA.USER32(?,0000036E,?,00000000), ref: 004B6E5C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 83198d916c6a35d0c43de2fdbf7d4192e573f927922860fb7576013934108ebd
Instruction ID: bda4a95b1bb6b269b9351b2a2186e05cae2a7fbac4f747cbdbd4e7ff470942a7
Opcode Fuzzy Hash: 83198d916c6a35d0c43de2fdbf7d4192e573f927922860fb7576013934108ebd
Instruction Fuzzy Hash: 2FF04F7A600209BFDF019F59C841AEEB7B9BF54754F10802BE901A7250DA78EE418BB4

Function 004B7156 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e033b6cd87310490416f84af7851f9123eec91c9dc03d175df1759f8ad2ff0b
Instruction ID: 85fe130acf4e634c680c69593f91767ab39bf5bc6d85e726280ee1c736708ab6
Opcode Fuzzy Hash: 4e033b6cd87310490416f84af7851f9123eec91c9dc03d175df1759f8ad2ff0b
Instruction Fuzzy Hash: BFF03036004619FBCF126F959C00DDF3B29AF55361F008417FA0956291C73DD962EBB9

Function 004BAE88 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004BAE8D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fd8bb22a8afdf0dc9477bb22d6c0e430d453c0289d7ac90ee89b1bbb09c8a87c
Instruction ID: 7507b38ad3ae37bab5a20ba1b4a43e444cc602b97d7443249561e80033f82b3d
Opcode Fuzzy Hash: fd8bb22a8afdf0dc9477bb22d6c0e430d453c0289d7ac90ee89b1bbb09c8a87c
Instruction Fuzzy Hash: D8E01A75E01208DFCB50EFA8D5456AEBBF4FB44314F10847FE405E2201E3358A028BA1

Function 0042B750 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00560000,00000000,?), ref: 0042B761

Part of subcall function 004230F0: wsprintfA.USER32 ref: 00423102

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: AllocateHeapwsprintf
String ID:
API String ID: 1352872168-0
Opcode ID: e5e118c0634272d56f7587d1957e2e577ae46a0dd74a383141485bcafa2ba3ee
Instruction ID: 77d654a66065db69b54b0964edaab829368ee9e4e10a7d5773f32138bb9b6b35
Opcode Fuzzy Hash: e5e118c0634272d56f7587d1957e2e577ae46a0dd74a383141485bcafa2ba3ee
Instruction Fuzzy Hash: 9CE046B9A00208EBDB00DFA4E941EAE77B8EB88340F008198FD084B240D675AE409B94

Function 0042B850 Relevance: 1.5, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00560000,00000000,00000000,00000000), ref: 0042B878

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5e2c172864a2cb61ddaa03fca8b4b9a041ed439119040ed25da919147944e109
Instruction ID: ef67971599a36a9a3accad31d29ca0967e19f72af6b88b18da5c670db0b2c8c3
Opcode Fuzzy Hash: 5e2c172864a2cb61ddaa03fca8b4b9a041ed439119040ed25da919147944e109
Instruction Fuzzy Hash: D9D01236700618ABD7149B99E949BAB37ACDB44345F808055FA0C4E290D774E840D7D4

Function 00477A00 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00477A00,?), ref: 00477A22

Part of subcall function 00477960: SetWindowLongA.USER32(?,000000FC,?), ref: 004779A8
Part of subcall function 00477960: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004779B1
Part of subcall function 00477960: HeapFree.KERNEL32(00000000), ref: 004779B8
Part of subcall function 00477960: RedrawWindow.USER32(?,00000000,00000000,00000705), ref: 004779C8

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: HeapWindow$ChildEnumFreeLongProcessRedrawWindows
String ID:
API String ID: 4238677917-0
Opcode ID: b21097f4c699deb0436b9df5ca0526230ec66f7814a5d6b6baeb2d097bbbb4ef
Instruction ID: 805e16ef92b9b9c69d030d35f008d3d22db49ecdcfe6655224eaac6e26389b4e
Opcode Fuzzy Hash: b21097f4c699deb0436b9df5ca0526230ec66f7814a5d6b6baeb2d097bbbb4ef
Instruction Fuzzy Hash: 77D05B3210D25053A6516619AC44EDF9668AFD5760F91C81BF048A311046587941C2AE

Function 004B3BE0 Relevance: 1.5, APIs: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000102B,?,?), ref: 004B3C01

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 352ef132ea4a33855a1ba710403a2e7270056e948061ccac58cf9fa6a2d45422
Instruction ID: 5fe238f61dbe2c320cd5b58e19b6aebee02bf3aecbf9d235717b28e69544fb71
Opcode Fuzzy Hash: 352ef132ea4a33855a1ba710403a2e7270056e948061ccac58cf9fa6a2d45422
Instruction Fuzzy Hash: CFD0677590020EAFCB41DF99D845CDEBBB9EB18304F108426F915A6250D671E5928F90

Function 004BAF91 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

LoadStringA.USER32(?,?,?,?), ref: 004BAFA8

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: cd16f1834dc075d6a8a856c88b4b7b1ce4688052e160e6416edef6736f9bff1c
Instruction ID: 86e40c8ba187f353b7d7c42b04921981efcf53e0f161b6b67d08bff21263aa71
Opcode Fuzzy Hash: cd16f1834dc075d6a8a856c88b4b7b1ce4688052e160e6416edef6736f9bff1c
Instruction Fuzzy Hash: 31D05E724083619B8B01DF518804DCFBBB8BF54210B040C0EF48043112C32494948676

Function 004B99AD Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,0042DEFA), ref: 004B99BB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c34a9c882fdebdffcc154bce9206bf7e4e07ec9901ac9513bd04e6da37b8277c
Instruction ID: 13f0424e97ef03a9b53af824ef3f60a536b62fc91648fc37d68e909a6e1a880d
Opcode Fuzzy Hash: c34a9c882fdebdffcc154bce9206bf7e4e07ec9901ac9513bd04e6da37b8277c
Instruction Fuzzy Hash: 87D09271208200AFCB898F60D948E5ABBB2BF94704B248569E54A8A225D736DC52EB15

Function 004B9A7F Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?,0041F36C,00000000), ref: 004B9A8D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: c5d4925c4251c131ce074510c0b9303c2ab49b5d16f46ac9d86a0086b6fa5ea8
Instruction ID: a173b3dfafe1adbcf0d0b9612ee85665d1b0aae690b2d46ad35cce2f14a4bc60
Opcode Fuzzy Hash: c5d4925c4251c131ce074510c0b9303c2ab49b5d16f46ac9d86a0086b6fa5ea8
Instruction Fuzzy Hash: EFD05230204200AFCB088F60C908E0ABBA2BFA8300B208468E10A8A120D732CC52EB09

Function 00471800 Relevance: 1.5, APIs: 1, Instructions: 11windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001009,00000000,00000000), ref: 0047181A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 94cf3b5aafee0eff6f46217b5cc4c25c3f7de682823e2f13ff51707bd4c6a359
Instruction ID: 678b9fd9482f9650a2dd17576fcd5e61aaaf3ce4be7da9f2a248a9f6862d42ef
Opcode Fuzzy Hash: 94cf3b5aafee0eff6f46217b5cc4c25c3f7de682823e2f13ff51707bd4c6a359
Instruction Fuzzy Hash: D0C08C70640300BBEDA4AB648C06F0A33A95B44718F018458B2096A1C2C5B4F0008A89

Non-executed Functions

Function 0043A740 Relevance: 89.0, APIs: 47, Strings: 3, Instructions: 1494windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 004BBD89: GetClipBox.GDI32(?,?), ref: 004BBD90

DPtoLP.GDI32 ref: 0043A85B
GetClientRect.USER32(?,?), ref: 0043A869
DPtoLP.GDI32(?,?,00000002), ref: 0043A881
IntersectRect.USER32(?,?,?), ref: 0043A920
LPtoDP.GDI32(?,?,00000002), ref: 0043A961
IntersectRect.USER32(?,?,?), ref: 0043A9BE
LPtoDP.GDI32(?,?,00000002), ref: 0043A9FF
CreateRectRgnIndirect.GDI32(?), ref: 0043AA2A
IntersectRect.USER32(?,?,?), ref: 0043AA5E
LPtoDP.GDI32(?,?,00000002), ref: 0043AA9F
CreateRectRgnIndirect.GDI32(?), ref: 0043AAC5
CreateRectRgnIndirect.GDI32(?), ref: 0043AAF4
GetCurrentObject.GDI32(?,00000006), ref: 0043AB10
GetCurrentObject.GDI32(?,00000001), ref: 0043AB29
GetCurrentObject.GDI32(?,00000002), ref: 0043AB42

Part of subcall function 004BBA48: SetBkMode.GDI32(?,?), ref: 004BBA61
Part of subcall function 004BBA48: SetBkMode.GDI32(?,?), ref: 004BBA6F

Part of subcall function 004B8837: GetScrollPos.USER32(00000000,?), ref: 004B8855

Part of subcall function 0043A370: CreateFontIndirectA.GDI32(00000000), ref: 0043A3C2

FillRgn.GDI32(?,?,?), ref: 0043AD22
IntersectRect.USER32(?,?,?), ref: 0043AE07
IsRectEmpty.USER32(?), ref: 0043AE12
LPtoDP.GDI32(?,?,00000002), ref: 0043AE2F
CreateRectRgnIndirect.GDI32(?), ref: 0043AE3A
CombineRgn.GDI32(?,?,?,00000004), ref: 0043AE6B
DPtoLP.GDI32(?,?,00000002), ref: 0043AE89

Part of subcall function 004BBB2F: SetMapMode.GDI32(?,?), ref: 004BBB48
Part of subcall function 004BBB2F: SetMapMode.GDI32(?,?), ref: 004BBB56

PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 0043AEC8
IntersectRect.USER32(?,?,?), ref: 0043AF5B
IsRectEmpty.USER32(?), ref: 0043AFA1
SelectObject.GDI32(?,?), ref: 0043AFDC
DPtoLP.GDI32(?,?,00000001), ref: 0043B068
LPtoDP.GDI32(?,?,00000001), ref: 0043B187
DPtoLP.GDI32(?,?,00000001), ref: 0043B1A5

Part of subcall function 004BBE5D: MoveToEx.GDI32(?,?,?,?), ref: 004BBE7F
Part of subcall function 004BBE5D: MoveToEx.GDI32(?,?,?,?), ref: 004BBE93

Part of subcall function 004BBEA9: MoveToEx.GDI32(?,?,?,00000000), ref: 004BBEC3
Part of subcall function 004BBEA9: LineTo.GDI32(?,?,?), ref: 004BBED4

Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,00000000), ref: 004BB98E
Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,?), ref: 004BB9A4

Part of subcall function 0043DA30: GetCurrentObject.GDI32(?), ref: 0043DAFB
Part of subcall function 0043DA30: LPtoDP.GDI32(?,00000000,00000001), ref: 0043DB48

IntersectRect.USER32(?,00000000,?), ref: 0043B2F2
IsRectEmpty.USER32(00000000), ref: 0043B2FD
PatBlt.GDI32(?,00000000,?,?,?,00F00021), ref: 0043B344
LPtoDP.GDI32(?,00000000,00000002), ref: 0043B359
CreateRectRgnIndirect.GDI32(00000000), ref: 0043B364
CombineRgn.GDI32(?,?,?,00000004), ref: 0043B395
LPtoDP.GDI32(?,?,00000001), ref: 0043B3C4
DPtoLP.GDI32(?,?,00000001), ref: 0043B3E2
wsprintfA.USER32 ref: 0043B480
SelectObject.GDI32(?,?), ref: 0043B4A8
IntersectRect.USER32(?,?,?), ref: 0043BA18
IsRectEmpty.USER32(?), ref: 0043BA23
LPtoDP.GDI32(?,?,00000002), ref: 0043BA40
CreateRectRgnIndirect.GDI32(?), ref: 0043BA4B
CombineRgn.GDI32(?,?,?,00000004), ref: 0043BA7C

Part of subcall function 0043D0F0: SetRectEmpty.USER32(?), ref: 0043D16A

Part of subcall function 0043D0F0: GetSysColor.USER32(0000000F), ref: 0043D29B
Part of subcall function 0043D0F0: IntersectRect.USER32(?,?,?), ref: 0043D2F3

GetSysColor.USER32(0000000F), ref: 0043AC06

Part of subcall function 004BC3D5: __EH_prolog.LIBCMT ref: 004BC3DA
Part of subcall function 004BC3D5: CreateSolidBrush.GDI32(?), ref: 004BC3F7

Part of subcall function 004BC385: __EH_prolog.LIBCMT ref: 004BC38A
Part of subcall function 004BC385: CreatePen.GDI32(?,?,?), ref: 004BC3AD

CreateRectRgnIndirect.GDI32(?), ref: 0043A986

Part of subcall function 0043BF40: CopyRect.USER32(?,00000000), ref: 0043BFB7
Part of subcall function 0043BF40: IsRectEmpty.USER32(?), ref: 0043BFC2
Part of subcall function 0043BF40: GetClientRect.USER32(00000000,?), ref: 0043C001
Part of subcall function 0043BF40: DPtoLP.GDI32(?,?,00000002), ref: 0043C013
Part of subcall function 0043BF40: LPtoDP.GDI32(?,?,00000002), ref: 0043C050

FillRect.USER32(?,?,?), ref: 0043BD79

Strings

!K, xrefs: 0043AD28, 0043BC38, 0043BD7F
EK, xrefs: 0043A96E, 0043AA0C, 0043AAAC, 0043B9BC
0b)u, xrefs: 0043A986, 0043AA17, 0043AE3A, 0043B364, 0043BA4B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Create$IndirectIntersectObject$Empty$CurrentModeSelect$CombineH_prologMove$ClientColorFill$BeginBrushClipCopyFontLinePaintScrollSolidwsprintf
String ID: !K$0b)u$EK
API String ID: 3726329589-1513951853
Opcode ID: fbcc4a55516b34ff3ba297e91bcb38b57e048947fec19a7b96c52b87871001db
Instruction ID: 93cb47bc0c08f3ffcfc7ba512d51c864bdd8152a6d8880d703ee4fb8e8e6c3eb
Opcode Fuzzy Hash: fbcc4a55516b34ff3ba297e91bcb38b57e048947fec19a7b96c52b87871001db
Instruction Fuzzy Hash: AFD227712083859FD324DF65C895FAFB7E9EBC8704F00491EF68A83251DB74A905CBA6

Function 0044D7F0 Relevance: 32.8, Strings: 26, Instructions: 305COMMON

Download Yara Rule

Strings

invalid rendering intent, xrefs: 0044D8BD
rncs, xrefs: 0044DA7D
unexpected NamedColor ICC profile class, xrefs: 0044DA6A
Gray color space not permitted on RGB PNG, xrefs: 0044D9D4
BGR, xrefs: 0044D985
caps, xrefs: 0044DA84
ZYX, xrefs: 0044DAC7
baL, xrefs: 0044DAC0
tag count too large, xrefs: 0044DAF4
knil, xrefs: 0044DA20
intent outside defined range, xrefs: 0044D8DF
invalid ICC profile color space, xrefs: 0044D990
rtnm, xrefs: 0044DA27
rtrp, xrefs: 0044DA76
invalid embedded Abstract ICC profile, xrefs: 0044DA51
PCS illuminant is not D50, xrefs: 0044D944
unrecognized ICC profile class, xrefs: 0044DA8B
invalid signature, xrefs: 0044D91F
lcmn, xrefs: 0044DA10
YARG, xrefs: 0044D97E
unexpected DeviceLink ICC profile class, xrefs: 0044DA34
unexpected ICC PCS encoding, xrefs: 0044DACE
RGB color space not permitted on grayscale PNG, xrefs: 0044D9B0
length does not match profile, xrefs: 0044D829
tsba, xrefs: 0044DA19
psca, xrefs: 0044D918

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: BGR$ ZYX$ baL$Gray color space not permitted on RGB PNG$PCS illuminant is not D50$RGB color space not permitted on grayscale PNG$YARG$caps$intent outside defined range$invalid ICC profile color space$invalid embedded Abstract ICC profile$invalid rendering intent$invalid signature$knil$lcmn$length does not match profile$psca$rncs$rtnm$rtrp$tag count too large$tsba$unexpected DeviceLink ICC profile class$unexpected ICC PCS encoding$unexpected NamedColor ICC profile class$unrecognized ICC profile class
API String ID: 0-319498373
Opcode ID: 70a91e9758681da49a43c10027eec337e30d008ed4f0dce50c33fcdea4f1a846
Instruction ID: 249f06e3968720c8c777c23974950c44659a7929e2f245b70c2d1fe7c7534faa
Opcode Fuzzy Hash: 70a91e9758681da49a43c10027eec337e30d008ed4f0dce50c33fcdea4f1a846
Instruction Fuzzy Hash: 71916CE3F0819027FB08DE2D9C92A777B95DBC9305F1D84AAF884DA306E519C50583A9

Function 00424FC0 Relevance: 23.6, APIs: 8, Strings: 5, Instructions: 865COMMON

Download Yara Rule

Strings

`mP, xrefs: 004253F8
`mP, xrefs: 00425087
`mP, xrefs: 0042598D, 00425991
`mP, xrefs: 00425BA8, 00425BAE
`mP, xrefs: 00425A87

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: wsprintf
String ID: `mP$`mP$`mP$`mP$`mP
API String ID: 2111968516-3884641827
Opcode ID: 65d769361f88b1751ec1b22e503a18c5f0b002f20c9c309699b920b07f8072e1
Instruction ID: 1811c3892e047497ca9c58e203a566edd2c4825e6fc76097daf1057d4133bd1f
Opcode Fuzzy Hash: 65d769361f88b1751ec1b22e503a18c5f0b002f20c9c309699b920b07f8072e1
Instruction Fuzzy Hash: 9A62E271704B219FC724DF25E880A6BB7E5AFC4314F54492EF88A97341EA38EC458B5A

Function 0042AF20 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 93libraryloaderwindowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042AF2C
IsZoomed.USER32(?), ref: 0042AF3A
LoadLibraryA.KERNEL32(User32.dll,00000003,00000009), ref: 0042AF64
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042AF77
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042AF85
FreeLibrary.KERNEL32(00000000), ref: 0042AFBB
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0042AFD1
IsWindow.USER32(?), ref: 0042AFFE
ShowWindow.USER32(?,00000005,?,?,?,?,00000004), ref: 0042B00B

Strings

MonitorFromWindow, xrefs: 0042AF71
GetMonitorInfoA, xrefs: 0042AF7D
H, xrefs: 0042AFA8
User32.dll, xrefs: 0042AF59

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: AddressLibraryProcWindow$FreeIconicInfoLoadParametersShowSystemZoomed
String ID: GetMonitorInfoA$H$MonitorFromWindow$User32.dll
API String ID: 447426925-661446951
Opcode ID: 2d1b60cfd7488bf0c756ed509778e8f72ab2516f17c72e8e73907c8e04e72521
Instruction ID: 3b96bc23e96c9b6df38971a90167570e32b049f9a3bc412aaa1557a30dc06eaa
Opcode Fuzzy Hash: 2d1b60cfd7488bf0c756ed509778e8f72ab2516f17c72e8e73907c8e04e72521
Instruction Fuzzy Hash: 48316D71300711AFD710AF619C49F2FB7A9AB84B45F40842DFE05A7290DBB8EC45876A

Function 00423AD0 Relevance: 18.3, APIs: 12, Instructions: 273windowthreadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00423AF5
IsWindow.USER32(00010456), ref: 00423B11
SendMessageA.USER32(00010456,000083E7,?,00000000), ref: 00423B2A
ExitProcess.KERNEL32 ref: 00423B3F
FreeLibrary.KERNEL32(?), ref: 00423C23
FreeLibrary.KERNEL32 ref: 00423C77
DestroyIcon.USER32(00000000), ref: 00423CC7
DestroyIcon.USER32(00000000), ref: 00423CDE
IsWindow.USER32(00010456), ref: 00423CF5
DestroyIcon.USER32(?,00000001,00000000,000000FF), ref: 00423DA4
WSACleanup.WS2_32 ref: 00423DEF

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: DestroyIcon$FreeLibraryWindow$CleanupCurrentExitMessageProcessSendThread
String ID:
API String ID: 3816745216-0
Opcode ID: 159844f1dac720bc624169fe19cc6f0c211cc7a5c7ccabc5fb61b676a7e749a6
Instruction ID: 445002f5a0222a1c3f1fbae1ad020b81704996e2ed6b84c142a0e29784c6d984
Opcode Fuzzy Hash: 159844f1dac720bc624169fe19cc6f0c211cc7a5c7ccabc5fb61b676a7e749a6
Instruction Fuzzy Hash: 9EB16A70310B119BD724DF25D8D5BABB7F5AF48305F80452EE5AA87291CB38BA81CB58

Function 00426B30 Relevance: 15.4, APIs: 10, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a08876c2b9b44e7887080c10e4080855483ad5add3308eb5f31263f04c491b
Instruction ID: 0d507b852649c53f385b6e352dc519f0a32763d3a3e09febe39363cec4fe9fef
Opcode Fuzzy Hash: e3a08876c2b9b44e7887080c10e4080855483ad5add3308eb5f31263f04c491b
Instruction Fuzzy Hash: 5FC1E1767046288FD310EF29FC81A6BB3A5FB84314F90492FE446C7342DB3AE9558799

Function 004B6785 Relevance: 13.6, APIs: 9, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004B678A
FindResourceA.KERNEL32(?,00000000,00000005), ref: 004B67C2
LoadResource.KERNEL32(?,00000000,?,?,?,00000000), ref: 004B67CA

Part of subcall function 004B75C4: UnhookWindowsHookEx.USER32(?), ref: 004B75E9

LockResource.KERNEL32(?,?,00000000,?,?,?,00000000), ref: 004B67D7
IsWindowEnabled.USER32(?), ref: 004B680A
EnableWindow.USER32(?,00000000), ref: 004B6818
EnableWindow.USER32(?,00000001), ref: 004B68A6
GetActiveWindow.USER32 ref: 004B68B1
SetActiveWindow.USER32(?,?,?,00000000,?,?,?,00000000), ref: 004B68BF

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$Resource$ActiveEnable$EnabledFindH_prologHookLoadLockUnhookWindows
String ID:
API String ID: 401145483-0
Opcode ID: 0584601d35e366ad6fb91b4a5dd4ccdb21698dcab7a9fe8b9bcc9d40c7dfaaac
Instruction ID: a1766c88beabff59e3fc2b229e080a3dd575789a9bde7aa9a57986127cddbae0
Opcode Fuzzy Hash: 0584601d35e366ad6fb91b4a5dd4ccdb21698dcab7a9fe8b9bcc9d40c7dfaaac
Instruction Fuzzy Hash: D6419170900A14EFCF21AB65C849AEEBBB5FF84715F11052FE501A2291CB7D6D41CB7A

Function 0043FAE0 Relevance: 12.1, APIs: 8, Instructions: 88clipboardmemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000042,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043FB57
GlobalLock.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043FB73
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043FB95
OpenClipboard.USER32(00000000), ref: 0043FB9D
GlobalFree.KERNEL32(00000000), ref: 0043FBA9
EmptyClipboard.USER32 ref: 0043FBB1
SetClipboardData.USER32(0000C1BF,00000000), ref: 0043FBC3
CloseClipboard.USER32 ref: 0043FBC9

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyFreeLockOpenUnlock
String ID:
API String ID: 453615576-0
Opcode ID: 500f3d2652b0ba9695825897ad39719639d22f2cd5bd01723494372afe895ebb
Instruction ID: 8e0b9596635a07aadb19695e02951a90d8035ebc571b692d1f8ca20d3e03bc2b
Opcode Fuzzy Hash: 500f3d2652b0ba9695825897ad39719639d22f2cd5bd01723494372afe895ebb
Instruction Fuzzy Hash: 9831B1B1204601AFC354EB65DC55F6FB7E9EB88710F405A3EF85283290DB78E844CB65

Function 004B60FD Relevance: 12.1, APIs: 8, Instructions: 72stringfileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004B6102
GetFullPathNameA.KERNEL32(?,00000104,?,?,?,?), ref: 004B6120
lstrcpynA.KERNEL32(?,?,00000104), ref: 004B612F
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,?), ref: 004B6163
CharUpperA.USER32(?), ref: 004B6174
FindFirstFileA.KERNEL32(?,?), ref: 004B618A
FindClose.KERNEL32(00000000), ref: 004B6196
lstrcpyA.KERNEL32(?,?), ref: 004B61A6

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Find$CharCloseFileFirstFullH_prologInformationNamePathUpperVolumelstrcpylstrcpyn
String ID:
API String ID: 304730633-0
Opcode ID: 9597dcb96dffa1f58ccce05e7cc0e1d7a04bfdc1d94a792ebeda74713d3a3016
Instruction ID: e60f813052158d7ca69ed5ebd1adf93517982bc36dd39bf2dadd8c58c53b702e
Opcode Fuzzy Hash: 9597dcb96dffa1f58ccce05e7cc0e1d7a04bfdc1d94a792ebeda74713d3a3016
Instruction Fuzzy Hash: 1E219271901018BBCB209F69DC08EEFBFBCEF56365F004126F819E61A1D7789A45CBA4

Function 00419130 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B541C: InterlockedIncrement.KERNEL32(-000000F4), ref: 004B5431

FindFirstFileA.KERNEL32(?,?,*.*), ref: 004191CA

Part of subcall function 004B2CCF: __EH_prolog.LIBCMT ref: 004B2CD4

Part of subcall function 004B56A7: InterlockedDecrement.KERNEL32(-000000F4), ref: 004B56BB

SendMessageA.USER32 ref: 00419270
FindNextFileA.KERNEL32(?,00000010), ref: 0041927C
FindClose.KERNEL32(?), ref: 0041928F
SendMessageA.USER32(?,00001102,00000002,?), ref: 004192A1

Strings

*.*, xrefs: 004191B2

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Find$FileInterlockedMessageSend$CloseDecrementFirstH_prologIncrementNext
String ID: *.*
API String ID: 2486832813-438819550
Opcode ID: eedd4188243a541046b4bf212e4cac43af1761da1ec21d3d059e548ab988456c
Instruction ID: 34a19e38a63fb2996ec934935be1eca7cfa37b5498ef22509533e03f4d92d72c
Opcode Fuzzy Hash: eedd4188243a541046b4bf212e4cac43af1761da1ec21d3d059e548ab988456c
Instruction Fuzzy Hash: 1B41AE71104381ABC314DF61C851FDFB7E8AB94714F008E1EF99587290DBB9A944CB6A

Function 0043FC40 Relevance: 10.6, APIs: 7, Instructions: 89clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0043FC6D
GetClipboardData.USER32(0000C1BF), ref: 0043FC86
CloseClipboard.USER32 ref: 0043FC92
GlobalSize.KERNEL32(00000000), ref: 0043FCC8
GlobalLock.KERNEL32(00000000,00000000,?,?), ref: 0043FCD0
GlobalUnlock.KERNEL32(00000000), ref: 0043FCE8
CloseClipboard.USER32 ref: 0043FCEE

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Clipboard$Global$Close$DataLockOpenSizeUnlock
String ID:
API String ID: 2237123812-0
Opcode ID: d8260b99f7a14275097b7ce763479bec238f44d9139f4df764db48800f1227d6
Instruction ID: 52fb68c6d5033a041a3f23947bd0169baca736f664f3dc8cf9a46e4a82228011
Opcode Fuzzy Hash: d8260b99f7a14275097b7ce763479bec238f44d9139f4df764db48800f1227d6
Instruction Fuzzy Hash: C8218071700206ABD714AB65E848E7FB7E9EF88354F04153AF906C3250EB68ED4987A6

Function 004782B0 Relevance: 10.6, APIs: 7, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,00000000), ref: 004782C0
GetWindowDC.USER32(?,?,?), ref: 004782C9
CreateCompatibleDC.GDI32(00000000), ref: 004782D3
SetBkMode.GDI32(00000000,00000001), ref: 004782DF
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0047831B
SelectObject.GDI32(?,00000000), ref: 00478329
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00478365

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CompatibleCreateWindow$BitmapModeObjectRectSelect
String ID:
API String ID: 1095011300-0
Opcode ID: f29c095417e09e7d655d1415c1471688311580f9cce02f588acfc9c7570c7837
Instruction ID: d470da0d48a7d4c2a09e0a175b02f97f1e770cc860735c65a595178bd2e4b46e
Opcode Fuzzy Hash: f29c095417e09e7d655d1415c1471688311580f9cce02f588acfc9c7570c7837
Instruction Fuzzy Hash: C321C3B5600B01AFD364DF69D988F6BB7E9AB88700F10891DF59AC3650DB70F8848B65

Function 0045024D Relevance: 10.5, Strings: 8, Instructions: 498COMMON

Download Yara Rule

Strings

rgb color-map: too few entries, xrefs: 0045045C
bad data option (internal error), xrefs: 004509E8
rgb[gray] color-map: too few entries, xrefs: 004502CF
rgb[ga] color-map: too few entries, xrefs: 00450294
rgb+alpha color-map: too few entries, xrefs: 00450497
bad background index (internal error), xrefs: 00450ADF
color map overflow (BAD internal error), xrefs: 00450A39
rgb-alpha color-map: too few entries, xrefs: 00450552

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: bad background index (internal error)$bad data option (internal error)$color map overflow (BAD internal error)$rgb color-map: too few entries$rgb+alpha color-map: too few entries$rgb-alpha color-map: too few entries$rgb[ga] color-map: too few entries$rgb[gray] color-map: too few entries
API String ID: 0-1509944728
Opcode ID: 4c2ba1cb28bccefdf0d3c61e663d19a10ab3bc29bcab768b97416fa5fd1e78ef
Instruction ID: ff3167dbb4c6ffcf49cfe82a4b0b34ee482d06c1f2506dc9914ef6579f7b98c3
Opcode Fuzzy Hash: 4c2ba1cb28bccefdf0d3c61e663d19a10ab3bc29bcab768b97416fa5fd1e78ef
Instruction Fuzzy Hash: 1A02F276604341ABE314DB14C881BABB7E5EBD430AF14052EFC8497383D7B9E849C79A

Function 00452120 Relevance: 8.0, Strings: 6, Instructions: 536COMMON

Download Yara Rule

Strings

unexpected 8-bit transformation, xrefs: 00452199
unexpected compose, xrefs: 00452164
unknown interlace type, xrefs: 004521B7
lost rgb to gray, xrefs: 00452150
lost/gained channels, xrefs: 00452180
unexpected bit depth, xrefs: 004521F3

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: lost rgb to gray$lost/gained channels$unexpected 8-bit transformation$unexpected bit depth$unexpected compose$unknown interlace type
API String ID: 0-3614292578
Opcode ID: 09d48c41c3d255ea39b10c4da76ba86b44b305f10660295607ab9e60786cef5c
Instruction ID: 0a15706584a19976d7bad17d27c2a112f99c0f4a93ceda9ae692ccfe14b2d43d
Opcode Fuzzy Hash: 09d48c41c3d255ea39b10c4da76ba86b44b305f10660295607ab9e60786cef5c
Instruction Fuzzy Hash: EB12C4756083418BC714CF28C98066BB7E2BBD9305F44493FFD8997382D679E94ACB4A

Function 004A356F Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

MonitorFromWindow.USER32(?,?), ref: 004A3584

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: FromMonitorWindow
String ID:
API String ID: 721739931-0
Opcode ID: fcd30337d0a215c29fefe8a128703d0ad9734691c91a11bd5abd4f9c85ce25d9
Instruction ID: 3b2b95dab2bdb948e075257727e1e53d10678d2de26842fe33f470f24f46ce28
Opcode Fuzzy Hash: fcd30337d0a215c29fefe8a128703d0ad9734691c91a11bd5abd4f9c85ce25d9
Instruction Fuzzy Hash: 2EF0A931A04108FBCF419F65CC04AAE7B78AF2538AB444022F805C1120FB38DB56EB59

Function 0045A780 Relevance: 5.5, Strings: 4, Instructions: 485COMMON

Download Yara Rule

Strings

internal row logic error, xrefs: 0045A7C5
invalid user transform pixel depth, xrefs: 0045A9F9
internal row size calculation error, xrefs: 0045A7FB
internal row width error, xrefs: 0045A80D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: internal row logic error$internal row size calculation error$internal row width error$invalid user transform pixel depth
API String ID: 0-64619857
Opcode ID: 93fcab6814bdb2948eed995694e4accf0823b30ad7b36e07260b590cf71b1c0c
Instruction ID: 6f4737c25a2c74ddced4599b40433f2a7c1bd8035474e96b9909254cc192b839
Opcode Fuzzy Hash: 93fcab6814bdb2948eed995694e4accf0823b30ad7b36e07260b590cf71b1c0c
Instruction Fuzzy Hash: 03F117326083554FCB25DE2895902BFBBD2ABC5302F584A6FDC8587303E6299C5EC797

Function 004507B2 Relevance: 5.2, Strings: 4, Instructions: 245COMMON

Download Yara Rule

Strings

bad data option (internal error), xrefs: 004509E8
palette color-map: too few entries, xrefs: 00450830
bad background index (internal error), xrefs: 00450ADF
color map overflow (BAD internal error), xrefs: 00450A39

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: bad background index (internal error)$bad data option (internal error)$color map overflow (BAD internal error)$palette color-map: too few entries
API String ID: 0-3263629853
Opcode ID: 86eae95c9da0b0c069e5e457f4938dd8b9490e3f00d9433c880f44a31ecd848c
Instruction ID: 2d1afc5d96d2c6a907427ae6ca1e435f9039a88d5f702c10d0ef57d6afaa0776
Opcode Fuzzy Hash: 86eae95c9da0b0c069e5e457f4938dd8b9490e3f00d9433c880f44a31ecd848c
Instruction Fuzzy Hash: D28112B56083419FD318CF18C890AAFB7E5EFC8305F54452EF88587352D279EC49879A

Function 004B005F Relevance: 4.7, APIs: 3, Instructions: 207timeCOMMON

Download Yara Rule

APIs

Part of subcall function 004AB7E4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB821
Part of subcall function 004AB7E4: EnterCriticalSection.KERNEL32(?,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB83C

Part of subcall function 004AB845: LeaveCriticalSection.KERNEL32(?,004A5442,00000009,004A542E,00000000,?,00000000,00000000,00000000), ref: 004AB852

GetTimeZoneInformation.KERNEL32(0000000C,?,?,?,0000000B,0000000B,?,004B0050,004AFE06,?,?,?,?,004A66AE,?,?), ref: 004B00AD
WideCharToMultiByte.KERNEL32(00000220,00534044,000000FF,0000003F,00000000,?,?,004B0050,004AFE06,?,?,?,?,004A66AE,?,?), ref: 004B0143
WideCharToMultiByte.KERNEL32(00000220,00534098,000000FF,0000003F,00000000,?,?,004B0050,004AFE06,?,?,?,?,004A66AE,?,?), ref: 004B017C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalSection$ByteCharMultiWide$EnterInformationInitializeLeaveTimeZone
String ID:
API String ID: 3442286286-0
Opcode ID: 490ecdfb50ed44bdaab61e5e961ac4313cb7ba9b462d75374835130d0e47170c
Instruction ID: d9e9534ca06020cbd539bffd475c8d09950dcfbd219e99380fceb4d293b0f1cc
Opcode Fuzzy Hash: 490ecdfb50ed44bdaab61e5e961ac4313cb7ba9b462d75374835130d0e47170c
Instruction Fuzzy Hash: 3D614A715041009ED72DAF18AC49FAB3BE4E712350F14017FE158973A1C7789DAADB6E

Function 004A65E0 Relevance: 4.6, APIs: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004A65ED
GetSystemTime.KERNEL32(?), ref: 004A65F7
GetTimeZoneInformation.KERNEL32(?), ref: 004A664C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Time$InformationLocalSystemZone
String ID:
API String ID: 2475273158-0
Opcode ID: 6d3f3e3b45322e28ba8a4a541fd8bf2733585bdcb6c592025d0e75440262e02e
Instruction ID: 2a6d7549a8b2e2e25737c8ffeb1f69cf3189407a8aff69c8238683348f43ab70
Opcode Fuzzy Hash: 6d3f3e3b45322e28ba8a4a541fd8bf2733585bdcb6c592025d0e75440262e02e
Instruction Fuzzy Hash: 9E219269800106A6CB20AF98D948BFF77B9AF26714F450512FD11E6290E73C8DC6D778

Function 0042BA50 Relevance: 4.5, APIs: 3, Instructions: 49keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 0042BA81
GetKeyState.USER32(00000010), ref: 0042BA96
GetKeyState.USER32(00000012), ref: 0042BAAB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: dfaa7884f0083e7f690176dfe5db0578c0d94df7297fb697b7a8940d635abd9a
Instruction ID: c8ddd37e3bbc70eca8f352e932ee0810af7009d438b37227c4c9a988092d136c
Opcode Fuzzy Hash: dfaa7884f0083e7f690176dfe5db0578c0d94df7297fb697b7a8940d635abd9a
Instruction Fuzzy Hash: EC01AD1AF042B985EA2416A8B809BF677518B60B50FDA41B3C94C37291878D0CC623EA

Function 004BA7D4 Relevance: 4.5, APIs: 3, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 004BA7FB
GetKeyState.USER32(00000011), ref: 004BA804
GetKeyState.USER32(00000012), ref: 004BA80D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: 70abb25f619d50cafaf9762464bfaed8922c58f838bf4bf8f0f0b724442c6644
Instruction ID: 134a6f676f1d9ec41be7c84025e3f22cfa7c97b98573b6ccdde1575a1d3fb563
Opcode Fuzzy Hash: 70abb25f619d50cafaf9762464bfaed8922c58f838bf4bf8f0f0b724442c6644
Instruction Fuzzy Hash: F1E09B39500259DDEF4072419908FDD76905F08B98F00C467E644AB592C6A898B397FF

Function 00436A20 Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,4004667F,?), ref: 00436A52
recvfrom.WS2_32(00000000,00000000,?,00000000,00000000,00000000), ref: 00436AA0

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ioctlsocketrecvfrom
String ID:
API String ID: 217199969-0
Opcode ID: 7b296f32f88cdcda1dc62dc014adb962d191d461af497f3d0d9030984bf6a875
Instruction ID: f67c06e8b2b9fec89436b371d80164bfc1e59f88705c1f0d321be9a28fc685a5
Opcode Fuzzy Hash: 7b296f32f88cdcda1dc62dc014adb962d191d461af497f3d0d9030984bf6a875
Instruction Fuzzy Hash: D6214F75104602ABD314EF24C945F6BB7E4AF88714F108A1EF49A972D0DB78EC85CB59

Function 00450D10 Relevance: 2.9, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

bad encoding (internal error), xrefs: 00450EBD
color-map index out of range, xrefs: 00450D5F

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: bad encoding (internal error)$color-map index out of range
API String ID: 0-7351992
Opcode ID: 7b20135aac5d53f3d73256476e50e5f85ff7207c867be2ddabc5174590dc62ff
Instruction ID: ef58db386566e766dad7a438658d897a5dfbafd94fcc337cb23fb8fb3a845afc
Opcode Fuzzy Hash: 7b20135aac5d53f3d73256476e50e5f85ff7207c867be2ddabc5174590dc62ff
Instruction Fuzzy Hash: 0BF1E476A083028BC718DF29C89166AB3D1FBD8305F054A7EEC9AD7351D638E909CB95

Function 0044DB20 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

ICC profile tag outside profile, xrefs: 0044DC38
ICC profile tag start not a multiple of 4, xrefs: 0044DBE9

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: ICC profile tag outside profile$ICC profile tag start not a multiple of 4
API String ID: 0-2051163487
Opcode ID: 87e00c8406ee3634965cf02395cc7523bc3ed27874502ea390ce68deb0de7393
Instruction ID: c12398e3d30749d5d86f481eb45ba9724c6e158a9e8d541ac8714ac7863eb606
Opcode Fuzzy Hash: 87e00c8406ee3634965cf02395cc7523bc3ed27874502ea390ce68deb0de7393
Instruction Fuzzy Hash: 0A31F3B3B0879107E71CDA2D5CA06A7BBD3ABC8244F1DC96DE4DAC3301E864A505C758

Function 004481C0 Relevance: 2.5, APIs: 1, Instructions: 1006COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bb263fed986227b6ef32358c02b9e2a5a9a3e4e3f22f7e6d1ccb5e913cbae7
Instruction ID: 86a4c7486a4305aa0f071381030fa826bf66871eb63ec8360108bb2986abc4b4
Opcode Fuzzy Hash: 48bb263fed986227b6ef32358c02b9e2a5a9a3e4e3f22f7e6d1ccb5e913cbae7
Instruction Fuzzy Hash: 59926871604B418FE329CF29C4906ABFBE2EF99304F24892ED5DB87B51DA34B845CB45

Function 00470A30 Relevance: 1.6, Strings: 1, Instructions: 334COMMON

Download Yara Rule

Strings

4N, xrefs: 00470D76

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: 4N
API String ID: 0-311606650
Opcode ID: 13b6631d4630b45304af14c16c627782399e78e1bf22bca9fa2ca4491d655a13
Instruction ID: e7b5800396e07c62e6c325428ccbc7cfc95c901501a2a0a16587d347464a96e6
Opcode Fuzzy Hash: 13b6631d4630b45304af14c16c627782399e78e1bf22bca9fa2ca4491d655a13
Instruction Fuzzy Hash: 62C1DF71A097518FC718CF2DD59016AFBE2FB98310F198A6EE8DA93741C774A805CB89

Function 0044A2C0 Relevance: .9, Instructions: 903COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001e5f98e01f343688f1f4a40c646c6cf60b39d2f685159afc147662c4238f6e
Instruction ID: f6c0c079e8c98f012e555f220d95af3e6443879f2fcc065cca0ccf04975757b5
Opcode Fuzzy Hash: 001e5f98e01f343688f1f4a40c646c6cf60b39d2f685159afc147662c4238f6e
Instruction Fuzzy Hash: FC52DA367487095BD308CE9ACC9159EF3D3ABC8314F498A3CE955C3346EEB8ED0A8655

Function 00464D4E Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7d75d7a36f4031a79c0d25b6cfd7052b2668509a128308978e66474c96f5b3
Instruction ID: 25092846ddc8e3cf3d8e1674f92c15e4dbdd2c545c2f598152125546a5f88fe1
Opcode Fuzzy Hash: 5c7d75d7a36f4031a79c0d25b6cfd7052b2668509a128308978e66474c96f5b3
Instruction Fuzzy Hash: 7F1270B16047018FCB18CF19D99062BBBE6EFC9700F14896EE8898B345E774ED45CB96

Function 00464F9E Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e733ad131aad04d9e20f7e731a6825663d974cbebbd864102e05df5db40461
Instruction ID: d47b49799f5ed1a916b8252dedfc4d8529c735e54c12b0ec473d9b28bcedce7f
Opcode Fuzzy Hash: b7e733ad131aad04d9e20f7e731a6825663d974cbebbd864102e05df5db40461
Instruction Fuzzy Hash: 201270B16047018FCB18CF19D99062BBBE6EFC9700F14896EE8898B345E774ED45CB96

Function 0046CBF0 Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9e148aade188e509ef5b85ed7300b4d5bae1e0ae1d29337091a805405e9e4f
Instruction ID: 01b33a1aadab9cfe32c9f3c65ab850a28fc23e1fb2f5234f25916493f2ffc0f5
Opcode Fuzzy Hash: ff9e148aade188e509ef5b85ed7300b4d5bae1e0ae1d29337091a805405e9e4f
Instruction Fuzzy Hash: 72120AB4B087018FC708CF29D594A2ABBE1FB88314F14896EE49AC7751E734E945CF5A

Function 004B163D Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44700af83111c2bf6df53a807408527aed4aed6a86fa766c2ad534030a4dd467
Instruction ID: 7499ebde91076b7cf30a6ed1b261bddc40203703403537acf6004ef0345ae13b
Opcode Fuzzy Hash: 44700af83111c2bf6df53a807408527aed4aed6a86fa766c2ad534030a4dd467
Instruction Fuzzy Hash: 28E1E171E55249DFEB258E64C8717FE77B1BB14340FA8002BD401E72A1D77C9A82CB29

Function 0045F150 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08657e54aea992d857d123e8f46ac34acce9810103a6cfba9da3bcbf38ac3d2
Instruction ID: e1d3752fb34ac42ed4ce8d5d269efccc8ff7543d75ec171aac29e4eedff01616
Opcode Fuzzy Hash: f08657e54aea992d857d123e8f46ac34acce9810103a6cfba9da3bcbf38ac3d2
Instruction Fuzzy Hash: C2C1242520E6824FDB198EAC94E92BBFFD1DB6A311B0881FED9D5CB323D525840EC355

Function 0045F850 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7d6e5bdf9180fc249a7cdffd82ac3d4432134ef2b1545fd9ebd85a9bab015f
Instruction ID: 9b8b36354c82df944d7667a1f9b425b76701fbc5e419c622126007be3dd6aa54
Opcode Fuzzy Hash: bd7d6e5bdf9180fc249a7cdffd82ac3d4432134ef2b1545fd9ebd85a9bab015f
Instruction Fuzzy Hash: 41D1B96150D6D28BD722CE2884A03A7FFD1AFA6305F188AEED8D44F347D269984DC357

Function 0046E8E0 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4bfdb248b3fb90f8076a3fe4a1e75f7bd1b50aa5aafde52d762773f77742459
Instruction ID: d32a9ce76f5ac16744bcc32b58e1f3caa66a12d5c8b2782eccdc3c7c9486cc90
Opcode Fuzzy Hash: d4bfdb248b3fb90f8076a3fe4a1e75f7bd1b50aa5aafde52d762773f77742459
Instruction Fuzzy Hash: 10F1BD765082418FC309CF18D5989E27BE2FFA8714B1F42FAD44A9B363D7369841CB96

Function 004570C0 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f492b554109c666d3f01e677f6b3c0c4980e36121065eeb4fe684823ca5fc740
Instruction ID: b546d549841d3ee206db9806d99b2c416446500d0fb4bc99fadb91d1389518d5
Opcode Fuzzy Hash: f492b554109c666d3f01e677f6b3c0c4980e36121065eeb4fe684823ca5fc740
Instruction Fuzzy Hash: E5E1F7B5604A018FD334CF19D490A22FBF2EF89311B25C96ED89ACB762D735E846CB54

Function 0045DC30 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcdb0e9a48f9cc5b8454a5ea312c92bd26660b050e477f45892fe8a81102f325
Instruction ID: 189e2a0af3454f957987072dc1bfc8f5acae826aecbdcbe8dde4a7e1589293cd
Opcode Fuzzy Hash: dcdb0e9a48f9cc5b8454a5ea312c92bd26660b050e477f45892fe8a81102f325
Instruction Fuzzy Hash: 06D1C4356087828FC725CF29C4902A7FBE1FF9A704F48856DE9D99B352D234D80ACB95

Function 0045E149 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d4b358ca929aae1a7670035e6ffff8e58438444434f69097c7261679edf30f
Instruction ID: f40e3da39cfa2b6fc5e6fd9949893bda8fd6dbeed5ed12750dd00c86ff3996d5
Opcode Fuzzy Hash: b1d4b358ca929aae1a7670035e6ffff8e58438444434f69097c7261679edf30f
Instruction Fuzzy Hash: 0DB17B2634A2828BDB195A3D90603F77BA1DB96312F5C54BEDDDAC7743E11E8A0EC305

Function 0045ACC0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030453e0bf82d2e98ab279b92e9b33a0ea4a5968e538ec9e799787ff2b968e1e
Instruction ID: f6b4f25ee2b88e56576dc97639cad8102a145668dbc34052ae3ab79a8cc397a6
Opcode Fuzzy Hash: 030453e0bf82d2e98ab279b92e9b33a0ea4a5968e538ec9e799787ff2b968e1e
Instruction Fuzzy Hash: F7D18B72A097468FC704CE18C49436BFBE1FBD8315F544A2EE89597791D338A90ECB86

Function 0042C110 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a7c87ebfcfecd4733fd7e97fcaf75af45901bfd187d631f72a97af90fa00200
Instruction ID: e07882056c6f8a0a8f00ab860fdd6ec160321f97c8343737217e3fdbee852067
Opcode Fuzzy Hash: 8a7c87ebfcfecd4733fd7e97fcaf75af45901bfd187d631f72a97af90fa00200
Instruction Fuzzy Hash: 90C1FE31B086A48FD725CE48E4E13AFB7E2AF86740FD8895FE4C147352D6389845CB5A

Function 0045ED1E Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209fc5673e656db3213c2d2fbf9a8a4af23a33bfddf6ddf1f62eb543b428bd05
Instruction ID: 71294d33a5bec29dc899b2f41f127136d1e1e642dc2351f7e386130d003839e9
Opcode Fuzzy Hash: 209fc5673e656db3213c2d2fbf9a8a4af23a33bfddf6ddf1f62eb543b428bd05
Instruction Fuzzy Hash: 00C1C03520C7824BC72DDB2894A55FBBFE29FAA300B1DD5BDD88A8B393D9255409C750

Function 0046EE60 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2417c1ce4e9e9b69ca172a5cfb6e8ea2df5b38e71710020941bb48b39ad2ce8e
Instruction ID: 79947136f6c47ca925560f53afd2dcbbcc819fb6ae759bb0d20169486e2bf3e3
Opcode Fuzzy Hash: 2417c1ce4e9e9b69ca172a5cfb6e8ea2df5b38e71710020941bb48b39ad2ce8e
Instruction Fuzzy Hash: 9CD18C752082518FC319CF18E9D88E27BE1BFA8740F0E42F9D98A8B323D7369945CB55

Function 004AD276 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 3801af7c5f6c5dcd1b59b771cc8546a2959237d446cd3294f618e3ed67faf9e2
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 3EB18B7590020ADFDB15CF04C5D0AA9BBA1BF69318F24C1AED85A4B782C735FE46CB94

Function 0046B470 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab88bb81d6f1a3f294bb195b69a7ed404116198194961875d31482ad394f9ff
Instruction ID: c081704d68ea1507edc3738d9e6e30aaf25844cd72d69a049e3ded5911d85175
Opcode Fuzzy Hash: cab88bb81d6f1a3f294bb195b69a7ed404116198194961875d31482ad394f9ff
Instruction Fuzzy Hash: 72A1F675A087418FC314CF29C49085AFBF2BFC8714F198A6DE99987325E770E945CB86

Function 0045F620 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4664e54bd8655df0b62760be2564d86677a0bae60cff444b8354291ceb51d8c8
Instruction ID: 425735577f7ae8863b7842a170fa4a962e1be06fe1cec519a874496c59ebde99
Opcode Fuzzy Hash: 4664e54bd8655df0b62760be2564d86677a0bae60cff444b8354291ceb51d8c8
Instruction Fuzzy Hash: 0C71D73550C6828AC711CF28C484666FFD2ABAA305F0CC6AECCC89F357D665E90DC792

Function 0045EAA4 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09e427cc0f5c48326d696f622ddb13854d7e20a58c35d846649955e18978596
Instruction ID: 8ffb78a4382c42801452b25a323a3d3109ccba851ac42c0494cb44020652aa39
Opcode Fuzzy Hash: e09e427cc0f5c48326d696f622ddb13854d7e20a58c35d846649955e18978596
Instruction Fuzzy Hash: B971232020D7C24BC72A9B2888A42F6BFA1AF96302F5C95FED8D64F393C406650DC721

Function 0046A9D0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85e5f8c1b8543d5e31b2507d484f8634bc59b4117db2810bbc7b5cb86d4c726
Instruction ID: c33d551def23ccc1fd2a1ef49bf70edc5998146a630d1c23ba56b9f1561c9553
Opcode Fuzzy Hash: c85e5f8c1b8543d5e31b2507d484f8634bc59b4117db2810bbc7b5cb86d4c726
Instruction Fuzzy Hash: D481193954A7819FC711CF29C0D0466FBE2BF9E204F5C999DE9C50B317D231A919CB92

Function 0045D3F0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083e52cccdf5450e489e77c33d6860a22e01e3515010b0744dceb5592228e7a7
Instruction ID: 695d003fa8f9c596b4bbd100c4f6674f7c4eb50ff049aeed854a2df96480b311
Opcode Fuzzy Hash: 083e52cccdf5450e489e77c33d6860a22e01e3515010b0744dceb5592228e7a7
Instruction Fuzzy Hash: CA513631A083644FC315DF2D989016AFBD29FCA316F588A6ED8D9C7313E235E8098785

Function 0045E8F1 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4d2dea2c165661568dc7cef3cf9871e53b13df2d48047b3dc5f70df1b2c506
Instruction ID: 00dad51e363d434b0dee973ad96dd68088ad665d4f0b4c92eb065135b284d4c6
Opcode Fuzzy Hash: 4d4d2dea2c165661568dc7cef3cf9871e53b13df2d48047b3dc5f70df1b2c506
Instruction Fuzzy Hash: FA41343A3192834BC7289E3C84512B6FBA1AF9A301B5847BED8D5C7743D6299A0AC754

Function 0045E606 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c27889d51f487b201adba72a386df83b8ac4b76ef92a9fc20cd27d85f323ea
Instruction ID: 109e22c010c5b0bf7b8255c4465612544583fa791aca71b4e84936f2dc0cc86b
Opcode Fuzzy Hash: a8c27889d51f487b201adba72a386df83b8ac4b76ef92a9fc20cd27d85f323ea
Instruction Fuzzy Hash: 5251AC2920DBD14AC71A973854A95F7FFE29F6B302B4E90EEC8DA8B363D516410CC760

Function 00460290 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd569e7163981d773c755b0d9c8571a49a4c4d70a2c301a50f699e530bd60ad
Instruction ID: 7c8f87e9a5c9336ed9a283bcbebb77d3dd1b68eccf10348b0ac2271c5d78e5a7
Opcode Fuzzy Hash: 2cd569e7163981d773c755b0d9c8571a49a4c4d70a2c301a50f699e530bd60ad
Instruction Fuzzy Hash: 4341C132700A510BC778CA2A98A01FBB793DBC6301F28C8BFC59E8B725E9355844CB85

Function 004574F0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
Instruction ID: 3b4163a1df93306f16789d9e08b335229fe29319b66eef29c0edf652b8a843d0
Opcode Fuzzy Hash: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
Instruction Fuzzy Hash: 73312D3374958203F71DCA2F9CA12BAEAD34FC522872DD87E99C987757ECB9841A8104

Function 00456DB0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f56755fb1d45353d884b0032e82fd145e1b97ab046bd07626dad2e3ede3ed2
Instruction ID: c5488a6bb5d6af12d03688ec508865531f56d558858d35d892c1ec3432e11d6d
Opcode Fuzzy Hash: e7f56755fb1d45353d884b0032e82fd145e1b97ab046bd07626dad2e3ede3ed2
Instruction Fuzzy Hash: 9C3177267B609207D395CEBD9C80577B693A7CA306B6DC678D984C7A0EC43DD80B8258

Function 00479B50 Relevance: 98.4, APIs: 55, Strings: 1, Instructions: 403windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004782B0: GetWindowRect.USER32(?,00000000), ref: 004782C0
Part of subcall function 004782B0: GetWindowDC.USER32(?,?,?), ref: 004782C9
Part of subcall function 004782B0: CreateCompatibleDC.GDI32(00000000), ref: 004782D3
Part of subcall function 004782B0: SetBkMode.GDI32(00000000,00000001), ref: 004782DF
Part of subcall function 004782B0: SelectObject.GDI32(?,00000000), ref: 00478329
Part of subcall function 004782B0: BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00478365

GetClientRect.USER32(00000000,?), ref: 00479B83
FillRect.USER32(?,?,?), ref: 00479BB7
GetWindowLongA.USER32(?,000000F0), ref: 00479BC2
GetVersion.KERNEL32 ref: 00479C4F
GetSysColor.USER32 ref: 00479C6A
CreatePen.GDI32(00000000,00000001,00000000), ref: 00479C74
SelectObject.GDI32(?,00000000), ref: 00479C82
GetSysColor.USER32(0000000F), ref: 00479C91
CreateSolidBrush.GDI32 ref: 00479CA1
SelectObject.GDI32(?,00000000), ref: 00479CA9
Ellipse.GDI32(?,?,?,?,?), ref: 00479CCA
SelectObject.GDI32(?,00000000), ref: 00479CD2
DeleteObject.GDI32(00000000), ref: 00479CDB
SelectObject.GDI32(?,?), ref: 00479CE3
DeleteObject.GDI32(00000000), ref: 00479CE6
GetSysColor.USER32(0000000F), ref: 00479CF0
CreatePen.GDI32(00000000,00000001,00845521), ref: 00479D07
SelectObject.GDI32(?,00000000), ref: 00479D0F
Arc.GDI32(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00479D3A
SelectObject.GDI32(?,?), ref: 00479D46
DeleteObject.GDI32(00000000), ref: 00479D49
InflateRect.USER32(?,000000FE,000000FE), ref: 00479D54
CreateEllipticRgnIndirect.GDI32(?), ref: 00479D5F
SelectClipRgn.GDI32(?,00000000), ref: 00479D6B
GetStockObject.GDI32(00000000), ref: 00479D7A
FillRect.USER32(?,?,00000000), ref: 00479D87
SelectClipRgn.GDI32(?,00000000), ref: 00479DB7
DeleteObject.GDI32(?), ref: 00479DC2
InflateRect.USER32(?,000000FE,000000FE), ref: 00479DCD
CreatePen.GDI32(00000000,00000001,00DEEFF7), ref: 00479DE7
SelectObject.GDI32(?,00000000), ref: 00479DEF
CreateSolidBrush.GDI32(00DEEFF7), ref: 00479DFA
SelectObject.GDI32(?,00000000), ref: 00479E02
Ellipse.GDI32(?,?,?,?,?), ref: 00479E1F
SelectObject.GDI32(?,?), ref: 00479E2B
DeleteObject.GDI32(00000000), ref: 00479E2E
SelectObject.GDI32(?,?), ref: 00479E36
DeleteObject.GDI32(00000000), ref: 00479E39
InflateRect.USER32(?,000000FF,000000FF), ref: 00479E44
CreatePen.GDI32(00000000,00000001,-0094CB9B), ref: 00479E6D
SelectObject.GDI32(?,00000000), ref: 00479E75
Arc.GDI32(?,?,?,?,?,00000000,00000000,00000000,00000000), ref: 00479E9A
SelectObject.GDI32(?,?), ref: 00479EA6
DeleteObject.GDI32(00000000), ref: 00479EA9
CreateEllipticRgnIndirect.GDI32(?), ref: 00479EB0
SelectClipRgn.GDI32(?,00000000), ref: 00479EBC
SelectClipRgn.GDI32(?,00000000), ref: 00479EE1
DeleteObject.GDI32(?), ref: 00479EEC
GetWindowTextA.USER32(00000001,?,00000100), ref: 00479EFB
GetSysColor.USER32(00000011), ref: 00479F11
SetTextColor.GDI32(?,?), ref: 00479F1E
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 00479F2D
SelectObject.GDI32(?,00000000), ref: 00479F35

Part of subcall function 00476C30: GetTextExtentPoint32A.GDI32(?,004EEAE0,?,?), ref: 00476CC3

SelectObject.GDI32(?,00000000), ref: 00479F61
DrawFocusRect.USER32(?,?), ref: 00479F91

Strings

N, xrefs: 00479EC6

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Object$Select$Create$DeleteRect$Color$ClipWindow$InflateText$BrushEllipseEllipticFillIndirectSolid$ClientCompatibleDrawExtentFocusLongMessageModePoint32SendStockVersion
String ID: N
API String ID: 1322314875-3948818596
Opcode ID: 8bea2fb6dc65c8ae00e31523f026ec98ecf04729c0ac43a790a241e00e06da80
Instruction ID: ef8a133b45522f8bf16b41b9e4001d5bdd003197e43d0ab4114199d162fd4932
Opcode Fuzzy Hash: 8bea2fb6dc65c8ae00e31523f026ec98ecf04729c0ac43a790a241e00e06da80
Instruction Fuzzy Hash: EED157B1108701AFD700DB65CC48FAFB7E8EF89704F044A1DF995C6290DB78E9458B6A

Function 00447620 Relevance: 80.0, APIs: 53, Instructions: 459windowsleepCOMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00447642

Part of subcall function 0042D040: EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 0042D04F

SetStretchBltMode.GDI32(00000000,00000000), ref: 00447655
CreateCompatibleDC.GDI32(00000000), ref: 00447662
CreateCompatibleDC.GDI32(00000000), ref: 00447667
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004476B8
SelectObject.GDI32(00000000,00000000), ref: 004476CC
SelectObject.GDI32(?,?), ref: 004476F6
PatBlt.GDI32(?,00000000,00000000,?,?,00F00021), ref: 00447718
SelectObject.GDI32(?,?), ref: 00447728
SelectObject.GDI32(?,?), ref: 00447734
GetTickCount.KERNEL32 ref: 00447782
SelectObject.GDI32(?,?), ref: 004477BA
SelectObject.GDI32(00000000,00000000), ref: 004477D6
BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 004477FB
SelectObject.GDI32(00000000,?), ref: 00447807
DeleteObject.GDI32(00000000), ref: 0044780E
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00447852
SelectObject.GDI32(00000000,00000000), ref: 0044785E
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,00000000,00CC0020), ref: 00447883
SelectObject.GDI32(00000000,?), ref: 0044788F
SelectObject.GDI32(00000000,?), ref: 00447897
CreateCompatibleDC.GDI32(00000000), ref: 004478AC
CreateCompatibleDC.GDI32(00000000), ref: 004478B5
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004478CB
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 004478E3
SelectObject.GDI32(00000000,?), ref: 004478F3
SelectObject.GDI32(00000000,?), ref: 00447903
SetBkColor.GDI32(00000000,?), ref: 00447915
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00447936
SetBkColor.GDI32(00000000,?), ref: 00447942
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00330008), ref: 0044795F
BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 00447984
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 004479A1
BitBlt.GDI32(?,?,00000000,?,?,00000000,00000000,00000000,00EE0086), ref: 004479C6
SelectObject.GDI32(00000000,?), ref: 004479D2
DeleteObject.GDI32(00000000), ref: 004479D9
SelectObject.GDI32(00000000,?), ref: 004479E5
DeleteObject.GDI32(00000000), ref: 004479EC
DeleteDC.GDI32(00000000), ref: 004479F9
DeleteDC.GDI32(00000000), ref: 004479FC
SelectObject.GDI32(00000000,?), ref: 00447A35
DeleteObject.GDI32(?), ref: 00447A3C
IsWindow.USER32(?), ref: 00447A46
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 00447AAA
BitBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00CC0020), ref: 00447AD4
SelectObject.GDI32(?,?), ref: 00447AE4
Sleep.KERNEL32(0000000A), ref: 00447B30
GetTickCount.KERNEL32 ref: 00447B36
DeleteObject.GDI32(00000000), ref: 00447B63
DeleteDC.GDI32(00000000), ref: 00447B70
DeleteDC.GDI32(?), ref: 00447B77
ReleaseDC.USER32(?,00000000), ref: 00447B7E

Part of subcall function 00447160: GetClientRect.USER32(?,?), ref: 00447187
Part of subcall function 00447160: __ftol.LIBCMT ref: 0044725E
Part of subcall function 00447160: __ftol.LIBCMT ref: 00447271

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Object$Select$Delete$Create$Compatible$Bitmap$ColorCountStretchTick__ftol$ClientDisplayEnumModeRectReleaseSettingsSleepWindow
String ID:
API String ID: 1975044605-0
Opcode ID: d84f70d83c37e78f8e3f5b639f4bda7b1ba309dc1bd617dc0568cb3fad6b7351
Instruction ID: 904a7e97ff7a3c566e83dcf5d929af1c4f7da2a9a9635feffefedd97aca6458f
Opcode Fuzzy Hash: d84f70d83c37e78f8e3f5b639f4bda7b1ba309dc1bd617dc0568cb3fad6b7351
Instruction Fuzzy Hash: 6C02E6B5604700AFE360DB65CC89F2BB7E9EB88B04F10491DF69697290DB74F8458B29

Function 00455540 Relevance: 46.0, APIs: 25, Strings: 1, Instructions: 452windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000010), ref: 004555C8

Part of subcall function 004BE34D: SetBkColor.GDI32(?,?), ref: 004BE35C
Part of subcall function 004BE34D: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 004BE38E

GetSysColor.USER32(00000014), ref: 00455600
InflateRect.USER32(?,000000FF,000000FF), ref: 00455632
GetSysColor.USER32(00000016), ref: 0045564B
GetSysColor.USER32(0000000F), ref: 0045565B
DrawEdge.USER32(?,?,00000002,0000000F), ref: 00455694
GetDeviceCaps.GDI32(?), ref: 0045589E
RealizePalette.GDI32(?), ref: 004558C1
GetSysColor.USER32(00000014), ref: 004558D9
GetSysColor.USER32(0000000F), ref: 004558EB
GetSysColor.USER32(0000000F), ref: 004555A1

Part of subcall function 004BE323: SetBkColor.GDI32(?,?), ref: 004BE32D
Part of subcall function 004BE323: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 004BE343

GetSysColor.USER32(0000000F), ref: 004556F8
InflateRect.USER32(?,000000FF,000000FF), ref: 00455731
GetSysColor.USER32(00000016), ref: 00455746
GetSysColor.USER32(0000000F), ref: 00455752
InflateRect.USER32(?,?,?), ref: 00455793
GetSysColor.USER32(00000010), ref: 00455797
Rectangle.GDI32(?,?,?,?,?), ref: 004557DE
DrawEdge.USER32(?,?,00000002,0000000F), ref: 00455819
DrawEdge.USER32(?,?,00000002,0000000F), ref: 00455920
GetSysColor.USER32(00000010), ref: 0045597D
CreatePen.GDI32(00000000,00000001,00000000), ref: 00455984
InflateRect.USER32(?,?,?), ref: 004559C3
Rectangle.GDI32(?,?,?,?,?), ref: 004559E1
GetDeviceCaps.GDI32(?,00000026), ref: 00455A17

Strings

!K, xrefs: 00455856, 00455A2C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Color$InflateRect$DrawEdge$CapsDeviceRectangleText$CreatePaletteRealize
String ID: !K
API String ID: 3119264602-3405271303
Opcode ID: 93716d44f2339dd8f1c4f9a210072c440c24b2ab0782b2448125af021eb1758c
Instruction ID: e5ee1e66f9e8c17a843f4f22261fe21603432c0af764afbbb2f4980b91139568
Opcode Fuzzy Hash: 93716d44f2339dd8f1c4f9a210072c440c24b2ab0782b2448125af021eb1758c
Instruction Fuzzy Hash: 2AF17A71204701AFD714DB65C894E7FB3E9FB88704F004A2EFA9687291DBB4E805CB66

Function 00414AC0 Relevance: 40.9, APIs: 27, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c2ff4a6c7c1fff5544f635a024a0296206676e4c86ffbb57b6e463d791ab02
Instruction ID: 9c3a3481c6fa8faacec73868fbb50a71b3e00e3caa1e712d2f79b15e3779e864
Opcode Fuzzy Hash: 05c2ff4a6c7c1fff5544f635a024a0296206676e4c86ffbb57b6e463d791ab02
Instruction Fuzzy Hash: 74D15EB2604605AFD704DFA8E8C4DABB7A9FB84365B10893EF105C7251D735E891CBA4

Function 00432580 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 366windowCOMMON

Download Yara Rule

APIs

CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 0043260C
CreateCompatibleDC.GDI32(?), ref: 0043261E
CreateCompatibleDC.GDI32(?), ref: 00432627
SelectObject.GDI32(00000000,?), ref: 00432636
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00432649
SelectObject.GDI32(?,00000000), ref: 00432659
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00432679
SelectObject.GDI32(00000000,?), ref: 00432685
DeleteDC.GDI32(00000000), ref: 00432692
SelectObject.GDI32(?,?), ref: 0043269A
DeleteDC.GDI32(?), ref: 004326A1
DeleteObject.GDI32(?), ref: 004326A7
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 004326DD

Strings

, xrefs: 004327A3
(, xrefs: 0043293F
(, xrefs: 0043278C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CreateObject$Select$BitmapCompatibleDelete
String ID: $($(
API String ID: 1878064223-3669016180
Opcode ID: 3d4cf4b692dd603bbb77bd3456f3729282759677cd2476b57c23a635f0098308
Instruction ID: a51550c07a1bcd83a0c8f4dc731026e5c6112cbd66e96250cd3cf998e62ae352
Opcode Fuzzy Hash: 3d4cf4b692dd603bbb77bd3456f3729282759677cd2476b57c23a635f0098308
Instruction Fuzzy Hash: A4D155B5A047009FC724DF29D984A6BBBE9EFC8310F14892EF99687350D774E844CB66

Function 004165A0 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 384windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 004BBD89: GetClipBox.GDI32(?,?), ref: 004BBD90

IsRectEmpty.USER32(?), ref: 004165E5
GetCurrentObject.GDI32(?,00000002), ref: 0041662A
GetCurrentObject.GDI32(?,00000001), ref: 0041663D
GetClientRect.USER32 ref: 004166C2
CreatePen.GDI32(-00000003,00000000,?), ref: 004166DE
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 004167A2

Part of subcall function 004BC24A: __EH_prolog.LIBCMT ref: 004BC24F
Part of subcall function 004BC24A: EndPaint.USER32(?,?,?,?,00414203), ref: 004BC26C

Strings

gfff, xrefs: 00416912
!K, xrefs: 004169E6
'K, xrefs: 0041669C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CurrentH_prologObjectPaintRect$BeginClientClipCreateEmpty
String ID: !K$'K$gfff
API String ID: 3506841274-3458085062
Opcode ID: 1247271362fd2d7619618a3b5bced564e3bbc2a528a1b8cf8d9b409cebdfc743
Instruction ID: a65b6a9c75819ff3dfce3c70bdb4be9e8d0c32a213edcbb0bcc13aab1f12d056
Opcode Fuzzy Hash: 1247271362fd2d7619618a3b5bced564e3bbc2a528a1b8cf8d9b409cebdfc743
Instruction Fuzzy Hash: B7E19CB15083409FC314DF59C884EAFB7E9FB88714F514A1EF59587290DB38E849CBAA

Function 00422870 Relevance: 33.3, APIs: 22, Instructions: 293windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 004228FF
GetWindowRect.USER32(?,?), ref: 00422956
GetParent.USER32(?), ref: 00422966
GetParent.USER32(?), ref: 00422999
GlobalSize.KERNEL32(00000000), ref: 004229E3
GlobalLock.KERNEL32(00000000,00000000), ref: 004229EB
IsWindow.USER32(?), ref: 00422A04
GetTopWindow.USER32(?), ref: 00422A41
GetWindow.USER32(00000000,00000002), ref: 00422A5A
SetParent.USER32(?,?), ref: 00422A86
SendMessageA.USER32(?,0000806F,00000000,00000000), ref: 00422AD1
SendMessageA.USER32(?,00008076,00000000,00000000), ref: 00422AE0
GetParent.USER32(?), ref: 00422AF3
SendMessageA.USER32(?,00008004,00000000,00000000), ref: 00422B0C
GetWindowLongA.USER32(?,000000F0), ref: 00422B14
SendMessageA.USER32(?,0000130B,00000000,00000000), ref: 00422B44
SendMessageA.USER32(?,0000130C,00000000,00000000), ref: 00422B52
IsWindow.USER32(?), ref: 00422B9E
GetFocus.USER32 ref: 00422BA8
SetFocus.USER32(?,00000000), ref: 00422BC0
GlobalUnlock.KERNEL32(00000000), ref: 00422BCB
GlobalFree.KERNEL32(00000000), ref: 00422BD2

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$MessageSend$GlobalParent$Focus$FreeLockLongRectSizeUnlock
String ID:
API String ID: 300820980-0
Opcode ID: 59312e6593d847d3b6ca3a127827fd77bc5a1de3a36835e6a24a757019e3d284
Instruction ID: d2c02a062f5f0b462a6e902ae2f88f1f809bd864c630c0343e789db5b1507e84
Opcode Fuzzy Hash: 59312e6593d847d3b6ca3a127827fd77bc5a1de3a36835e6a24a757019e3d284
Instruction Fuzzy Hash: 86A148B1304700AFD724EF659D84F2BB7E9BF88700F504A1EF95197291DBB8E8418B69

Function 004280D0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 245COMMON

Download Yara Rule

APIs

SetWindowRgn.USER32(?,00000000,00000001), ref: 00428101
GetWindowRect.USER32(?,?), ref: 0042812E
BeginPath.GDI32(?), ref: 004281B7
MulDiv.KERNEL32(7FFF0000,?,00007FFF), ref: 004281D0
MulDiv.KERNEL32(00000000,?,00007FFF), ref: 004281DF
MulDiv.KERNEL32(3FFF0000,?,00007FFF), ref: 00428207
MulDiv.KERNEL32(00000000,?,00007FFF), ref: 00428216
EndPath.GDI32(?), ref: 00428231
PathToRegion.GDI32(?), ref: 0042823C

Strings

gfff, xrefs: 0042830A
gfff, xrefs: 004282FA
EK, xrefs: 00428144, 00428322, 00428323

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Path$Window$BeginRectRegion
String ID: EK$gfff$gfff
API String ID: 3989698161-4290331459
Opcode ID: 92a34ad30450fb562635a85b0c8b23507e93b2a154ccbd2050e9c6a8b71e2d07
Instruction ID: 6405701b3ab51cd6c590f590cf4d215e40ac5df88a94fa5da49da94dbace2614
Opcode Fuzzy Hash: 92a34ad30450fb562635a85b0c8b23507e93b2a154ccbd2050e9c6a8b71e2d07
Instruction Fuzzy Hash: C481F3B1604741AFC318DF25DC85E6FB7E8FB94704F44892EF98683290DE38A845C766

Function 00449CF0 Relevance: 31.7, APIs: 21, Instructions: 205COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000022B8), ref: 00449D05
EnterCriticalSection.KERNEL32(?), ref: 00449D28
LeaveCriticalSection.KERNEL32(?), ref: 00449D36
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00449D58
waveOutPrepareHeader.WINMM(?,?,00000020), ref: 00449DA1
waveOutWrite.WINMM(?,?,00000020), ref: 00449DAE
EnterCriticalSection.KERNEL32(?), ref: 00449DB8
LeaveCriticalSection.KERNEL32(?), ref: 00449DC6
EnterCriticalSection.KERNEL32(?), ref: 00449DF5
ReleaseSemaphore.KERNEL32(?,00000014,00000000), ref: 00449E13
LeaveCriticalSection.KERNEL32(?), ref: 00449E1A
waveOutPause.WINMM(?), ref: 00449E29
waveOutReset.WINMM(?), ref: 00449E33
waveOutUnprepareHeader.WINMM(?,00000000,00000020), ref: 00449E51
waveOutUnprepareHeader.WINMM(?,?,00000020), ref: 00449E76
EnterCriticalSection.KERNEL32(00507808), ref: 00449E8C
LeaveCriticalSection.KERNEL32(00507808), ref: 00449EE8
CloseHandle.KERNEL32(?), ref: 00449F16
CloseHandle.KERNEL32(?), ref: 00449F1C
CloseHandle.KERNEL32(?), ref: 00449F22
DeleteCriticalSection.KERNEL32(?), ref: 00449F28

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalSection$wave$EnterHeaderLeave$CloseHandleUnprepare$DeleteMultipleObjectsPausePrepareReleaseResetSemaphoreWaitWrite
String ID:
API String ID: 361331667-0
Opcode ID: 33e5f42266412e8aed80e3059d977fcc4490b3aa1e3b9a83dcde8ee0b6d5bb0b
Instruction ID: 3e78584cd100be71eac9d453100101527c098e7ff7c12d490ae73f8cb970e303
Opcode Fuzzy Hash: 33e5f42266412e8aed80e3059d977fcc4490b3aa1e3b9a83dcde8ee0b6d5bb0b
Instruction Fuzzy Hash: 8F719E756006199FEB54CF68DC88AAF77A8EF48304F14852AFD06DB290C738ED41DB98

Function 004301F0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 183windowmemoryCOMMON

Download Yara Rule

APIs

GetStockObject.GDI32(0000000F), ref: 00430244
GetObjectA.GDI32(?,00000018,?), ref: 00430257
SelectPalette.GDI32(?,00000000,00000000), ref: 004302B2
RealizePalette.GDI32(?), ref: 004302BC
GlobalAlloc.KERNEL32(00000002,00000028), ref: 004302C6
SelectPalette.GDI32(?,?,00000000), ref: 004302DC
GlobalLock.KERNEL32(00000000), ref: 004302E4
GetDIBits.GDI32(?,?,00000000,?,00000000,00000000,00000000), ref: 00430313
GlobalUnlock.KERNEL32(00000000), ref: 00430369
GlobalReAlloc.KERNEL32(00000000,?,00000002), ref: 00430372
GlobalLock.KERNEL32(00000000), ref: 0043037F
GetDIBits.GDI32(?,?,00000000,?,00000000,00000000,00000000), ref: 004303A2
SelectPalette.GDI32(?,?,00000000), ref: 004303B5
GlobalUnlock.KERNEL32(00000000), ref: 004303BC
GlobalFree.KERNEL32(00000000), ref: 004303C3

Part of subcall function 004BC0E2: __EH_prolog.LIBCMT ref: 004BC0E7
Part of subcall function 004BC0E2: ReleaseDC.USER32(?,00000000), ref: 004BC106

Strings

(, xrefs: 0043026A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Global$Palette$Select$AllocBitsLockObjectUnlock$FreeH_prologRealizeReleaseStock
String ID: (
API String ID: 3986717603-3887548279
Opcode ID: c2161b2f457c81154ca42fc2fba1a534a35e3b3657fc5c1ce66474b25a7d7ef5
Instruction ID: 147809fc6433be86f52ff5f09f725146cb8e3a35a52ad9e705796d73ff1e4213
Opcode Fuzzy Hash: c2161b2f457c81154ca42fc2fba1a534a35e3b3657fc5c1ce66474b25a7d7ef5
Instruction Fuzzy Hash: 1A6158725447509FC360DB54CC88F6FB7E8FB88B10F144A2DFA8597290DB78A845CBA6

Function 00449910 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 331threadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00449A7B
CreateSemaphoreA.KERNEL32(00000000,00000014,00000014,00000000), ref: 00449A90
InitializeCriticalSection.KERNEL32(?), ref: 00449ABB
CreateThread.KERNEL32(00000000,00000000,00449CF0,?,00000004,?), ref: 00449AF0
EnterCriticalSection.KERNEL32(00507808), ref: 00449B02
LeaveCriticalSection.KERNEL32(00507808,-000000FC,00000000,00000000), ref: 00449CB5
ResumeThread.KERNEL32(?), ref: 00449CC3
ReleaseSemaphore.KERNEL32(?,00000014,00000000), ref: 00449CD5

Strings

xP, xrefs: 00449BCF
fmt , xrefs: 00449994
RIFF, xrefs: 00449924, 00449938
data, xrefs: 004499B5
xP, xrefs: 00449C72
xP, xrefs: 00449C22
xP, xrefs: 00449BEF
xP, xrefs: 00449C47
WAVE, xrefs: 00449951, 00449968

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CreateCriticalSection$SemaphoreThread$EnterEventInitializeLeaveReleaseResume
String ID: xP$ xP$ xP$ xP$ xP$RIFF$WAVE$data$fmt
API String ID: 1802393137-3042124615
Opcode ID: eedda10e25806d24670ca29a8b612efc06e53685d60957cd9f14d2637a0ff2bf
Instruction ID: bb1c09a64d356771dae48a14d155362068357635a71df923c187e4b64914615e
Opcode Fuzzy Hash: eedda10e25806d24670ca29a8b612efc06e53685d60957cd9f14d2637a0ff2bf
Instruction Fuzzy Hash: D7B1FDB1A043009BE714DF24DC85A2FB7E5FB88318F04862EF94697380E679ED05DB99

Function 004465F0 Relevance: 25.9, APIs: 17, Instructions: 351windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B7A75: GetWindowTextLengthA.USER32(?), ref: 004B7A82
Part of subcall function 004B7A75: GetWindowTextA.USER32(?,00000000,00000000), ref: 004B7A9A

__ftol.LIBCMT ref: 00446666
__ftol.LIBCMT ref: 004466BC
__ftol.LIBCMT ref: 00446712
__ftol.LIBCMT ref: 00446768
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00446789
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004467A3
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0044686B
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0044689D
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 004468BA
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004468DA
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004468F4
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0044690C
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0044692B
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00446994
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004469F9
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00446A3B

Part of subcall function 004B983D: GetDlgItem.USER32(?,?), ref: 004B984B

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00446A67

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$__ftol$TextWindow$ItemLength
String ID:
API String ID: 2143175130-0
Opcode ID: 4f1559c98fcfb8eef726e8002ee5c29cab65a9634121de8822ab5e85c329b84e
Instruction ID: 0ee18c4da01dbe1cf487a23a9a6a07f23839b477813f6d4845e08513761deab8
Opcode Fuzzy Hash: 4f1559c98fcfb8eef726e8002ee5c29cab65a9634121de8822ab5e85c329b84e
Instruction Fuzzy Hash: 36D1E7B1544B02ABE320EB31CC42FAB73E4AF95744F11492EF19A972D0DB78E5418F1A

Function 004536A0 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 00452BF0: GetWindowExtEx.GDI32(?,?), ref: 00452C13

MulDiv.KERNEL32(?,00000064,?), ref: 0045375B
GetClientRect.USER32(?,?), ref: 004537E9
DPtoLP.GDI32(?,?,00000002), ref: 004537FE
OffsetRect.USER32 ref: 0045384D
Rectangle.GDI32(?,?,?,?,?), ref: 0045388B
FillRect.USER32(?,?,?), ref: 004538E3
FillRect.USER32(?,00000032,?), ref: 00453926
LPtoDP.GDI32(?,?,00000002), ref: 004539CF
IsRectEmpty.USER32(?), ref: 004539D6
CreateRectRgnIndirect.GDI32(?), ref: 00453A1A

Part of subcall function 004BBD99: SelectClipRgn.GDI32(?,00000000), ref: 004BBDBB
Part of subcall function 004BBD99: SelectClipRgn.GDI32(?,?), ref: 004BBDD1

LPtoDP.GDI32(?,?,00000001), ref: 00453A5A
DPtoLP.GDI32(?,?,00000001), ref: 00453A81

Strings

2, xrefs: 00453845
0b)u, xrefs: 00453A1A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$ClipFillSelect$BeginClientCreateEmptyH_prologIndirectOffsetPaintRectangleWindow
String ID: 0b)u$2
API String ID: 2521159323-3765794826
Opcode ID: f87c1c05112e221a85c0b6d52c792f7f9117600fb5e3608a4e27643e8b3d30c4
Instruction ID: 30437d56553cd64bb71ffad172cdd35520f55c78af5b4af0e42e63b58240ff6a
Opcode Fuzzy Hash: f87c1c05112e221a85c0b6d52c792f7f9117600fb5e3608a4e27643e8b3d30c4
Instruction Fuzzy Hash: 37E12AB16087409FD324DF69C881B6BB7E5BBC8704F408A2EF59A83351DB74E908CB56

Function 0043F1E0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 320windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 0043F1FE
SetCapture.USER32(?,?,?,?,?,?,?,?,?,004C2E88,000000FF,0043EA3D,?,?,?,?), ref: 0043F21B

Part of subcall function 004BC070: __EH_prolog.LIBCMT ref: 004BC075
Part of subcall function 004BC070: GetDC.USER32(?), ref: 004BC09E

Part of subcall function 00452BF0: GetWindowExtEx.GDI32(?,?), ref: 00452C13

Part of subcall function 004BBF9E: GetWindowExtEx.GDI32(?,?), ref: 004BBFAF
Part of subcall function 004BBF9E: GetViewportExtEx.GDI32(?,?), ref: 004BBFBC
Part of subcall function 004BBF9E: MulDiv.KERNEL32(?,00000000,00000000), ref: 004BBFE1
Part of subcall function 004BBF9E: MulDiv.KERNEL32(?,00000000,00000000), ref: 004BBFFC

Part of subcall function 004BBB2F: SetMapMode.GDI32(?,?), ref: 004BBB48
Part of subcall function 004BBB2F: SetMapMode.GDI32(?,?), ref: 004BBB56

Part of subcall function 004BBAA4: SetROP2.GDI32(?,?), ref: 004BBABD
Part of subcall function 004BBAA4: SetROP2.GDI32(?,?), ref: 004BBACB

Part of subcall function 004BBA48: SetBkMode.GDI32(?,?), ref: 004BBA61
Part of subcall function 004BBA48: SetBkMode.GDI32(?,?), ref: 004BBA6F

Part of subcall function 004BC385: __EH_prolog.LIBCMT ref: 004BC38A
Part of subcall function 004BC385: CreatePen.GDI32(?,?,?), ref: 004BC3AD

Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,00000000), ref: 004BB98E
Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,?), ref: 004BB9A4

GetCapture.USER32 ref: 0043F2E1
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0043F300
DispatchMessageA.USER32(?), ref: 0043F341
DispatchMessageA.USER32(?), ref: 0043F35D
ScreenToClient.USER32(?,?), ref: 0043F3A4
GetCapture.USER32 ref: 0043F3CC
ReleaseCapture.USER32 ref: 0043F3F4
ReleaseCapture.USER32 ref: 0043F450
DPtoLP.GDI32 ref: 0043F494
InvalidateRect.USER32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,?,?), ref: 0043F51D
InvalidateRect.USER32(?,00000000,00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0043F5AB

Strings

!K, xrefs: 0043F408, 0043F5C5

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Capture$Mode$Message$DispatchH_prologInvalidateObjectRectReleaseSelectWindow$ClientCreateScreenViewport
String ID: !K
API String ID: 453157188-3405271303
Opcode ID: a57f673c36a88599c5f8e2f9ed2e8854b08599362c3585c46e12c957c511031b
Instruction ID: bcf1c97d089bdb712bb4913abef6ffedbc960091fa58fc27bc77eb6d6cbe84f1
Opcode Fuzzy Hash: a57f673c36a88599c5f8e2f9ed2e8854b08599362c3585c46e12c957c511031b
Instruction Fuzzy Hash: CDB1A471504700ABD314EF65C885F6FB7E9BF88704F10192EF592832A1DB78E949CB6A

Function 004A3441 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,004A357A), ref: 004A3463
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 004A347B
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 004A348C
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 004A349D
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 004A34AE
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 004A34BF
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 004A34D0

Strings

GetMonitorInfoA, xrefs: 004A34CA
MonitorFromPoint, xrefs: 004A34A8
EnumDisplayMonitors, xrefs: 004A34B9
MonitorFromWindow, xrefs: 004A3486
MonitorFromRect, xrefs: 004A3497
GetSystemMetrics, xrefs: 004A3475
USER32, xrefs: 004A345E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-2376520503
Opcode ID: f3a9ff96a37f3de8b4a616e3441982232046edf7c3fff0b90340b3d17e0873f9
Instruction ID: 30b5f126c5d87352768c57309e0dad0c6ef46ad529c19d2c84e0994c5a0106c6
Opcode Fuzzy Hash: f3a9ff96a37f3de8b4a616e3441982232046edf7c3fff0b90340b3d17e0873f9
Instruction Fuzzy Hash: 051193B1A01241EBC3119F25ACC5A2ABFE5B36D703370857FE004D2750E7B88789AF69

Function 004284B0 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 354COMMON

Download Yara Rule

APIs

CreateRectRgn.GDI32(?,?,?,?), ref: 004284FE
GetClientRect.USER32(?,?), ref: 00428599
CreateRectRgn.GDI32 ref: 0042860A
CombineRgn.GDI32(?,?,EK,00000004), ref: 0042863B
SetRect.USER32(?,00000000,?,?,?), ref: 00428692
IntersectRect.USER32(?,?,?), ref: 0042869F
IsRectEmpty.USER32(?), ref: 004286CA
__ftol.LIBCMT ref: 004287A8
__ftol.LIBCMT ref: 004287B5
CreateRectRgn.GDI32(00000000,?,00000000,00000000), ref: 0042880E
CombineRgn.GDI32(?,?,EK,00000004), ref: 0042883F

Part of subcall function 004329C0: SetStretchBltMode.GDI32(?,00000000), ref: 004329D4
Part of subcall function 004329C0: CreateCompatibleDC.GDI32(?), ref: 00432A59
Part of subcall function 004329C0: CreateCompatibleDC.GDI32(?), ref: 00432A71
Part of subcall function 004329C0: GetObjectA.GDI32(?,00000018,?), ref: 00432AB2
Part of subcall function 004329C0: CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 00432AC8

FillRgn.GDI32(?,?,00000000), ref: 004288BC

Strings

EK, xrefs: 004284D8, 004285EE, 00428636, 004287F6, 0042883A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Create$CombineCompatible__ftol$BitmapClientEmptyFillIntersectModeObjectStretch
String ID: EK
API String ID: 3212946024-2789900426
Opcode ID: 71cb89fa28403f3d1a0a922b0e28999befb3fed09ed9abc265bf736848854e61
Instruction ID: 9eb4af10ac575a2f5df9ff98c071c6446094120c32b58c848425b238834204d7
Opcode Fuzzy Hash: 71cb89fa28403f3d1a0a922b0e28999befb3fed09ed9abc265bf736848854e61
Instruction Fuzzy Hash: BCD18CB1608340AFC314DF25C884E6FBBE9BBC8744F548A1EF88583251DB74E945CB66

Function 00438610 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 282COMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(windows,device,,,,,?,000001F4), ref: 0043868F
GetProfileStringA.KERNEL32(devices,00000000,00507790,?,00001000), ref: 004386C3
GetProfileStringA.KERNEL32(devices,?,,,,,?,000000C8), ref: 0043874A

Strings

windows, xrefs: 0043868A
,,,, xrefs: 00438680, 0043873F
none, xrefs: 00438780
device, xrefs: 00438685
devices, xrefs: 004386BE, 00438745

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ProfileString
String ID: ,,,$device$devices$none$windows
API String ID: 1468043044-528626633
Opcode ID: 6b22dcacb758ea7e953d24d7bf1a5b1035d91cfea745d7aa41765b6c2e1c9332
Instruction ID: b29221ad40a32953ce25b98b083ee8b8259ad6b5dcde242ff8045bbe9ee14a03
Opcode Fuzzy Hash: 6b22dcacb758ea7e953d24d7bf1a5b1035d91cfea745d7aa41765b6c2e1c9332
Instruction Fuzzy Hash: 16B1B6741083819FD324EB65C881FDBB7D4AF99758F400A1EF89583391DB78A904CB6B

Function 004B37BC Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 119registryclipboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BF1AC: TlsGetValue.KERNEL32(00533A2C,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6,?,00000000,?,004B2B99,00000000,00000000,00000000,00000000), ref: 004BF1EB

RegisterClipboardFormatA.USER32(commdlg_LBSelChangedNotify), ref: 004B3814
RegisterClipboardFormatA.USER32(commdlg_ShareViolation), ref: 004B3820
RegisterClipboardFormatA.USER32(commdlg_FileNameOK), ref: 004B382C
RegisterClipboardFormatA.USER32(commdlg_ColorOK), ref: 004B3838
RegisterClipboardFormatA.USER32(commdlg_help), ref: 004B3844
RegisterClipboardFormatA.USER32(commdlg_SetRGBColor), ref: 004B3850

Part of subcall function 004B97D4: SetWindowLongA.USER32(?,000000FC,00000000), ref: 004B9803

SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 004B3943

Strings

commdlg_ShareViolation, xrefs: 004B3816
commdlg_FileNameOK, xrefs: 004B3822
commdlg_ColorOK, xrefs: 004B382E
commdlg_SetRGBColor, xrefs: 004B3846
commdlg_LBSelChangedNotify, xrefs: 004B380F
commdlg_help, xrefs: 004B383A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ClipboardFormatRegister$LongMessageSendValueWindow
String ID: commdlg_ColorOK$commdlg_FileNameOK$commdlg_LBSelChangedNotify$commdlg_SetRGBColor$commdlg_ShareViolation$commdlg_help
API String ID: 3913284445-3888057576
Opcode ID: 95da53dff740d27ebd9d5cefe6eb6e14a8cce357d66334456292643dda814945
Instruction ID: a36e2ef493e0363750ed31323f170160233666201a66fd65d11094c641b030fb
Opcode Fuzzy Hash: 95da53dff740d27ebd9d5cefe6eb6e14a8cce357d66334456292643dda814945
Instruction Fuzzy Hash: 8541D670600204AFDF309F2ADC45BEE3BA1EB54751F10082BF80557360CB789A84DBBA

Function 004329C0 Relevance: 22.8, APIs: 15, Instructions: 305windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042D040: EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 0042D04F

SetStretchBltMode.GDI32(?,00000000), ref: 004329D4
CreateCompatibleDC.GDI32(?), ref: 00432A59
CreateCompatibleDC.GDI32(?), ref: 00432A71
GetObjectA.GDI32(?,00000018,?), ref: 00432AB2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 00432AC8
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00432B26
StretchBlt.GDI32(?,000000FF,?,?,?,?,00000000,00000000,?,?,00660046), ref: 00432B7F
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,008800C6), ref: 00432BB9
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 00432BF3
CreateCompatibleDC.GDI32(?), ref: 00432C6B
SelectObject.GDI32(00000000,?), ref: 00432C78
StretchBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 00432CBB
SelectObject.GDI32(00000000,?), ref: 00432CC7
DeleteDC.GDI32(00000000), ref: 00432CCE
DrawIconEx.USER32(?,?,?,?,?,?,00000000,00000000,00000003), ref: 00432D0D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Stretch$Create$CompatibleObject$Select$BitmapDeleteDisplayDrawEnumIconModeSettings
String ID:
API String ID: 1298110373-0
Opcode ID: 17b0c42d6885cc72e4cd221ffc87179e9b5915fe35b2003db02d55f8efbe42b7
Instruction ID: 732cebb6d0bab4f53a8b00d8d06611bd5af29e7a4c4710a67fc940b8051f8478
Opcode Fuzzy Hash: 17b0c42d6885cc72e4cd221ffc87179e9b5915fe35b2003db02d55f8efbe42b7
Instruction Fuzzy Hash: 3EB14871204700AFD260DB65CD85F6BB3E9FB88714F208A1DF696D7290DB74ED018BA6

Function 00444DF0 Relevance: 22.8, APIs: 15, Instructions: 255windowCOMMON

Download Yara Rule

APIs

CopyRect.USER32(?,?), ref: 00444E26

Part of subcall function 004BC3D5: __EH_prolog.LIBCMT ref: 004BC3DA
Part of subcall function 004BC3D5: CreateSolidBrush.GDI32(?), ref: 004BC3F7

FillRect.USER32(?,?,00000000), ref: 00444E64
GetSystemMetrics.USER32(0000002E), ref: 00444E8D
GetSystemMetrics.USER32(0000002D), ref: 00444E93
DrawFrameControl.USER32(?,?,00000003,?), ref: 00444F06
DrawEdge.USER32(?,?,0000000A,0000000F), ref: 00444F19
InflateRect.USER32(?,00FFFFFD,00000001), ref: 00444F34
GetSysColor.USER32(0000000F), ref: 00444F58
Rectangle.GDI32(?,?,?,?,?), ref: 00444FAB
OffsetRect.USER32(?,00000001,00000001), ref: 00445015
GetSysColor.USER32(00000014), ref: 0044501B
OffsetRect.USER32(?,000000FF,000000FF), ref: 00445043
GetSysColor.USER32(00000010), ref: 00445049
InflateRect.USER32(?,000000FF,000000FF), ref: 00445092
DrawFocusRect.USER32(?,?), ref: 004450A1

Part of subcall function 004B7A75: GetWindowTextLengthA.USER32(?), ref: 004B7A82
Part of subcall function 004B7A75: GetWindowTextA.USER32(?,00000000,00000000), ref: 004B7A9A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$ColorDraw$InflateMetricsOffsetSystemTextWindow$BrushControlCopyCreateEdgeFillFocusFrameH_prologLengthRectangleSolid
String ID:
API String ID: 4239342997-0
Opcode ID: 2a82b4b0dd6d8da0b38fd82fe8fca3203fbb1b8793f3c3952bd8ea94fc558e82
Instruction ID: 49a72ab12fcdc2d6032405124e2a8871984b2192d030dbc5794af9c6aab693b0
Opcode Fuzzy Hash: 2a82b4b0dd6d8da0b38fd82fe8fca3203fbb1b8793f3c3952bd8ea94fc558e82
Instruction Fuzzy Hash: F0A17674208745AFD304DF64C888E6ABBE9FF88714F004A1DF59687390DBB4E945CBA6

Function 00430530 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 265windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0043056D
MulDiv.KERNEL32(?,?,00000064), ref: 004305A2
MulDiv.KERNEL32(?,?,00000064), ref: 004305CD
GetDeviceCaps.GDI32 ref: 00430607
GetSystemPaletteEntries.GDI32(?,00000000,000000FF,00000004), ref: 00430641
CreatePalette.GDI32(00000000), ref: 0043064C
CreateCompatibleBitmap.GDI32(?,?,?), ref: 004306AC
CreateCompatibleDC.GDI32(?), ref: 004306DF
CreateCompatibleDC.GDI32(?), ref: 00430718
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0043077B
GlobalFree.KERNEL32(00000000), ref: 00430843

Strings

!K, xrefs: 00430683, 004307D7

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Create$Compatible$Palette$BitmapCapsDeviceEntriesFreeGlobalObjectStretchSystem
String ID: !K
API String ID: 3563226738-3405271303
Opcode ID: 53120f1a832a30ffad92112a31bb671031a1d68b3d91a20d06c8e6ffea0a48fd
Instruction ID: 9c2ae3ab6c4876c392fd83e610a567c39b90009df96435532e27a481fddcb61b
Opcode Fuzzy Hash: 53120f1a832a30ffad92112a31bb671031a1d68b3d91a20d06c8e6ffea0a48fd
Instruction Fuzzy Hash: EA919471508344ABC310EF65C895F6FB7E8FB99704F104A1EF69583281DB78E904CBAA

Function 0043BF40 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 186COMMON

Download Yara Rule

APIs

CopyRect.USER32(?,00000000), ref: 0043BFB7
IsRectEmpty.USER32(?), ref: 0043BFC2
GetClientRect.USER32(00000000,?), ref: 0043C001
DPtoLP.GDI32(?,?,00000002), ref: 0043C013
LPtoDP.GDI32(?,?,00000002), ref: 0043C050
CreateRectRgnIndirect.GDI32(?), ref: 0043C068
OffsetRect.USER32(?,?,?), ref: 0043C08D
LPtoDP.GDI32(?,?,00000002), ref: 0043C09F

Part of subcall function 004BC385: __EH_prolog.LIBCMT ref: 004BC38A
Part of subcall function 004BC385: CreatePen.GDI32(?,?,?), ref: 004BC3AD

Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,00000000), ref: 004BB98E
Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,?), ref: 004BB9A4

Part of subcall function 004BB930: GetStockObject.GDI32(?), ref: 004BB939
Part of subcall function 004BB930: SelectObject.GDI32(00411F45,00000000), ref: 004BB953
Part of subcall function 004BB930: SelectObject.GDI32(00411F45,00000000), ref: 004BB95E

Part of subcall function 004BBAA4: SetROP2.GDI32(?,?), ref: 004BBABD
Part of subcall function 004BBAA4: SetROP2.GDI32(?,?), ref: 004BBACB

Rectangle.GDI32(?,?,?,?,?), ref: 0043C113

Part of subcall function 004BBD99: SelectClipRgn.GDI32(?,00000000), ref: 004BBDBB
Part of subcall function 004BBD99: SelectClipRgn.GDI32(?,?), ref: 004BBDD1

Part of subcall function 004BC36F: DeleteObject.GDI32(00000000), ref: 004BC37E

Part of subcall function 004BC0E2: __EH_prolog.LIBCMT ref: 004BC0E7
Part of subcall function 004BC0E2: ReleaseDC.USER32(?,00000000), ref: 004BC106

Strings

!K, xrefs: 0043C12D
EK, xrefs: 0043C056
0b)u, xrefs: 0043C068

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ObjectSelect$Rect$ClipCreateH_prolog$ClientCopyDeleteEmptyIndirectOffsetRectangleReleaseStock
String ID: !K$0b)u$EK
API String ID: 2841338838-1513951853
Opcode ID: 7c6ada431c87cc00a7ae7a6f85f64cde59e9eeca772b42b998895c38f8f2f64b
Instruction ID: 828c3a915f7aaba58f62d396d373a780b7bf9e5d26f4f67b87ec60134fb92666
Opcode Fuzzy Hash: 7c6ada431c87cc00a7ae7a6f85f64cde59e9eeca772b42b998895c38f8f2f64b
Instruction Fuzzy Hash: B0614E711087409FC314DF65C885E6BBBE9EFC8718F408A1DF59693291DBB8E904CBA6

Function 00474010 Relevance: 20.0, APIs: 13, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5faa7d93065ba11cac7fbf1ee7a2e13608dd02f723b466a20a21c990ae3aa4
Instruction ID: 382fb46e6c28d9fd79ca8c9d3e576d165bd766c6498e1deaebbc00000fc0c9a5
Opcode Fuzzy Hash: 5b5faa7d93065ba11cac7fbf1ee7a2e13608dd02f723b466a20a21c990ae3aa4
Instruction Fuzzy Hash: 71E177723007059FC720DF68D884AABB3E9EBC8315F10892EF59AC7341D77AE8558B65

Function 004299D0 Relevance: 19.7, APIs: 13, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00429A1A

Part of subcall function 004B9AA6: IsWindowEnabled.USER32(?), ref: 004B9AB0

IsWindow.USER32(?), ref: 00429ABB
GetParent.USER32(?), ref: 00429AD6
IsWindowVisible.USER32(?), ref: 00429AEA
SetActiveWindow.USER32(?), ref: 00429B0B
IsWindow.USER32(?), ref: 00429B28
UpdateWindow.USER32(?), ref: 00429B36
IsWindow.USER32(?), ref: 00429B3D
IsWindow.USER32(?), ref: 00429B98
IsWindow.USER32(?), ref: 00429BF2
GetFocus.USER32 ref: 00429C06
IsWindow.USER32(00000000), ref: 00429C13
IsChild.USER32(?,00000000), ref: 00429C22

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$Parent$ActiveChildEnabledFocusUpdateVisible
String ID:
API String ID: 983273251-0
Opcode ID: a98bd25438dae7c7289637e0a7e29b91b91060ecd9f11c43117a48ed3cdfb433
Instruction ID: 4bd4014e3c73fc5f249112eda3715d0a99f8b7d4bdc76d5eddf59be085bff686
Opcode Fuzzy Hash: a98bd25438dae7c7289637e0a7e29b91b91060ecd9f11c43117a48ed3cdfb433
Instruction Fuzzy Hash: D1519171B047559BCB249FA2E844A5FBBE8FB44340F80492FF94593210DB38EC45CB69

Function 004158A0 Relevance: 19.7, APIs: 10, Strings: 1, Instructions: 430COMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 004BBD89: GetClipBox.GDI32(?,?), ref: 004BBD90

IsRectEmpty.USER32(?), ref: 004158E7
GetClientRect.USER32(?,?), ref: 004158FF
InflateRect.USER32(?,?,?), ref: 004159BD
IntersectRect.USER32(?,?,?), ref: 00415A27
CreateRectRgn.GDI32(?,?,?,?), ref: 00415A41
FillRgn.GDI32(?,?,?), ref: 00415C00
GetCurrentObject.GDI32(?,00000006), ref: 00415C7F

Part of subcall function 004BB930: GetStockObject.GDI32(?), ref: 004BB939
Part of subcall function 004BB930: SelectObject.GDI32(00411F45,00000000), ref: 004BB953
Part of subcall function 004BB930: SelectObject.GDI32(00411F45,00000000), ref: 004BB95E

OffsetRect.USER32(?,00000001,00000001), ref: 00415D5D
OffsetRect.USER32(?,00000002,00000002), ref: 00415DF1
OffsetRect.USER32(?,00000001,00000001), ref: 00415DA4

Part of subcall function 004BBB00: SetTextColor.GDI32(?,?), ref: 004BBB1A
Part of subcall function 004BBB00: SetTextColor.GDI32(?,?), ref: 004BBB28

Strings

!K, xrefs: 00415BBB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Object$Offset$ColorSelectText$BeginClientClipCreateCurrentEmptyFillH_prologInflateIntersectPaintStock
String ID: !K
API String ID: 4264835570-3405271303
Opcode ID: 8b245a1939de42c7aa72f9f126fa5c8d94ed7b5f4c23a817db494e2a15de2728
Instruction ID: 904a7627de542a74fc11a886b7f54d450d5eafdf0ffc547f762f46b88bb54919
Opcode Fuzzy Hash: 8b245a1939de42c7aa72f9f126fa5c8d94ed7b5f4c23a817db494e2a15de2728
Instruction Fuzzy Hash: 2A024771508780DFD324DF65C884AEBB7E9BFD8304F40491EF18687250EB78A985CB66

Function 0041D0E0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 316windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0041D11F
CreateCompatibleBitmap.GDI32 ref: 0041D17B
CreateCompatibleDC.GDI32(?), ref: 0041D1AB
CreateRectRgn.GDI32(00000000,00000000,00000001,?), ref: 0041D240
SetRect.USER32(?,00000000,00000000,00000001,?), ref: 0041D269

Part of subcall function 00415F50: __ftol.LIBCMT ref: 00416075
Part of subcall function 00415F50: __ftol.LIBCMT ref: 00416082

FillRgn.GDI32(?,?,?), ref: 0041D2E6
PatBlt.GDI32(?,00000000,00000000,00000001,?,00F00021), ref: 0041D359

Part of subcall function 00411510: GetSysColor.USER32(0000000F), ref: 0041151D

Part of subcall function 004BC3D5: __EH_prolog.LIBCMT ref: 004BC3DA
Part of subcall function 004BC3D5: CreateSolidBrush.GDI32(?), ref: 004BC3F7

GetObjectA.GDI32(?,00000018,?), ref: 0041D3D5
CreateCompatibleDC.GDI32(?), ref: 0041D413
BitBlt.GDI32(?,00000000,00000000,00000001,?,?,00000000,00000000,00CC0020), ref: 0041D472

Strings

!K, xrefs: 0041D2EC, 0041D305, 0041D369, 0041D4DC

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Create$CompatibleRect$__ftol$BitmapBrushClientColorFillH_prologObjectSolid
String ID: !K
API String ID: 2289681609-3405271303
Opcode ID: c74065bd95cfe5d0d26fc975a1b99916fa88e27c97b3205d1e506bc47ef562ba
Instruction ID: 59704fb123a603bed9161cc1daa8395750608d093278f096ef4a0b6251094e99
Opcode Fuzzy Hash: c74065bd95cfe5d0d26fc975a1b99916fa88e27c97b3205d1e506bc47ef562ba
Instruction Fuzzy Hash: 9BC19FB15083419FC314DB65C885FAFB7E8AF88708F04491EF59AC3251EB78E849CB66

Function 004236C0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 310libraryregistryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00506D88,00000000), ref: 004237A4
LoadLibraryA.KERNEL32(?,?,00000000,?,?,?,004E4D0C,?,?,?,?,?,?,00000000,00506D88,00000000), ref: 004237E1
GetProcAddress.KERNEL32(00000000,DllRegisterServer), ref: 00423817
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,00000000,00506D88,00000000), ref: 00423822
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,00000000,00506D88,00000000), ref: 00423830
LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0042393D
RegisterTypeLib.OLEAUT32(00000000,00000000), ref: 00423972
CLSIDFromString.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00506D88,00000000), ref: 00423A37
UnRegisterTypeLib.OLEAUT32(?,00000000,00000000,00000000,00000001), ref: 00423A53

Strings

DllRegisterServer, xrefs: 00423809
DllUnregisterServer, xrefs: 00423810, 00423815

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Library$LoadType$FreeRegister$AddressFromProcString
String ID: DllRegisterServer$DllUnregisterServer
API String ID: 2476498075-2931954178
Opcode ID: 177d68d017236563fd0f777e579d060566dbd66532d4484f21da7a38e3932ed9
Instruction ID: afbe405f6b6ecd39ebb82d06c2cd25f9d949442d9d08c66c4377ac4b7f786dc1
Opcode Fuzzy Hash: 177d68d017236563fd0f777e579d060566dbd66532d4484f21da7a38e3932ed9
Instruction Fuzzy Hash: B0B1D7B0A00219ABDB10EFA4D845FEFB3B8EF44314F50451EF815AB281DB7CAA45CB65

Function 004B1370 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,004D5C6C,00000001,004D5C6C,00000001,00000000,0246119C,0000000C,00000000,0000000C,00000000,000001D0,00000000,00000000,004A40C2), ref: 004B13AE
CompareStringA.KERNEL32(00000000,00000000,004D5C68,00000001,004D5C68,00000001), ref: 004B13CB
CompareStringA.KERNEL32(00463596,00000000,00000000,00000000,004A40C2,00000000,00000000,0246119C,0000000C,00000000,0000000C,00000000,000001D0,00000000,00000000,004A40C2), ref: 004B1429
GetCPInfo.KERNEL32(00000000,00000000,00000000,0246119C,0000000C,00000000,0000000C,00000000,000001D0,00000000,00000000,004A40C2,00000000), ref: 004B147A
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000), ref: 004B14F9
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 004B155A
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,?,00000000,00000000), ref: 004B156D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 004B15B9
CompareStringW.KERNEL32(00463596,00000000,00000000,00000000,?,00000000,?,00000000), ref: 004B15D1

Strings

h\M, xrefs: 004B13C1
l\M, xrefs: 004B13A4

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide$Info
String ID: h\M$l\M
API String ID: 1651298574-2397351120
Opcode ID: 670ca7ee67a206c59ac224fc19d67b659b74eb283972cff245e5551d59dd5f40
Instruction ID: 151ce1fa9c32d1bcf6b4b065a368749d2143a78b1a1549488385fae65898e8fc
Opcode Fuzzy Hash: 670ca7ee67a206c59ac224fc19d67b659b74eb283972cff245e5551d59dd5f40
Instruction Fuzzy Hash: 2B71C271900249AFCF218F91DCA1DEF7BB9EB05314F94412BF852A2270C7399951DBB9

Function 004AC6E4 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004D5C6C,00000001,00000000,00000000,74DEE860,00537CE4,?,?,?,004A57ED,?,?,?,00000000), ref: 004AC726
LCMapStringA.KERNEL32(00000000,00000100,004D5C68,00000001,00000000,00000000,?,?,004A57ED,?,?,?,00000000,00000001), ref: 004AC742
LCMapStringA.KERNEL32(?,?,?,WJ,?,?,74DEE860,00537CE4,?,?,?,004A57ED,?,?,?,00000000), ref: 004AC78B
MultiByteToWideChar.KERNEL32(?,?,?,WJ,00000000,00000000,74DEE860,00537CE4,?,?,?,004A57ED,?,?,?,00000000), ref: 004AC7C3
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,004A57ED,?,?,?,00000000,00000001), ref: 004AC81B
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,004A57ED,?,?,?,00000000,00000001), ref: 004AC831
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,004A57ED,?,?,?,00000000,00000001), ref: 004AC864
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,004A57ED,?,?,?,00000000,00000001), ref: 004AC8CC

Strings

|S, xrefs: 004AC7B4, 004AC7BF
WJ, xrefs: 004AC7AE, 004AC810, 004AC77F, 004AC75F

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: WJ$|S
API String ID: 352835431-1774375694
Opcode ID: 5f5d2636e7075ce8abb222ea3ab2c2594fe1a7452655e910dc683c15d6369c1e
Instruction ID: 90349d7fb4d8ae5bd1ffdc894957fd0ed116e8bf31109b31cf4344b0c351c666
Opcode Fuzzy Hash: 5f5d2636e7075ce8abb222ea3ab2c2594fe1a7452655e910dc683c15d6369c1e
Instruction Fuzzy Hash: 5251AC71900209EFCF619F95CC85EEF7BB8FB6AB51F10412AF901A1260D33A9D50DB68

Function 00419B30 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 130stringprocessCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,?), ref: 00419BC8
lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?,?,?,?), ref: 00419C07
lstrlenA.KERNEL32(?), ref: 00419C5C
lstrcatA.KERNEL32(00000000,004E4D20), ref: 00419CA5
lstrcatA.KERNEL32(00000000,?), ref: 00419CAD
WinExec.KERNEL32(?,?), ref: 00419CB5

Part of subcall function 004B56A7: InterlockedDecrement.KERNEL32(-000000F4), ref: 004B56BB

Strings

mailto:, xrefs: 00419B96
open, xrefs: 00419BC1
.htm, xrefs: 00419BE0
\shell\open\command, xrefs: 00419C01
"%1", xrefs: 00419C2B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: lstrcat$DecrementExecExecuteInterlockedShelllstrlen
String ID: "%1"$.htm$\shell\open\command$mailto:$open
API String ID: 51986957-2182632014
Opcode ID: 158136ad879311c30589511cb8d6456e4ff847f5dbc4e1fe2d1503ec4994f3e0
Instruction ID: 2d80229a4ab24653fe7730edb8d81be5a4f4b721de138a97458bb43061ed783f
Opcode Fuzzy Hash: 158136ad879311c30589511cb8d6456e4ff847f5dbc4e1fe2d1503ec4994f3e0
Instruction Fuzzy Hash: D041E431244742ABC324EB65DC80FEBB3E4AB94750F104A1EF59593280E778AC45CBAA

Function 00431B80 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 405COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,?,?), ref: 00431C26

Part of subcall function 00431950: SetRect.USER32(?,00000000,00000032,00000032,?), ref: 00431A39
Part of subcall function 00431950: OffsetRect.USER32(?,?,?), ref: 00431A46
Part of subcall function 00431950: IntersectRect.USER32(?,?,?), ref: 00431A62
Part of subcall function 00431950: IsRectEmpty.USER32(?), ref: 00431A6D

InflateRect.USER32(?,?,?), ref: 00431C99
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00431E9D
GetClipRgn.GDI32(?,00000000), ref: 00431EAC
CreatePolygonRgn.GDI32 ref: 00431F2A
SelectClipRgn.GDI32(?,?), ref: 0043200D
CreatePolygonRgn.GDI32(?,00000005,00000002), ref: 00432030
SelectClipRgn.GDI32(?,?), ref: 004320B1
DeleteObject.GDI32(?), ref: 004320C7

Strings

gfff, xrefs: 00431D8D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$ClipCreate$InflatePolygonSelect$DeleteEmptyIntersectObjectOffset
String ID: gfff
API String ID: 1105800552-1553575800
Opcode ID: 9e7bb3d75ccc64f2470bd2f69dbdbe9fec954d8071b2a7f1fe9c0ab9e7372e01
Instruction ID: 4fffa796f9c627ac5700dcb07f384e49138b0eb9d169a75bfeef2a415bf30e8a
Opcode Fuzzy Hash: 9e7bb3d75ccc64f2470bd2f69dbdbe9fec954d8071b2a7f1fe9c0ab9e7372e01
Instruction Fuzzy Hash: ABF117746083419FD364CF19C980B6BBBE5BBC9704F108A2EF99987360E774A845CF56

Function 004B64A1 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004B64A6
GetSystemMetrics.USER32(0000002A), ref: 004B6557
GlobalLock.KERNEL32(?,?,00000000,?,?), ref: 004B65E1
CreateDialogIndirectParamA.USER32(?,?,?,Function_000B62E9,00000000), ref: 004B6613

Strings

MS Sans Serif, xrefs: 004B6578
MS Shell Dlg, xrefs: 004B6565
Helv, xrefs: 004B658B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CreateDialogGlobalH_prologIndirectLockMetricsParamSystem
String ID: Helv$MS Sans Serif$MS Shell Dlg
API String ID: 2364537584-2894235370
Opcode ID: f23e2d92ea716db406169ea03797faf8a809055094cde564b15bacaaa998ad31
Instruction ID: e64f00e1eb1cf934841bbb1f6185592c1a9089b7527c6f6ddcc8e5fb16b9c31a
Opcode Fuzzy Hash: f23e2d92ea716db406169ea03797faf8a809055094cde564b15bacaaa998ad31
Instruction Fuzzy Hash: B1618E31A0020AEFCF14EFA5D8859EEBBB1FF14305F21443FE505A2291DB789A51CB69

Function 00455020 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

GetTextExtentPoint32A.GDI32(?,?,?,00000090), ref: 0045509F
GetTextExtentPoint32A.GDI32(?,?,?,00000090), ref: 004550C4
GetWindowRect.USER32(?,?), ref: 0045514E
SetRect.USER32(00000080,?,?,?,?), ref: 00455183
SetRect.USER32(00000070,?,?,?,?), ref: 004551C8
SetRect.USER32(00000060,?,?,?,?), ref: 0045523B
GetSystemMetrics.USER32(00000001), ref: 00455266
GetSystemMetrics.USER32(00000000), ref: 0045526C
OffsetRect.USER32(00000080,00000000,00000000), ref: 00455284
OffsetRect.USER32(00000080,00000000,00000000), ref: 00455292
OffsetRect.USER32(00000080,00000000,00000000), ref: 004552A4

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Offset$ExtentMetricsPoint32SystemText$Window
String ID:
API String ID: 1551820068-0
Opcode ID: 235661f1b19a081a8e932bebb3957b2297ee016cb4944081ee03fd52c5313fb7
Instruction ID: f6187045d4614e6b0a9593fb52db526b7ae2e0ecd4f1cd690813b6edb028f6b0
Opcode Fuzzy Hash: 235661f1b19a081a8e932bebb3957b2297ee016cb4944081ee03fd52c5313fb7
Instruction Fuzzy Hash: 0C914670200B05AFD318CF29C995E6AF7E6FB88700F148A2DA95AC7755EB74FC098B54

Function 004472F0 Relevance: 16.7, APIs: 11, Instructions: 185windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0044731E
FillRect.USER32(?,?,00000000), ref: 0044737E
FillRect.USER32(?,?,00000000), ref: 004473EE

Part of subcall function 004BC3D5: __EH_prolog.LIBCMT ref: 004BC3DA
Part of subcall function 004BC3D5: CreateSolidBrush.GDI32(?), ref: 004BC3F7

FillRect.USER32(?,?,00000000), ref: 00447465
CreateCompatibleDC.GDI32(?), ref: 0044748D
SelectObject.GDI32(00000000,?), ref: 004474A3
SetStretchBltMode.GDI32(?,00000000), ref: 004474D5
StretchBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00447508
BitBlt.GDI32(?,00000000,?,?,?,00000000,00000000,00000000,00CC0020), ref: 00447533
SelectObject.GDI32(00000000,?), ref: 0044753F
DeleteDC.GDI32(00000000), ref: 0044754C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Fill$CreateObjectSelectStretch$BrushClientCompatibleDeleteH_prologModeSolid
String ID:
API String ID: 1645634290-0
Opcode ID: 15f51d368038fe63d918547a1e2dae3c30bf06ab6a5ca4ee2b8a863a705ffeb6
Instruction ID: aaf3df16af4bceb0891c53b2c2d1c48900d0a4f08a455647602f8fb1322a5f6e
Opcode Fuzzy Hash: 15f51d368038fe63d918547a1e2dae3c30bf06ab6a5ca4ee2b8a863a705ffeb6
Instruction Fuzzy Hash: B7612DB5204701AFE724DF65C984F6BB7E9BF88704F00891EF95A87240DB34E906CB65

Function 0041DB10 Relevance: 16.7, APIs: 11, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetCurrentObject.GDI32(?,00000001), ref: 0041DB49
GetCurrentObject.GDI32(?,00000002), ref: 0041DB93
GetCurrentObject.GDI32(?,00000006), ref: 0041DBDD
GetTextColor.GDI32(?), ref: 0041DC1C
GetBkMode.GDI32(?), ref: 0041DC46
GetBkColor.GDI32(?), ref: 0041DC65
GetBkMode.GDI32(?), ref: 0041DC88
GetBkColor.GDI32(?), ref: 0041DCA7
GetROP2.GDI32(?), ref: 0041DCCF
GetStretchBltMode.GDI32(?), ref: 0041DCF0
GetPolyFillMode.GDI32(?), ref: 0041DD1C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Mode$ColorCurrentObject$FillPolyStretchText
String ID:
API String ID: 544274770-0
Opcode ID: 3ec680a315a8ec995a532adf4794f8715b9679bb4f6ea509aa0f5fc06d02ba39
Instruction ID: 1fed875718b3a3b370b126b64ca06eab5a774b4f978ca174bea6d8de44933f2d
Opcode Fuzzy Hash: 3ec680a315a8ec995a532adf4794f8715b9679bb4f6ea509aa0f5fc06d02ba39
Instruction Fuzzy Hash: 6D515FB1614B019BC764DB64C888FEBB3A5EF84305F154A1DE26B87260DF78F885CB58

Function 00444720 Relevance: 16.6, APIs: 11, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

GetClientRect.USER32(?,?), ref: 0044475D
CreateCompatibleBitmap.GDI32 ref: 00444792
CreateCompatibleDC.GDI32(?), ref: 004447C2

Part of subcall function 004BB919: SelectObject.GDI32(?,?), ref: 004BB921

PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 004447FA
GetObjectA.GDI32(00000000,00000018,?), ref: 00444815
CreateCompatibleDC.GDI32(?), ref: 00444820
SelectObject.GDI32(00000000,00000000), ref: 00444830
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00444853
SelectObject.GDI32(00000000,?), ref: 0044485F
DeleteDC.GDI32(00000000), ref: 00444862
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0044488B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Object$CompatibleCreateSelect$BeginBitmapClientDeleteH_prologPaintRect
String ID:
API String ID: 1593221388-0
Opcode ID: 27bb66107624f5e38b3bf9d14ef1fca9daa0f40209f82169e2055ef77b337fc9
Instruction ID: 64047e55b7f3a68e5406390a2a883a2324bf637d19019594a46c0a125c13a844
Opcode Fuzzy Hash: 27bb66107624f5e38b3bf9d14ef1fca9daa0f40209f82169e2055ef77b337fc9
Instruction Fuzzy Hash: A3516E75608345AFD350DFA5DC89F6FBBE8EBC9704F04492DB58583281DBB8E8048B66

Function 0047A0D0 Relevance: 16.6, APIs: 11, Instructions: 121COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 0047A128
GetSysColor.USER32(0000000F), ref: 0047A15B
CreateSolidBrush.GDI32(00BD9E7B), ref: 0047A16B
FrameRect.USER32(?,?,00000000), ref: 0047A184
DeleteObject.GDI32(00000000), ref: 0047A187
InflateRect.USER32(?,000000FF,000000FF), ref: 0047A19C
GetSysColorBrush.USER32(?), ref: 0047A1AE
FrameRect.USER32(?,?,00000000), ref: 0047A1C1
InflateRect.USER32(?,000000FF,000000FF), ref: 0047A1CC
GetSystemMetrics.USER32(00000009), ref: 0047A1D0
FrameRect.USER32(00000001,?,00000000), ref: 0047A1EB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Frame$BrushColorInflate$CreateDeleteMetricsObjectSolidSystemWindow
String ID:
API String ID: 3415418889-0
Opcode ID: 9d0daf9d8f99e38c75343b7775a664ec9ff0a594c74acec8de176aae0421a4f9
Instruction ID: b72930e791edc3e34ccb8a0ad5a22d87b1d0dd13718b31e2cfd3c73c905d5aac
Opcode Fuzzy Hash: 9d0daf9d8f99e38c75343b7775a664ec9ff0a594c74acec8de176aae0421a4f9
Instruction Fuzzy Hash: 59414971108346AFC300DF29C884D6FB7E8FBC8714F048E1DF5A993294DA35E9498B6A

Function 0042C8C0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 181windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 004BBD89: GetClipBox.GDI32(?,?), ref: 004BBD90

IsRectEmpty.USER32(?), ref: 0042C90D
GetSysColor.USER32(0000000F), ref: 0042C91E

Part of subcall function 004BC3D5: __EH_prolog.LIBCMT ref: 004BC3DA
Part of subcall function 004BC3D5: CreateSolidBrush.GDI32(?), ref: 004BC3F7

Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,00000000), ref: 004BB98E
Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,?), ref: 004BB9A4

PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 0042C968
GetClientRect.USER32(?,?), ref: 0042C981
LoadBitmapA.USER32(?,?), ref: 0042C9B8
GetObjectA.GDI32(?,00000018,?), ref: 0042CA07
CreateCompatibleDC.GDI32(?), ref: 0042CA2D
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0042CABF

Strings

!K, xrefs: 0042C9CC, 0042CAE8

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Object$CreateH_prologRectSelect$BeginBitmapBrushClientClipColorCompatibleEmptyLoadPaintSolid
String ID: !K
API String ID: 1390316934-3405271303
Opcode ID: cdafde65befbecc551c122d9c89edde9f1177e238a3dd948595a4140757c14bd
Instruction ID: 94ac06ba339eba3dbe6a698271c9882734d29ce6361c41cbcd0f27d7939cdfc3
Opcode Fuzzy Hash: cdafde65befbecc551c122d9c89edde9f1177e238a3dd948595a4140757c14bd
Instruction Fuzzy Hash: 2A614D712083819FD314DB65C885FAFBBE9FBC4704F048A2DF59993281DB78A904CB66

Function 004B0B30 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,004A92E2,?,Microsoft Visual C++ Runtime Library,00012010,?,004D59DC,?,004D5A2C,?,?,?,Runtime Error!Program: ), ref: 004B0B42
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004B0B5A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 004B0B6B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 004B0B78

Strings

GetLastActivePopup, xrefs: 004B0B6D
MessageBoxA, xrefs: 004B0B54
GetActiveWindow, xrefs: 004B0B65
user32.dll, xrefs: 004B0B3D
,ZM, xrefs: 004B0B9E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: ,ZM$GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-2555032862
Opcode ID: 6eed69bef0bad6b841be6c2a964d9aed4f5a37d7e5fef71742537278c9196db4
Instruction ID: 2ccbe839c2fa37ab3b6937e8a611742b8f13f6e225a6f5eb8ba141c05254e460
Opcode Fuzzy Hash: 6eed69bef0bad6b841be6c2a964d9aed4f5a37d7e5fef71742537278c9196db4
Instruction Fuzzy Hash: 94014431704702AF87119FF5AC84E6B7EE8EBB4785305443BA605C2321EB78A849EF75

Function 0040E590 Relevance: 15.3, APIs: 10, Instructions: 324COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0040E5BB
VariantInit.OLEAUT32(00000000), ref: 0040E5EA
VariantCopyInd.OLEAUT32(00000000), ref: 0040E5F2
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 0040E695

Part of subcall function 0042B750: RtlAllocateHeap.NTDLL(00560000,00000000,?), ref: 0042B761

VariantCopyInd.OLEAUT32(?), ref: 0040E875
VariantChangeType.OLEAUT32(00000000,?,00000000,?), ref: 0040E890

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Variant$CopyInit$AllocateArrayChangeElementHeapSafeType
String ID:
API String ID: 2026756349-0
Opcode ID: 669d2402d5bde8c958acd08ba2f69708c0a113abecd3ce215565b3cdb8d30735
Instruction ID: 4c3d88eb889cc562baf6b3401980fbab7f3039a8614402d07a4841e6bd4c7980
Opcode Fuzzy Hash: 669d2402d5bde8c958acd08ba2f69708c0a113abecd3ce215565b3cdb8d30735
Instruction Fuzzy Hash: EFD15DB56083418FC314DF16C841A6ABBE5FF88314F10893EF89997391D738E996CB96

Function 0040EDF0 Relevance: 15.3, APIs: 10, Instructions: 301COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0040EE42
VariantClear.OLEAUT32 ref: 0040EEC5
SafeArrayPutElement.OLEAUT32 ref: 0040EF3F
VariantClear.OLEAUT32(?), ref: 0040EF4E
VariantCopyInd.OLEAUT32 ref: 0040EFD1
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 0040F125
VariantClear.OLEAUT32 ref: 0040F130

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Variant$Clear$ArrayChangeCopyElementInitSafeType
String ID:
API String ID: 2581279852-0
Opcode ID: 1df25a4d180b58888a2d93c15ac172467e19c65099eedf0c1f29e69003021224
Instruction ID: 197265d8b71e607d2f99ff2ab46e5803b058e1fc65e2d1018cf0c9797f484154
Opcode Fuzzy Hash: 1df25a4d180b58888a2d93c15ac172467e19c65099eedf0c1f29e69003021224
Instruction Fuzzy Hash: A2B1A175214702CBC724DF16D880A6BB7E4EF84304F14497FE8859B7A1E378E989CB5A

Function 0042F310 Relevance: 15.3, APIs: 10, Instructions: 288COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(00FFFFFF), ref: 0042F46F
GetWindowRect.USER32(?), ref: 0042F499
GetStockObject.GDI32(00000005), ref: 0042F4C7
LoadCursorA.USER32(00000000,00007F00), ref: 0042F4D5
GetWindowRect.USER32(?,?), ref: 0042F543
GetWindowRect.USER32(?,?), ref: 0042F554
GetWindowRect.USER32(?,?), ref: 0042F569
GetSystemMetrics.USER32(00000001), ref: 0042F57F
GetWindowRect.USER32(?,?), ref: 0042F60A
OffsetRect.USER32(?,00000000,00000001), ref: 0042F624

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Window$BrushCreateCursorLoadMetricsObjectOffsetSolidStockSystem
String ID:
API String ID: 3805611468-0
Opcode ID: c9ee09039dc7919a31e0d2b105758830747773353c73bea17dbcbda1d1d460fb
Instruction ID: 11491c165a0a11f42c1d37cb1a52c36ad6bc6737e2c0e24a3634703799c92b5f
Opcode Fuzzy Hash: c9ee09039dc7919a31e0d2b105758830747773353c73bea17dbcbda1d1d460fb
Instruction Fuzzy Hash: 16A1CF70704701AFD714EF25C885F6FB7E6AB88704F90492EF6568B281DB78E8058B69

Function 0041CCD0 Relevance: 15.2, APIs: 10, Instructions: 198windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 004BBD89: GetClipBox.GDI32(?,?), ref: 004BBD90

GetClientRect.USER32(?,?), ref: 0041CD1E
IntersectRect.USER32(?,?,?), ref: 0041CD36
IsRectEmpty.USER32(?), ref: 0041CD66
GetObjectA.GDI32(?,00000018,?), ref: 0041CD9D
CreateCompatibleDC.GDI32(?), ref: 0041CDC3
IntersectRect.USER32(?,?,?), ref: 0041CE18
IsRectEmpty.USER32(?), ref: 0041CE23
BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 0041CE61
DPtoLP.GDI32(?,?,00000002), ref: 0041CEE6
IsWindow.USER32(?), ref: 0041CF48

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$EmptyIntersect$BeginClientClipCompatibleCreateH_prologObjectPaintWindow
String ID:
API String ID: 29348440-0
Opcode ID: 34b48d8772fe510f790f6b03fcd6702e25e8498187ed524edf49f3bc1ecf84e9
Instruction ID: 913801c98ceeba6dee9f5c41f137b95c8bce8becdca8ba93c2032f293785ac32
Opcode Fuzzy Hash: 34b48d8772fe510f790f6b03fcd6702e25e8498187ed524edf49f3bc1ecf84e9
Instruction Fuzzy Hash: 1E813CB55487419FC324DF65C884EABB7E9FBC8704F008E2EF59A83250D734A909CB66

Function 0042DBE0 Relevance: 15.2, APIs: 10, Instructions: 179COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0042DBFD
GetWindowRect.USER32(?,?), ref: 0042DC0C
IntersectRect.USER32(?,?,?), ref: 0042DC65
EqualRect.USER32(?,?), ref: 0042DC95
GetWindowRect.USER32(?,?), ref: 0042DCB3
OffsetRect.USER32(?,?,?), ref: 0042DD2A
OffsetRect.USER32(?,?,00000000), ref: 0042DD44
OffsetRect.USER32(?,?,00000000), ref: 0042DD5C
OffsetRect.USER32(?,00000000,?), ref: 0042DD76
OffsetRect.USER32(?,00000000,?), ref: 0042DD8E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Offset$Window$EqualIntersect
String ID:
API String ID: 2638238157-0
Opcode ID: 0a7e89b57e91288b4e1d50f7de616cc781b0a4589392cc6f684304c1e137a9e1
Instruction ID: e27cb0f653d2e8080e4fc0bd2d439da0d6a894986ac5eeb05247f14d5a355b73
Opcode Fuzzy Hash: 0a7e89b57e91288b4e1d50f7de616cc781b0a4589392cc6f684304c1e137a9e1
Instruction Fuzzy Hash: EE511AB16183029FC708CF29D98096FBBE9ABC8744F404A2EF986D3354DA74ED45CB56

Function 004451A0 Relevance: 15.1, APIs: 10, Instructions: 86COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000002E), ref: 004451B1
GetSystemMetrics.USER32(0000002D), ref: 004451B7
GetSystemMetrics.USER32(0000000A), ref: 004451BD
GetSystemMetrics.USER32(0000000A), ref: 004451C8
GetSystemMetrics.USER32(00000009), ref: 004451D6
GetSystemMetrics.USER32(00000009), ref: 004451E2
GetWindowRect.USER32(?,?), ref: 00445207
GetParent.USER32(?), ref: 0044520D
GetWindowRect.USER32(?,00000000), ref: 00445232
SetRect.USER32(?,?,00000000,?,?), ref: 00445264

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MetricsSystem$Rect$Window$Parent
String ID:
API String ID: 3457858938-0
Opcode ID: c0e0b2f9682405f3cf5977a6fd815351065c7e50e7b696fcebb585ed8130ad82
Instruction ID: 30fad2f9fca2dc95b394ad9c85671716486f9e281846a3aba7a90df1e55815c0
Opcode Fuzzy Hash: c0e0b2f9682405f3cf5977a6fd815351065c7e50e7b696fcebb585ed8130ad82
Instruction Fuzzy Hash: B1217471A047096FDB04DF68EC4596F77A9EBC4700F00492EB905D7285DBB4ED098BA6

Function 004AFEE8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004D5C6C,00000001,?,74DEE860,00537CE4,?,?,004A57ED,?,?,?,00000000,00000001), ref: 004AFF27
GetStringTypeA.KERNEL32(00000000,00000001,004D5C68,00000001,?,?,004A57ED,?,?,?,00000000,00000001), ref: 004AFF41
GetStringTypeA.KERNEL32(?,?,?,?,WJ,74DEE860,00537CE4,?,?,004A57ED,?,?,?,00000000,00000001), ref: 004AFF75
MultiByteToWideChar.KERNEL32(?,|S,?,?,00000000,00000000,74DEE860,00537CE4,?,?,004A57ED,?,?,?,00000000,00000001), ref: 004AFFAD
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,004A57ED,?), ref: 004B0003
GetStringTypeW.KERNEL32(?,?,00000000,WJ,?,?,?,?,?,?,004A57ED,?), ref: 004B0015

Strings

|S, xrefs: 004AFF9E, 004AFFA9
WJ, xrefs: 004B000D, 004AFF68

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: WJ$|S
API String ID: 3852931651-1774375694
Opcode ID: ca4224bf40dbae586c1717791637f73d23849ea4e68882245576fdfe17dc1560
Instruction ID: 82e77a322c22e284782bad6f42f2ccfaec276272571b318e1f9a72d185b9ab9e
Opcode Fuzzy Hash: ca4224bf40dbae586c1717791637f73d23849ea4e68882245576fdfe17dc1560
Instruction Fuzzy Hash: ED418C72600249AFCF209F94DC85EEF7FB8EB1A750F10052BFA11D62A0C3389955DBA4

Function 004A91BE Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 004A922B
GetStdHandle.KERNEL32(000000F4,004D59DC,00000000,00000000,00000000,?), ref: 004A9301
WriteFile.KERNEL32(00000000), ref: 004A9308

Strings

Runtime Error!Program: , xrefs: 004A9291
Microsoft Visual C++ Runtime Library, xrefs: 004A92D7
~O, xrefs: 004A91CC
..., xrefs: 004A927D
<program name unknown>, xrefs: 004A923B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $~O
API String ID: 3784150691-2062886391
Opcode ID: e2dc62992d48261115c0761d1507818c3cde71decec62f8fb8a5d003869e7737
Instruction ID: a018d2b816e916cd301b6246a66a72a144bb041c27c491b9963370b9387ab63a
Opcode Fuzzy Hash: e2dc62992d48261115c0761d1507818c3cde71decec62f8fb8a5d003869e7737
Instruction Fuzzy Hash: DA31D432A002186EDF20E660CC95FAE376CEF56304F5005ABF545D6251D678ED808B6D

Function 004BB57E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 004BB59A
GetStockObject.GDI32(0000000D), ref: 004BB5A2
GetObjectA.GDI32(00000000,0000003C,?), ref: 004BB5AF
GetDC.USER32(00000000), ref: 004BB5BE
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004BB5D5
MulDiv.KERNEL32(?,00000048,00000000), ref: 004BB5E1
ReleaseDC.USER32(00000000,00000000), ref: 004BB5EC

Strings

System, xrefs: 004BB593, 004BB602

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 2aedcf10a7a12db3ba624b76bcdc709a774c92e60ebcf4985eb3c98f3fca9e97
Instruction ID: 86a83490b5d4bf0c406daa1b1e3e6d49ab94c085ecce652c1cf46716fad1adb2
Opcode Fuzzy Hash: 2aedcf10a7a12db3ba624b76bcdc709a774c92e60ebcf4985eb3c98f3fca9e97
Instruction Fuzzy Hash: A9118671A40618BBEB109BA5DC09FEE7B78EF04785F004026F605E6190DBB59D418BA9

Function 004B9484 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,004B977E,?,00020000), ref: 004B948D
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 004B9496
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004B94AA
#17.COMCTL32 ref: 004B94C5
#17.COMCTL32 ref: 004B94E1
FreeLibrary.KERNEL32(00000000), ref: 004B94ED

Strings

InitCommonControlsEx, xrefs: 004B94A2
COMCTL32.DLL, xrefs: 004B9486, 004B948C, 004B9493

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx
API String ID: 1437655972-4218389149
Opcode ID: 6d218096af2711690e188c40d3fb2bc0e9c070ad22ce58b6fce439f83518cadb
Instruction ID: d411b55b3d2c419a676fcac492e53c89e01e9c6fa99bf41c22ffbf5d0d3a3928
Opcode Fuzzy Hash: 6d218096af2711690e188c40d3fb2bc0e9c070ad22ce58b6fce439f83518cadb
Instruction Fuzzy Hash: 78F0F436608A534B87216F75AC4896F72ACAF847623150836FA04E3310CB68EC46877E

Function 004291E0 Relevance: 13.9, APIs: 9, Instructions: 387windowCOMMON

Download Yara Rule

APIs

IsChild.USER32(?,?), ref: 00429218
GetParent.USER32(?), ref: 004292A9
IsWindow.USER32(?), ref: 004293DB
IsWindowVisible.USER32(?), ref: 004293ED

Part of subcall function 004B9AA6: IsWindowEnabled.USER32(?), ref: 004B9AB0

GetParent.USER32(?), ref: 0042943E
IsChild.USER32(?,?), ref: 0042945E
GetParent.USER32(?), ref: 00429607
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 00429624
IsWindow.USER32(?), ref: 0042967F

Part of subcall function 0041F660: IsChild.USER32(?,?), ref: 0041F6DD
Part of subcall function 0041F660: GetParent.USER32(?), ref: 0041F6F7

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ParentWindow$Child$EnabledMessageSendVisible
String ID:
API String ID: 2452671399-0
Opcode ID: 8418259a6152918583240118bd2c68a7342648d0147d58160aae0b2023d0eba1
Instruction ID: 7559f0c9cfa3384107e0d89d1c93367d577246900dad8105c6b01e8c0c2fb856
Opcode Fuzzy Hash: 8418259a6152918583240118bd2c68a7342648d0147d58160aae0b2023d0eba1
Instruction Fuzzy Hash: 0EE1A0716043619FC720DF25D880B6BB7E5BF85704F840A2EF98597281DB78EC45CB9A

Function 0041AB20 Relevance: 13.8, APIs: 9, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7fe31fcb80df2e636eac4716612056e6118d374632d00ddecd54d4938640ed
Instruction ID: 65df4e681c00b6a59a7dce6ceca6de18777126d947af074f2dc0b08d781cb004
Opcode Fuzzy Hash: 2f7fe31fcb80df2e636eac4716612056e6118d374632d00ddecd54d4938640ed
Instruction Fuzzy Hash: 4181DEB23016019FD720DF68DCC5EABB3A9EB94354F00492EF142CB3A1D775E8868795

Function 0042D980 Relevance: 13.6, APIs: 9, Instructions: 118COMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 0042D986
ClientToScreen.USER32(?,?), ref: 0042D9C3
OffsetRect.USER32(?,?,?), ref: 0042D9EC
GetParent.USER32(?), ref: 0042D9F2

Part of subcall function 004BBEDE: ScreenToClient.USER32(?,75C07310), ref: 004BBEF2
Part of subcall function 004BBEDE: ScreenToClient.USER32(?,75C07318), ref: 004BBEFB

GetClientRect.USER32(?,?), ref: 0042DA15
OffsetRect.USER32(?,?,00000000), ref: 0042DA33
OffsetRect.USER32(?,?,00000000), ref: 0042DA4B
OffsetRect.USER32(?,00000000,?), ref: 0042DA69
OffsetRect.USER32(?,00000000,?), ref: 0042DA89

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Offset$Client$Screen$CaptureParent
String ID:
API String ID: 838496554-0
Opcode ID: 83d6c97916629be404d3280f220b594ef0d562f80496ca39acdf60de4b64bc34
Instruction ID: 3deb47973fbd345fbe5d187ff4e6091b425a440051b772271b103e1fa6e50ee5
Opcode Fuzzy Hash: 83d6c97916629be404d3280f220b594ef0d562f80496ca39acdf60de4b64bc34
Instruction Fuzzy Hash: DC4108B5608302AFD718DF68D984D7FB7E9ABC8700F008A1EF586C3254DA74ED458A66

Function 0042B020 Relevance: 13.6, APIs: 9, Instructions: 85windowCOMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,?,00000001,?,?,?,?), ref: 0042B03A
GetTopWindow.USER32(?), ref: 0042B040
IsWindowVisible.USER32(00000000), ref: 0042B051
GetWindowLongA.USER32(00000000,000000EC), ref: 0042B062
GetClientRect.USER32(00000000,?), ref: 0042B0B5
IntersectRect.USER32(?,?,?), ref: 0042B0CA
IsRectEmpty.USER32(?), ref: 0042B0D5
InvalidateRect.USER32(00000000,00000000,00000000,?,?,?,?), ref: 0042B0E6
GetWindow.USER32(00000000,00000002), ref: 0042B0EB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Window$Invalidate$ClientEmptyIntersectLongVisible
String ID:
API String ID: 938479747-0
Opcode ID: 424ae410c1ca9d58923b4adc4198eac1af621c066620b1d50efafa4a0e7ff346
Instruction ID: f13fca7d5397b93ad1841cc5619648833404bcd6d01014f89d2961cf40d360e3
Opcode Fuzzy Hash: 424ae410c1ca9d58923b4adc4198eac1af621c066620b1d50efafa4a0e7ff346
Instruction Fuzzy Hash: 32219C71204712AF8311DF15DC84DAFB7ADFF88304B444A2EF95492240EB38E949CBA9

Function 004B3394 Relevance: 13.6, APIs: 9, Instructions: 80windowstringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,0000000C,?,?,0042F799,?,-00000001,00000000,?,?,?,004E9C90), ref: 004B339E
GetFocus.USER32 ref: 004B33B9

Part of subcall function 004B75C4: UnhookWindowsHookEx.USER32(?), ref: 004B75E9

IsWindowEnabled.USER32(?), ref: 004B33E2
EnableWindow.USER32(?,00000000), ref: 004B33F4
GetOpenFileNameA.COMDLG32(?,?), ref: 004B341F
GetSaveFileNameA.COMDLG32(?,?), ref: 004B3426
EnableWindow.USER32(?,00000001), ref: 004B343D
IsWindow.USER32(?), ref: 004B3443
SetFocus.USER32(?), ref: 004B3451

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$EnableFileFocusName$EnabledHookOpenSaveUnhookWindowslstrlen
String ID:
API String ID: 3606897497-0
Opcode ID: 1486930976b5d75d51f2712a90ac71d806c2cd6e4ca930bb5a639db41b4c565d
Instruction ID: 1be2c2daf18d13ce2983d91aa20209a36780cdcfff03098651d310c8a1535cf5
Opcode Fuzzy Hash: 1486930976b5d75d51f2712a90ac71d806c2cd6e4ca930bb5a639db41b4c565d
Instruction Fuzzy Hash: 0D219271614700ABDB21AF72DC4AB9B7BE4EF40315F10442FF54282291DFB9E9408B79

Function 0042FD80 Relevance: 12.4, APIs: 8, Instructions: 368windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 0042FEFE
AppendMenuA.USER32(?,?,00000000,?), ref: 00430061
AppendMenuA.USER32(?,00000000,00000000,?), ref: 00430099
ModifyMenuA.USER32(?,00000000,00000000,00000000,00000000), ref: 004300B7
AppendMenuA.USER32(?,?,00000000,?), ref: 00430115
ModifyMenuA.USER32(?,?,?,?,?), ref: 0043013A
AppendMenuA.USER32(?,?,?,?), ref: 00430182
ModifyMenuA.USER32(?,?,?,?,?), ref: 004301A7

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Menu$Append$Modify$CreatePopup
String ID:
API String ID: 3846898120-0
Opcode ID: e6c8505d716f1ff5f7f7affbd5282d32626a42eb096b86025cfcb906f224da4d
Instruction ID: 757d996f58d34256d47be627c9e26aae7fb92e73e24927edaca847016954dd30
Opcode Fuzzy Hash: e6c8505d716f1ff5f7f7affbd5282d32626a42eb096b86025cfcb906f224da4d
Instruction Fuzzy Hash: 6BD19A716047108BC718DF18E880B6BBBF4EF89714F554A2EF88993351D779AC44CB9A

Function 00436C50 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93networkCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 00436C94

Strings

P, xrefs: 00436C8C
%s:%d, xrefs: 00436D0E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: accept
String ID: %s:%d$P
API String ID: 3005279540-612342447
Opcode ID: 3e49574b3689d7ca508612359b8f1c464a09280fea31de3d9b60c14f315f94f7
Instruction ID: 777544c598e45d05aba81050201cf31a2d6d3bf437bef303b73a2a880cc5e9d2
Opcode Fuzzy Hash: 3e49574b3689d7ca508612359b8f1c464a09280fea31de3d9b60c14f315f94f7
Instruction Fuzzy Hash: 06319531104A01AFD720EB28DC88DBF73E8FFD4324F104A2DF591962D0EA74A8498B55

Function 004A35DA Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,?), ref: 004A35F1
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004A3618
GetSystemMetrics.USER32(00000000), ref: 004A3630
GetSystemMetrics.USER32(00000001), ref: 004A3637
lstrcpyA.KERNEL32(?,DISPLAY), ref: 004A365B

Strings

DISPLAY, xrefs: 004A3655
B, xrefs: 004A35F9

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: System$InfoMetrics$MonitorParameterslstrcpy
String ID: B$DISPLAY
API String ID: 1771318095-3316187204
Opcode ID: e893a564246cd39a0de1001ba1aad10594c1281c846c9e1c17d1f94ed368f13e
Instruction ID: 50937a8e7ab316641a279ca605b70065e0441d85ed625cd004fa96b61381a770
Opcode Fuzzy Hash: e893a564246cd39a0de1001ba1aad10594c1281c846c9e1c17d1f94ed368f13e
Instruction Fuzzy Hash: 22110A31500324BBCB259F18CC85E8B7FA8EF1A796B004063FD059A241E7B5D640CB99

Function 00452A20 Relevance: 12.2, APIs: 8, Instructions: 162COMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32(?,00000058), ref: 00452A38
GetDeviceCaps.GDI32(?,0000005A), ref: 00452A41
GetDeviceCaps.GDI32(?,0000006E), ref: 00452A52
GetDeviceCaps.GDI32(?,0000006F), ref: 00452A6F
GetDeviceCaps.GDI32(?,00000070), ref: 00452A84
GetDeviceCaps.GDI32(?,00000071), ref: 00452A99
GetDeviceCaps.GDI32(?,00000008), ref: 00452AAE
GetDeviceCaps.GDI32(?,0000000A), ref: 00452AC3

Part of subcall function 00452800: __ftol.LIBCMT ref: 00452805

Part of subcall function 00452830: __ftol.LIBCMT ref: 00452835

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CapsDevice$__ftol
String ID:
API String ID: 1555043975-0
Opcode ID: d51170c5d0f78fce53cbcf42deafa4afe3f8fe9036eb654328c7bdb82543a980
Instruction ID: e9778c69354e15e53264451c1cfe858721ee83f519f940288a7f13e30d65847c
Opcode Fuzzy Hash: d51170c5d0f78fce53cbcf42deafa4afe3f8fe9036eb654328c7bdb82543a980
Instruction Fuzzy Hash: B0515870508700ABD300EF6ACD45A6FBBE4FFC9305F01495EFA8456291DBB1D924CB96

Function 004A8B57 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,004A3A06), ref: 004A8B72
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,004A3A06), ref: 004A8B86
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,004A3A06), ref: 004A8BB2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,004A3A06), ref: 004A8BEA
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,004A3A06), ref: 004A8C0C
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,004A3A06), ref: 004A8C25
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,004A3A06), ref: 004A8C38
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004A8C76

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: e583baa982517e1b6b25be8c83ae0374f124e5f6d14b4b49c7b1061fc2385f03
Instruction ID: 4947e8a7fc3bc917e024257d981bb85f1917f8e5ce61f939a1e261663e1deb8a
Opcode Fuzzy Hash: e583baa982517e1b6b25be8c83ae0374f124e5f6d14b4b49c7b1061fc2385f03
Instruction Fuzzy Hash: 7C3106B29062596FE7207B745C8883FB69CF67B3A8B15053FF541C3300EE289C818A79

Function 0047AB90 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0047ABA4
GetWindowLongA.USER32(?,000000EC), ref: 0047ABB2
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 0047ABCB
GetWindowRect.USER32(00000000,00000000), ref: 0047ABFE
GetStockObject.GDI32(00000006), ref: 0047AC46
SelectObject.GDI32(?,00000000), ref: 0047AC52
MoveToEx.GDI32(00000001,00030000,00000001,00000000), ref: 0047AC74
LineTo.GDI32(?,00030000,?), ref: 0047AC98

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$LongObject$LineMessageMoveRectSelectSendStock
String ID:
API String ID: 3454110192-0
Opcode ID: 8cdbd9e31dd649b0ed4446b420f88c1a2bf7cefbdf03b13768fb1e831a48dbff
Instruction ID: ad7f5218e1fccb12c358eba5884fb3282ee34526991b4b369c0129454b554b08
Opcode Fuzzy Hash: 8cdbd9e31dd649b0ed4446b420f88c1a2bf7cefbdf03b13768fb1e831a48dbff
Instruction Fuzzy Hash: C7313CB1504701AFD314DF19C888E5FB7E9EFC8714F108A1DF59993250DA74E845CB66

Function 00444640 Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 00444711

Part of subcall function 004B9AA6: IsWindowEnabled.USER32(?), ref: 004B9AB0

GetClientRect.USER32(?,?), ref: 00444667
PtInRect.USER32(?,?,?), ref: 0044467C
ClientToScreen.USER32(?,?), ref: 0044468D
WindowFromPoint.USER32(?,?), ref: 0044469D
ReleaseCapture.USER32 ref: 004446B7
GetCapture.USER32 ref: 004446D1
SetCapture.USER32(?), ref: 004446DC

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Capture$ClientRectReleaseWindow$EnabledFromPointScreen
String ID:
API String ID: 3076215760-0
Opcode ID: 133978739919b2aaefea6fd1f4bb6a79ba0918c1ffbe3394a75140d287ed9602
Instruction ID: 4aa72c3e20bcff7fb230108cad6db1660265d2b4a1f7181f6e26c386cdf7d163
Opcode Fuzzy Hash: 133978739919b2aaefea6fd1f4bb6a79ba0918c1ffbe3394a75140d287ed9602
Instruction Fuzzy Hash: D421D736200610ABE350EB29DC49FBF77E5EFD4709F04492EF94182351E739E9468BA9

Function 004B9EB2 Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 004B9ED2
lstrcmpA.KERNEL32(?,?), ref: 004B9EDE
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 004B9EF0
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004B9F13
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 004B9F1B
GlobalLock.KERNEL32(00000000), ref: 004B9F28
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 004B9F35
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 004B9F53

Part of subcall function 004BCD37: GlobalFlags.KERNEL32(?), ref: 004BCD41
Part of subcall function 004BCD37: GlobalUnlock.KERNEL32(?,?,?,?,00420400,?,?,?,?,?,?,?,?,0042B15D), ref: 004BCD58
Part of subcall function 004BCD37: GlobalFree.KERNEL32(?), ref: 004BCD63

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: f6d8cf1efdb9fdf85f22323cde9986c59811335ef374a29ec71a7952ff91ec95
Instruction ID: e049383cf6d6d961ee37cc84f818ba8ccb04dd2c5ac0feaf315b8e77590e76de
Opcode Fuzzy Hash: f6d8cf1efdb9fdf85f22323cde9986c59811335ef374a29ec71a7952ff91ec95
Instruction Fuzzy Hash: 20119171100104BADB21AB76CD4AEFFBABDEB96744F00041EF608D5112D6799D41D778

Function 00419A10 Relevance: 12.1, APIs: 8, Instructions: 55COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00419A2C
PtInRect.USER32(?,?,?), ref: 00419A41
ReleaseCapture.USER32 ref: 00419A51
InvalidateRect.USER32(?,00000000,00000000), ref: 00419A5F
GetCapture.USER32 ref: 00419A6F
SetCapture.USER32(?), ref: 00419A7A
InvalidateRect.USER32(?,00000000,00000000), ref: 00419A9B
SetCapture.USER32(?), ref: 00419AA5

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CaptureRect$Invalidate$ClientRelease
String ID:
API String ID: 3559558096-0
Opcode ID: d77eb6a67d23b6d9d959b4d99c000ad06aa9f2d2b90540898412d96949e4cb44
Instruction ID: f51490bacd05ac57d9cb8fab41c5a7891781daddd837e517cbcf653d5c34525b
Opcode Fuzzy Hash: d77eb6a67d23b6d9d959b4d99c000ad06aa9f2d2b90540898412d96949e4cb44
Instruction Fuzzy Hash: 7E115E76500B10AFD760AF64DC48FAF77A9BF98700F00892EF586C2254E734F8858B58

Function 0041F050 Relevance: 10.8, APIs: 7, Instructions: 268windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0041F08D
GetParent.USER32(?), ref: 0041F09F
SendMessageA.USER32(?,0000130B,00000000,00000000), ref: 0041F0C7
GetWindowRect.USER32(?,?), ref: 0041F151
InvalidateRect.USER32(?,?,00000001,?), ref: 0041F174
GetWindowRect.USER32(?,?), ref: 0041F33C
InvalidateRect.USER32(?,?,00000001,?), ref: 0041F35D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Window$Invalidate$MessageParentSend
String ID:
API String ID: 236041146-0
Opcode ID: eaf8db60dd3a6ee9b1c282ab6a48f545c3370beec39871f6e4f2da594c7af23f
Instruction ID: c67b8d9d5762bf6b8896d644d7ae194680187bc33540ed425860121492e00772
Opcode Fuzzy Hash: eaf8db60dd3a6ee9b1c282ab6a48f545c3370beec39871f6e4f2da594c7af23f
Instruction Fuzzy Hash: 9D91E371600705ABC720EF21C850BAB73E5AF84318F04462EFD559B386E73CED868B99

Function 004B06CB Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 241fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000001,80000000,?,0000000C,00000001,00000080,00000000,?,?,00000000), ref: 004B087E
GetLastError.KERNEL32 ref: 004B088A
GetFileType.KERNEL32(00000000), ref: 004B089F
CloseHandle.KERNEL32(00000000), ref: 004B08AA

Strings

H, xrefs: 004B08F1
@, xrefs: 004B08B7

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID: @$H
API String ID: 1809617866-104103126
Opcode ID: 0c27e5598b52a86b106a956bcfb58180a5f837a268ef3b5daa13c155d7420e35
Instruction ID: a23d663b95a7a534156c462a83a327501d81fb29aff0f435121ca10d5bf9f4e9
Opcode Fuzzy Hash: 0c27e5598b52a86b106a956bcfb58180a5f837a268ef3b5daa13c155d7420e35
Instruction Fuzzy Hash: 61812B719043485AEF309F68C8447EFBB609F11366F24421BE951663D2CB7C9A45CBBA

Function 00431950 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

SetRect.USER32(?,00000000,00000032,00000032,?), ref: 00431A39
OffsetRect.USER32(?,?,?), ref: 00431A46
IntersectRect.USER32(?,?,?), ref: 00431A62
IsRectEmpty.USER32(?), ref: 00431A6D
OffsetRect.USER32(?,?,?), ref: 00431AAA

Strings

2, xrefs: 004319F6

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Offset$EmptyIntersect
String ID: 2
API String ID: 765610062-450215437
Opcode ID: 8c2446e5131103ce626d427625aad8c44b77e992318b4add76c940bb1b30c94f
Instruction ID: 2c113ad6e7ead338afe5af8a8f261d6817ff2e82de70b6108ad3573e63f7ddc8
Opcode Fuzzy Hash: 8c2446e5131103ce626d427625aad8c44b77e992318b4add76c940bb1b30c94f
Instruction Fuzzy Hash: 346102B56083419FD718CF29C884A6BFBE9BBC8344F149A2EF58987320D734E905CB56

Function 0041CAD0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 0041CAF2
CreateRectRgn.GDI32 ref: 0041CB74
GetClientRect.USER32(?,?), ref: 0041CB9D
FillRgn.GDI32(?,?,?), ref: 0041CC16
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 0041CC8C

Strings

!K, xrefs: 0041CBD2, 0041CC9A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$ClientCreateEmptyFill
String ID: !K
API String ID: 97219908-3405271303
Opcode ID: 69fcf7e4e605821c9ea8410118b79727310b57abc0d04cb0a24966066e81643a
Instruction ID: 8941124b7693a4762f626db05d4847c1021cfa435e5d3696aaa2b9470cfdb88c
Opcode Fuzzy Hash: 69fcf7e4e605821c9ea8410118b79727310b57abc0d04cb0a24966066e81643a
Instruction Fuzzy Hash: 9B511AB1204601AFD714DF65C985FABB7E9FF88704F04891EB55AC3240EB78E845CBA6

Function 004A8C89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 004A8CE7
GetFileType.KERNEL32(?,?,00000000), ref: 004A8D92
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 004A8DF5
GetFileType.KERNEL32(00000000,?,00000000), ref: 004A8E03
SetHandleCount.KERNEL32 ref: 004A8E3A

Strings

$}S, xrefs: 004A8D21

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: $}S
API String ID: 1710529072-2834706651
Opcode ID: 0ef9cfabff9d1b8d65fa48ef594c96fee29919f11c9c605fbd97c4a2fbd4c830
Instruction ID: 1818f9c57c069aec94b9a25082e471bbbc41ea7d1ddfb944a4502980ce2aef31
Opcode Fuzzy Hash: 0ef9cfabff9d1b8d65fa48ef594c96fee29919f11c9c605fbd97c4a2fbd4c830
Instruction Fuzzy Hash: BB5105B19046098FCB209B38C84466A7BE4FB37328F24466ED592CB3E1DB789846D759

Function 004BDDC2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000019F,00000000,00000000), ref: 004BDDE6
GetParent.USER32(?), ref: 004BDDED

Part of subcall function 004B9917: GetWindowLongA.USER32(?,000000F0), ref: 004B9923

SendMessageA.USER32(?,00000187,00000000,00000000), ref: 004BDE40
SendMessageA.USER32(0000AC84,00000111,?,?), ref: 004BDE91
SendMessageA.USER32(?,00000185,00000000,00000000), ref: 004BDF1C

Strings

, xrefs: 004BDDC3

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$LongParentWindow
String ID:
API String ID: 779260966-3916222277
Opcode ID: faf5ae17a0ee7b74cdc5da69e308a0056cb02dc0b9d47400af3eb0f86c6f60c6
Instruction ID: fab33b562f725931d9be6188d135970a43e67feddbd056cc5344fb74441d0238
Opcode Fuzzy Hash: faf5ae17a0ee7b74cdc5da69e308a0056cb02dc0b9d47400af3eb0f86c6f60c6
Instruction Fuzzy Hash: 3831B5B0A047196FCB247E368C80DBFB69DEB94748B10097FF542C6291EB69DC029678

Function 004463F0 Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0044640B

Part of subcall function 004B9AC1: EnableWindow.USER32(?,00000000), ref: 004B9ACF

Part of subcall function 004B983D: GetDlgItem.USER32(?,?), ref: 004B984B

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00446445
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0044645C
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 004464AD
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 004464E7
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00446514
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 0044654A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$EnableItemWindow
String ID:
API String ID: 607626308-0
Opcode ID: a8061fbac1538f42fccafde6675c02c428d769b67f5671014e70ef8897632fec
Instruction ID: 009665d1b0c4a2b01b40d03580879a0360fb3f647d66bfdd3f9fd8a9c7206635
Opcode Fuzzy Hash: a8061fbac1538f42fccafde6675c02c428d769b67f5671014e70ef8897632fec
Instruction Fuzzy Hash: 9B3150713C074076EA34A6758C96FEB66659BC6F04F10491EB3169F2C2CD68AC41866D

Function 004B92B9 Relevance: 10.6, APIs: 7, Instructions: 122windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004B92ED
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004B9316
UpdateWindow.USER32(?), ref: 004B9332
SendMessageA.USER32(?,00000121,00000000,?), ref: 004B9358
SendMessageA.USER32(?,0000036A,00000000,00000001), ref: 004B9377
UpdateWindow.USER32(?), ref: 004B93BA
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004B93ED

Part of subcall function 004B9917: GetWindowLongA.USER32(?,000000F0), ref: 004B9923

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 952840c02e657f2f82102cbdc89d0fe7d4680c2f9f3870c13ed6dfe908776186
Instruction ID: bb5d249e9f403ab83b4115a73872f911ad0a6210c5b246d0db72fe61ea1e80bc
Opcode Fuzzy Hash: 952840c02e657f2f82102cbdc89d0fe7d4680c2f9f3870c13ed6dfe908776186
Instruction Fuzzy Hash: 44418530504741ABD7209F268848F5FBAF5FFC9B04F14091EF94186291C779DD45CB6A

Function 0040C7C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97processsynchronizationCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0040C877
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0040C88F
WaitForInputIdle.USER32(?,000003E8), ref: 0040C8A1
CloseHandle.KERNEL32(?), ref: 0040C8B2
CloseHandle.KERNEL32(?), ref: 0040C8B9

Strings

D, xrefs: 0040C7D9

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CloseHandleWait$CreateIdleInputObjectProcessSingle
String ID: D
API String ID: 2811420030-2746444292
Opcode ID: c2c81d0f25aab70210e4f0e266d7c2504c3625aaccd3905c1cbb0ebd956bde17
Instruction ID: 7ca699f29754fba2ea604a670feb2474f57e39d85275a44d0b7e831015fa3063
Opcode Fuzzy Hash: c2c81d0f25aab70210e4f0e266d7c2504c3625aaccd3905c1cbb0ebd956bde17
Instruction Fuzzy Hash: 07317E76A04300D7D720EB18C8C0A6B77E5EF94351F208A2EE542E7390D678E8858B5E

Function 004BDB13 Relevance: 10.6, APIs: 7, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BF241: __EH_prolog.LIBCMT ref: 004BF246

Part of subcall function 004B9917: GetWindowLongA.USER32(?,000000F0), ref: 004B9923

SendMessageA.USER32(?,000001A1,00000000,00000000), ref: 004BDB5C
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 004BDB6B
SendMessageA.USER32(?,0000018E,00000000,00000000), ref: 004BDB84
SendMessageA.USER32(?,0000018E,00000000,00000000), ref: 004BDBAC
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 004BDBBB
SendMessageA.USER32(?,00000198,?,?), ref: 004BDBD1
PtInRect.USER32(?,000000FF,?), ref: 004BDBDD

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$H_prologLongRectWindow
String ID:
API String ID: 2846605207-0
Opcode ID: fa7f76a1db84bb738574497517f5feeaeaaea66bf0dbe19df2dfe056d27bcaba
Instruction ID: c2b5d93db0068effea12adebd76ddaa53891b83f67caf4c06c1f8481509ea2c1
Opcode Fuzzy Hash: fa7f76a1db84bb738574497517f5feeaeaaea66bf0dbe19df2dfe056d27bcaba
Instruction Fuzzy Hash: BF312B70A0020DFFDB10DF99CC81DAEBBB9EF44344B1184AAE511A72A1E775AE15DB14

Function 00478410 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 00478446
CreateSolidBrush.GDI32(00BD9E7B), ref: 00478452
FrameRect.USER32(?,?,00000000), ref: 00478465
DeleteObject.GDI32(00000000), ref: 0047846C
InflateRect.USER32(?,000000FF,000000FF), ref: 00478477
GetSysColorBrush.USER32(0000000F), ref: 00478496
FrameRect.USER32(?,?,00000000), ref: 0047849F

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$BrushColorFrame$CreateDeleteInflateObjectSolid
String ID:
API String ID: 2412526408-0
Opcode ID: ef14cdf43ed5e50fb68d5e4efb9ecc1ab4d9774e25abeacedcccf9ffcc4aa138
Instruction ID: ab9f42329beb249587088b573e33fb15bfa07908d58d98fa892e3a357121b1dc
Opcode Fuzzy Hash: ef14cdf43ed5e50fb68d5e4efb9ecc1ab4d9774e25abeacedcccf9ffcc4aa138
Instruction Fuzzy Hash: E9012631208602AFC760DF58AC4CF6F776CEB45361F84813EF219D6390EE68A801C729

Function 0040EAA0 Relevance: 9.3, APIs: 6, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32 ref: 0040EBAC
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 0040EBD1
SafeArrayDestroy.OLEAUT32(00000000), ref: 0040EBDC
VariantCopyInd.OLEAUT32(?,?), ref: 0040EC35
SysAllocString.OLEAUT32(00000000), ref: 0040ED98
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 0040EDD1

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ArraySafe$Data$AccessAllocCopyCreateDestroyStringUnaccessVariant
String ID:
API String ID: 3584657539-0
Opcode ID: 469126093d61e97a81fd5aec98f8423d00af9971a293844d9351725d379b3e0e
Instruction ID: 457002c0baecac92c63d140a824050e87b2556156648e0d826f476d514e02c2a
Opcode Fuzzy Hash: 469126093d61e97a81fd5aec98f8423d00af9971a293844d9351725d379b3e0e
Instruction Fuzzy Hash: 9391C1752082028BE714CF1AC890B2FB3B5EBD8310F554D3FE98697391D67DE8918B5A

Function 00429760 Relevance: 9.2, APIs: 6, Instructions: 176windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 004297B1
IsWindow.USER32(?), ref: 004297C6
IsChild.USER32(?,?), ref: 004297D7
SetFocus.USER32(?), ref: 004297E8
IsWindow.USER32(?), ref: 004298E0
IsWindowVisible.USER32(?), ref: 004298EE

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$ChildFocusVisible
String ID:
API String ID: 372613587-0
Opcode ID: 58b4896cdd5995d7e9cca1631fb514dbb4b46178675706a73d5118149be540cd
Instruction ID: 3bb46c0c019d5ee4dc43f86c6d635359c9873b2f457e693a3993d3f2bb3cf3be
Opcode Fuzzy Hash: 58b4896cdd5995d7e9cca1631fb514dbb4b46178675706a73d5118149be540cd
Instruction Fuzzy Hash: 12517BB16007129FC720EF25D8809ABB7E9BF85358F45492EF88997341DB38EC45CB69

Function 00445900 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0044592C

Part of subcall function 004B541C: InterlockedIncrement.KERNEL32(-000000F4), ref: 004B5431

OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 0044595D
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000), ref: 004459A5
DocumentPropertiesA.WINSPOOL.DRV(?,?,?,00000000,00000000,0000000E), ref: 00445A3B
ClosePrinter.WINSPOOL.DRV(?,?,?,?,00000000,00000000,0000000E), ref: 00445A70

Part of subcall function 004B56A7: InterlockedDecrement.KERNEL32(-000000F4), ref: 004B56BB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: DocumentInterlockedProperties$CloseDecrementIncrementMessageOpenPrinterPrinter.Send
String ID:
API String ID: 1978028495-0
Opcode ID: de2aebae79a515ab2c5aff3534e160604652588781e8801dbfbfa6804022e89c
Instruction ID: b2cc831858826f7417666b6c8ed89b2bb99ca7a8a29746bd86dbcd02ce203c12
Opcode Fuzzy Hash: de2aebae79a515ab2c5aff3534e160604652588781e8801dbfbfa6804022e89c
Instruction Fuzzy Hash: 574128B4104345ABDB24EF15C881FEB77A9EF98724F00460DF85987381D7789944C7AA

Function 00476C30 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 381COMMON

Download Yara Rule

APIs

GetTextExtentPoint32A.GDI32(?,004EEAE0,?,?), ref: 00476CC3
GetTextExtentPoint32A.GDI32(?,?,00000001), ref: 00476D64
DrawTextA.USER32(?,?,000000FF,?,00000000), ref: 00477097

Strings

N, xrefs: 00476C91
&, xrefs: 00476D1D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Text$ExtentPoint32$Draw
String ID: &$N
API String ID: 3694408696-485256433
Opcode ID: 0486b3cd3d0399e04b69c0d47978b78bf2ae4aa543f6642ac4ecd5d5f63d0127
Instruction ID: 7869d30e5944a7a6b8515896b29469ff5510b8c388bd30c1398e76a1ab854c39
Opcode Fuzzy Hash: 0486b3cd3d0399e04b69c0d47978b78bf2ae4aa543f6642ac4ecd5d5f63d0127
Instruction Fuzzy Hash: 3EE149B16187858FC314CF28C58069FFBE2BBC8704F198A2EF59997351D774E9058B8A

Function 0043C200 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

CopyRect.USER32(?,00000000), ref: 0043C242
IsRectEmpty.USER32(?), ref: 0043C273
OffsetRect.USER32(?,00000000,?), ref: 0043C2C3
LPtoDP.GDI32(?,?,00000002), ref: 0043C2F8
GetClientRect.USER32(?,?), ref: 0043C307
IntersectRect.USER32(?,?,?), ref: 0043C31C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$ClientCopyEmptyIntersectOffset
String ID:
API String ID: 1743551499-0
Opcode ID: aed8f6fde7f438b3353c566632b44445dc82a06157e3761aae996da68afa0b1d
Instruction ID: 22f3d7cb0effb84cb8804c4e0cada81c31f196796261cc261f722a3c625f4bda
Opcode Fuzzy Hash: aed8f6fde7f438b3353c566632b44445dc82a06157e3761aae996da68afa0b1d
Instruction Fuzzy Hash: 464107B66047019FC318DF69C880E6BB7E9BBC8710F048A2EF556C7251DB74E945CBA2

Function 004B1C3D Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 004AB7E4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB821
Part of subcall function 004AB7E4: EnterCriticalSection.KERNEL32(?,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB83C

InitializeCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,?,?,004B0848,?,?,00000000), ref: 004B1C90
EnterCriticalSection.KERNEL32(00000068,00000100,00000080,?,00000000,?,?,004B0848,?,?,00000000), ref: 004B1CA5
LeaveCriticalSection.KERNEL32(00000068,?,00000000,?,?,004B0848,?,?,00000000), ref: 004B1CB2

Strings

}S, xrefs: 004B1C58
~S, xrefs: 004B1CEF
, xrefs: 004B1CE6

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID: $ }S$ ~S
API String ID: 713024617-1253393030
Opcode ID: c544797646711d41ddec7929535169e0649c2c4954825b5529c7490062689a14
Instruction ID: 38e9127b970b11d59c3abb37c26b365257001e9b98214bc839e27e1624a41473
Opcode Fuzzy Hash: c544797646711d41ddec7929535169e0649c2c4954825b5529c7490062689a14
Instruction Fuzzy Hash: 4D310C725043048FD720DF24EC84B9A77E5FF55328F248A2FE5654B2E1D778E8488769

Function 00431810 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00431780: CreateDIBitmap.GDI32(?,?,00000004,?,?,00000000), ref: 004317FB

CreateCompatibleDC.GDI32(?), ref: 0043186A
DeleteObject.GDI32(00000000), ref: 0043187F

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Create$BitmapCompatibleDeleteObject
String ID:
API String ID: 3709961035-0
Opcode ID: 396e0e0d9a11a242f18d84027b5e45084cf324bf4f72e5f578cc7937771447ea
Instruction ID: 29bfaf713b716fbbdc3c7ed079c851b56c5782feac62142c4a5e83aeca681059
Opcode Fuzzy Hash: 396e0e0d9a11a242f18d84027b5e45084cf324bf4f72e5f578cc7937771447ea
Instruction Fuzzy Hash: 5F318E762047409FC314EF69C985F5BB7E8FB88724F004A2EF55A83291CB78E805CB66

Function 0042DDD0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0042DE5D
wsprintfA.USER32 ref: 0042DE79

Strings

- , xrefs: 0042DEA4
%d / %d], xrefs: 0042DE57
- [, xrefs: 0042DDF8
?? / %d], xrefs: 0042DE73

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: wsprintf
String ID: - $ - [$%d / %d]$?? / %d]
API String ID: 2111968516-3107364983
Opcode ID: 2ba831995889dd9aff683fde0d2c8f987887252d576c3012860a10a24fcc6d8d
Instruction ID: 0d7040e606e8a2cffd4b9b4874127133998b2c2c814495b14529e2d5022df1cd
Opcode Fuzzy Hash: 2ba831995889dd9aff683fde0d2c8f987887252d576c3012860a10a24fcc6d8d
Instruction Fuzzy Hash: 9D31A274604B40AFC314DB25DC81FABB7E4BF94714F408A1EF49A87390DB79A905CB66

Function 004BEFB4 Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00533A2C,00533A1C,00000000,?,00533A2C,?,004BF21C,00533A1C,00000000,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6), ref: 004BEFBF
EnterCriticalSection.KERNEL32(00533A48,00000010,?,00533A2C,?,004BF21C,00533A1C,00000000,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6), ref: 004BF00E
LeaveCriticalSection.KERNEL32(00533A48,00000000,?,00533A2C,?,004BF21C,00533A1C,00000000,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6), ref: 004BF021
LocalAlloc.KERNEL32(00000000,00000005,?,00533A2C,?,004BF21C,00533A1C,00000000,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6), ref: 004BF037
LocalReAlloc.KERNEL32(?,00000005,00000002,?,00533A2C,?,004BF21C,00533A1C,00000000,?,00000000,004BEC33,004BE528,004BEC4F,004BA417,004BB6B6), ref: 004BF049
TlsSetValue.KERNEL32(00533A2C,00000000), ref: 004BF085

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: 4d3eba33feaec29aee5d40678a26108eacc8405697bd00921dc6247d32a996bf
Instruction ID: 92a0cd6220d0d4a9e694bb790bf9693b586227fdc3f1d1f5dafc08111b857650
Opcode Fuzzy Hash: 4d3eba33feaec29aee5d40678a26108eacc8405697bd00921dc6247d32a996bf
Instruction Fuzzy Hash: 1E31AE71100605AFD724DF59C889EAAB7E8FB85364F00852AF45AC7251DB74F849CF64

Function 00472B10 Relevance: 9.1, APIs: 6, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000409,00000001,00000000), ref: 00472B2B
SendMessageA.USER32(?,0000040E,00000000,00000000), ref: 00472B5A
SendMessageA.USER32(?,00000409,00000000,00000000), ref: 00472B6B
SendMessageA.USER32(?,00000404,?,?), ref: 00472B7C
SendMessageA.USER32(?,00000409,00000000,00000000), ref: 00472B8D
DestroyIcon.USER32(?,?,?,?,004712E2), ref: 00472BBA

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$DestroyIcon
String ID:
API String ID: 3419509030-0
Opcode ID: c52f5472a50b4925b92c4842f98516ba994e218b32a788ca3c17291e4baaab68
Instruction ID: ba18a8a4f7d1929d79e233a371a7c83a4bbf1beac126797da2ae919251595c0c
Opcode Fuzzy Hash: c52f5472a50b4925b92c4842f98516ba994e218b32a788ca3c17291e4baaab68
Instruction Fuzzy Hash: B121A4723007056FD620DE69CD80F57F3A9EB94710F11852AF749A7281D6B5FC468B64

Function 004BD2BB Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004BD2EE
GetLastActivePopup.USER32(?), ref: 004BD2FD
IsWindowEnabled.USER32(?), ref: 004BD312
EnableWindow.USER32(?,00000000), ref: 004BD325
GetWindowLongA.USER32(?,000000F0), ref: 004BD337
GetParent.USER32(?), ref: 004BD345

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: f3a9097016e02ac5494f3052003c901162598e37acb6f9d342890d2149a1d90b
Instruction ID: b86ae8b64f0fe155085de90bc9fcda473f280652c2b4085ff842d5dc419c1471
Opcode Fuzzy Hash: f3a9097016e02ac5494f3052003c901162598e37acb6f9d342890d2149a1d90b
Instruction Fuzzy Hash: 2C11E332E016215B86311E6D5C44BABB7D85F51B61F0511E6EC00D3306FB2CDC0146BE

Function 0043EED0 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0043EEF2
ScreenToClient.USER32(00000001,?), ref: 0043EF01

Part of subcall function 0043EF80: DPtoLP.GDI32(?,?,00000001), ref: 0043F097

LoadCursorA.USER32(00000000,00007F85), ref: 0043EF31
SetCursor.USER32(00000000), ref: 0043EF38
LoadCursorA.USER32(00000000,00007F84), ref: 0043EF57
SetCursor.USER32(00000000), ref: 0043EF5E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Cursor$Load$ClientScreen
String ID:
API String ID: 789353160-0
Opcode ID: 1b170f9018537ad058644bd487736972e5486a73bb1ffc8b538ae3bf325c43e6
Instruction ID: ea2849d88d792aaa0d35af8d8a7d6a75a21941c20c36a5fe4cad62add75224e3
Opcode Fuzzy Hash: 1b170f9018537ad058644bd487736972e5486a73bb1ffc8b538ae3bf325c43e6
Instruction Fuzzy Hash: 9011E531518701BBD710EB64EC49F9F73A8AF94B51F004A2EF145862C4EA74E888C7BB

Function 004194D0 Relevance: 9.1, APIs: 6, Instructions: 54windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000002,?), ref: 004194EB
SendMessageA.USER32(?,00001101,00000000,00000000), ref: 004194FD
SendMessageA.USER32(?,0000110A,00000002,?), ref: 0041950B
SendMessageA.USER32(?,0000110A,00000001,?), ref: 0041951D
SendMessageA.USER32(?,00001101,00000000,00000000), ref: 0041952F
SendMessageA.USER32(?,0000110A,00000001,?), ref: 0041953D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f52dbfc568c56276dac48aef5294ab332d1535113dd64340874e4d1cc4971f10
Instruction ID: 8e35118f0eb240e582e437977803fc2938257979ebc8e2f040889bd09ef3903c
Opcode Fuzzy Hash: f52dbfc568c56276dac48aef5294ab332d1535113dd64340874e4d1cc4971f10
Instruction Fuzzy Hash: A80162B27403057AF535DA698CC2FE7A2ADAF98B51F008619F701AB1C0D5F5EC824A30

Function 00478380 Relevance: 9.1, APIs: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00478396
BitBlt.GDI32(?,00000000,00000000,00CC0020,?,?,00000000,00000000,00CC0020), ref: 004783C7
SelectObject.GDI32(?,?), ref: 004783D9
DeleteObject.GDI32(?), ref: 004783EA
DeleteDC.GDI32(?), ref: 004783F4
ReleaseDC.USER32(?,?), ref: 00478401

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: DeleteObject$RectReleaseSelectWindow
String ID:
API String ID: 3522459120-0
Opcode ID: 14eead8600fc1d54beba044b01cfbfd0ede58d91e9eccb7939c39c28444d7de1
Instruction ID: 781d30baec58f04768397c9820635744da83600639385daf54be431c3e6dced7
Opcode Fuzzy Hash: 14eead8600fc1d54beba044b01cfbfd0ede58d91e9eccb7939c39c28444d7de1
Instruction Fuzzy Hash: F2113A75200B01AFD324DF28DC88F6BB3E9EF88B00F14891CB99693255CB30F8448B64

Function 004BCCC0 Relevance: 9.0, APIs: 6, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 004BCCC3

Part of subcall function 004BCB65: GetWindowLongA.USER32(00000000,000000F0), ref: 004BCB76

GetParent.USER32(00000000), ref: 004BCCEA

Part of subcall function 004BCB65: GetClassNameA.USER32(00000000,?,0000000A), ref: 004BCB91
Part of subcall function 004BCB65: lstrcmpiA.KERNEL32(?,combobox), ref: 004BCBA0

GetWindowLongA.USER32(?,000000F0), ref: 004BCD05
GetParent.USER32(?), ref: 004BCD13
GetDesktopWindow.USER32 ref: 004BCD17
SendMessageA.USER32(00000000,0000014F,00000000,00000000), ref: 004BCD2B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$LongParent$ClassDesktopFocusMessageNameSendlstrcmpi
String ID:
API String ID: 2818563221-0
Opcode ID: 0e7e5b4da1d6441d15785818985191f05af058920723982fee61ea06313c7f71
Instruction ID: 166a18f047212b43b654690e16577eb967b4fdea1718a07fa43c9dd531b0e4af
Opcode Fuzzy Hash: 0e7e5b4da1d6441d15785818985191f05af058920723982fee61ea06313c7f71
Instruction Fuzzy Hash: 7BF0F435201A2272D63227689CC9FEFA95D5BC0B50F140536F815A63D8DB1CAC4140BC

Function 004BCBDA Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 004BCBE9
GetWindow.USER32(?,00000005), ref: 004BCBFA
GetDlgCtrlID.USER32(00000000), ref: 004BCC03
GetWindowLongA.USER32(00000000,000000F0), ref: 004BCC12
GetWindowRect.USER32(00000000,?), ref: 004BCC24
PtInRect.USER32(?,?,?), ref: 004BCC34

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: d2b7e060a09780d79ace6563eaa92f2edad093306e1888d018f4df81cee822c8
Instruction ID: 4650fe3161e10b8e624e5760fc2d8d91d2b1a56f39e4838c3e68433ea0ad86df
Opcode Fuzzy Hash: d2b7e060a09780d79ace6563eaa92f2edad093306e1888d018f4df81cee822c8
Instruction Fuzzy Hash: 6C01A731100429BBDB119F58DC88EEF7B3DEF54311F408131F915D5164E734E9528BA8

Function 00424570 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 291COMMON

Download Yara Rule

Strings

<, xrefs: 004248FA
`mP, xrefs: 004247E8
`mP, xrefs: 004246F3, 004246F7

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: <$`mP$`mP
API String ID: 0-2285921081
Opcode ID: 17162d83e4c3cced3a932387a750ff5497c267b5b0f01e13166db814e9de81e4
Instruction ID: 0b12832d44601a876062db357c05cffc139cd29a19d550668b7a8ee07dd38a80
Opcode Fuzzy Hash: 17162d83e4c3cced3a932387a750ff5497c267b5b0f01e13166db814e9de81e4
Instruction Fuzzy Hash: 5DB1B2B56083518FC724CF24D881A6BB7E1FFC5310F548A2EF59A97280DB38D949CB86

Function 00419D00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 004BBD89: GetClipBox.GDI32(?,?), ref: 004BBD90

IsRectEmpty.USER32(?), ref: 00419D46
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00419DCD
GetCurrentObject.GDI32(?,00000006), ref: 00419E5A
GetClientRect.USER32(?,?), ref: 00419ECC

Part of subcall function 004BC24A: __EH_prolog.LIBCMT ref: 004BC24F
Part of subcall function 004BC24A: EndPaint.USER32(?,?,?,?,00414203), ref: 004BC26C

Strings

!K, xrefs: 00419EFD

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: H_prologPaintRect$BeginClientClipCurrentEmptyObject
String ID: !K
API String ID: 3717962522-3405271303
Opcode ID: e7b6fb4aaf6f0ac0f90b875ffbdaa26208e80bc5acb5ce22c57d5748fa7d81b2
Instruction ID: 0a1fe6af1754764c5a029e43df00309de83faabdd03b0775e9f4a373d6fa4a4f
Opcode Fuzzy Hash: e7b6fb4aaf6f0ac0f90b875ffbdaa26208e80bc5acb5ce22c57d5748fa7d81b2
Instruction Fuzzy Hash: 1C619B711083409FC324DB65C895FEBB7E8FF98714F40491EF58A83291DB78A949CB66

Function 00471540 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000102B,?,?), ref: 0047165E

Part of subcall function 004B3C0B: SendMessageA.USER32(?,0000102E,?,?), ref: 004B3C2C

Strings

4=Q, xrefs: 00471593

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID: 4=Q
API String ID: 3850602802-2863119746
Opcode ID: 56fb1cd82bc28453376bf88700e67b2b5977cc7c8b356425dc3a948649ce999d
Instruction ID: 79f6533c09ec75949094f3ab7d77e0450de4066d7130761945be43067d60211d
Opcode Fuzzy Hash: 56fb1cd82bc28453376bf88700e67b2b5977cc7c8b356425dc3a948649ce999d
Instruction Fuzzy Hash: CA51C531600701ABD724DF1ACC41BABB7E4EBC8760F04892EF94AD7290D274F9458B95

Function 00440050 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0044008F
CreateFontIndirectA.GDI32(00000028), ref: 004400F8
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0044013F

Strings

!K, xrefs: 0044020A
(, xrefs: 004400E4

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CreateExtentFontIndirectPoint32Textwsprintf
String ID: !K$(
API String ID: 3175173087-3601426174
Opcode ID: 7239f9f3c85b927a1ee03d9d7c9dc6671c3b1f7390f75ad2d451ce38a1bbfb8b
Instruction ID: 8eee193e29bce46f534811b3e89b56cff38fc5e1d0c223d3358256633538a448
Opcode Fuzzy Hash: 7239f9f3c85b927a1ee03d9d7c9dc6671c3b1f7390f75ad2d451ce38a1bbfb8b
Instruction Fuzzy Hash: 9851A2712047458FD324DF28C888B6FB7E5FF88304F144A1EE59687381DBBAA945CB96

Function 004212A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00421314
GetParent.USER32(00000000), ref: 00421364
IsWindow.USER32(?), ref: 00421384
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000013), ref: 004213FF

Part of subcall function 004B9A7F: ShowWindow.USER32(?,?,0041F36C,00000000), ref: 004B9A8D

Strings

`mP, xrefs: 004212AC, 004212CB, 004212B2

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$ParentShow
String ID: `mP
API String ID: 2052805569-212751916
Opcode ID: 251c63f2f7020154319690223b0dd9026b32bee23396a810baee5ecdac38b504
Instruction ID: 9667bf97171157016da491a3bf1bd6cfe05264f4b40b846b3991564dde3b011a
Opcode Fuzzy Hash: 251c63f2f7020154319690223b0dd9026b32bee23396a810baee5ecdac38b504
Instruction Fuzzy Hash: 8E41DF31700321ABD720EE61AC80FAB7395AF64754F44053EFD099B381D778E805C7A9

Function 004A828D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 004AB7E4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB821
Part of subcall function 004AB7E4: EnterCriticalSection.KERNEL32(?,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB83C

GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,004A3A10), ref: 004A82DE

Part of subcall function 004AB845: LeaveCriticalSection.KERNEL32(?,004A5442,00000009,004A542E,00000000,?,00000000,00000000,00000000), ref: 004AB852

Strings

0~S, xrefs: 004A83BC
@}O, xrefs: 004A82C5
0~O, xrefs: 004A82D2
0~S, xrefs: 004A8406

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: 0~O$0~S$0~S$@}O
API String ID: 1866836854-2290326825
Opcode ID: ba9e2d7d2cd17c8b38edacea7fc1a4748ee8f8d3d772385f55526a1fae61bce8
Instruction ID: 64750d2dd4fce40c4e7f4d7ae8be86bdcd954814a54e0be51f507ce42616f2b1
Opcode Fuzzy Hash: ba9e2d7d2cd17c8b38edacea7fc1a4748ee8f8d3d772385f55526a1fae61bce8
Instruction Fuzzy Hash: 0A4169719082599FEB20DB74C88437A7BD1EB3B704F2444AFD6458B392DE7E4C499788

Function 004A8FE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 004A8FFF
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 004A9034
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004A9094

Strings

__MSVCRT_HEAP_SELECT, xrefs: 004A902F
__GLOBAL_HEAP_SELECTED, xrefs: 004A906E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 3ce38b9261330ef832827222962ef8de3e471605105b92dc176d96e11da24a64
Instruction ID: 82d65cb3d4dc3bf9262858affe8259bac530441ef4a24a04aca57f8ff6d1d80a
Opcode Fuzzy Hash: 3ce38b9261330ef832827222962ef8de3e471605105b92dc176d96e11da24a64
Instruction Fuzzy Hash: 0C3168718092886DEB3596305C86BDF37A89B33384F2440EFD148D9242E73D8EC6CB1A

Function 004B77D2 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 004B788B
GetWindowLongA.USER32(?,000000FC), ref: 004B789C
GetWindowLongA.USER32(?,000000FC), ref: 004B78AC
SetWindowLongA.USER32(?,000000FC,?), ref: 004B78C8

Strings

(, xrefs: 004B7876

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: 0bb4f04ed05477ec76b2e9f509fce04a4ba82d1f89b8d551146d474e95258446
Instruction ID: e4406970075de76011f04a0bee87ae4fc42655e88152b7db355bf092eb18ce4f
Opcode Fuzzy Hash: 0bb4f04ed05477ec76b2e9f509fce04a4ba82d1f89b8d551146d474e95258446
Instruction Fuzzy Hash: E33190306047009FDB21BF69C888AAEBBF5BF88714F14453EE54197792DB38E814CB69

Function 004BFA7E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 004BFAAF

Part of subcall function 004BFB9B: lstrlenA.KERNEL32(00000104,00000000,?,004BFADF), ref: 004BFBD2

lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 004BFB50
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 004BFB7D

Strings

.HLP, xrefs: 004BFB4A
.INI, xrefs: 004BFB77

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: FileModuleNamelstrcatlstrcpylstrlen
String ID: .HLP$.INI
API String ID: 2421895198-3011182340
Opcode ID: 341bb5cb38ac7e6a26d43214a997bce6e96f857faf09cf13153303f8e1127f3b
Instruction ID: 4a9d684f5fd0cb5c871585491720c512daeb07bbe3a200cde653ee6768a1c7f6
Opcode Fuzzy Hash: 341bb5cb38ac7e6a26d43214a997bce6e96f857faf09cf13153303f8e1127f3b
Instruction Fuzzy Hash: FE316071804718AFDB21EB71DC85BCAB7E8AF14304F1089BBA189D6152DA78A9C4CB24

Function 004BD143 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BD2BB: GetParent.USER32(?), ref: 004BD2EE
Part of subcall function 004BD2BB: GetLastActivePopup.USER32(?), ref: 004BD2FD
Part of subcall function 004BD2BB: IsWindowEnabled.USER32(?), ref: 004BD312
Part of subcall function 004BD2BB: EnableWindow.USER32(?,00000000), ref: 004BD325

SendMessageA.USER32(?,00000376,00000000,00000000), ref: 004BD179
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 004BD1E7
MessageBoxA.USER32(00000000,?,?,00000000), ref: 004BD1F5
EnableWindow.USER32(00000000,00000001), ref: 004BD211

Strings

_\K, xrefs: 004BD143

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
String ID: _\K
API String ID: 1958756768-1872837343
Opcode ID: b5dbe62dda5212d9fc905b0fa9d561abfbd5808fa7b716667f853eaf836f7168
Instruction ID: 77ede3c0bd7a32fa43d69f14e19181ed36ec3e63686559dfde82be4a06406c7d
Opcode Fuzzy Hash: b5dbe62dda5212d9fc905b0fa9d561abfbd5808fa7b716667f853eaf836f7168
Instruction Fuzzy Hash: 6621A872E00148AFDB209F98CCC1AEEB7B9EB44350F1445BAE615E7240E7759D81CB74

Function 004BF706 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 004BF712
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 004BF7C1
LoadBitmapA.USER32(00000000,00007FE3), ref: 004BF7D9

Strings

\NM, xrefs: 004BF792
, xrefs: 004BF721

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
String ID: $\NM
API String ID: 2596413745-729966594
Opcode ID: 05dcbef5c3179e0345b117056622cabff96ee2320f048d4c8eb2a1b9cf93a2fb
Instruction ID: 59e075945337219c884b82ddb8f2f3d21129c4fe69ef817abd7a9fd5bbd45a09
Opcode Fuzzy Hash: 05dcbef5c3179e0345b117056622cabff96ee2320f048d4c8eb2a1b9cf93a2fb
Instruction Fuzzy Hash: DE212871E00214AFDB10CBB8CC89BAEBB78EB44714F0441A6E409EB382DA349A488B50

Function 00430430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 00430470
GlobalSize.KERNEL32(?), ref: 00430493
GlobalSize.KERNEL32(?), ref: 004304C3
GlobalUnlock.KERNEL32(?,00000000,00000000), ref: 004304D3

Strings

BM, xrefs: 0043048D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Global$Size$LockUnlock
String ID: BM
API String ID: 2233901773-2348483157
Opcode ID: d66b48f41243cfb690ce08fd0b18b1f2680ef88a674324458656b270b05f0168
Instruction ID: 0fee707df617a02857eb9b92bf679195ee83e87a69dbc5805ecafeffbf313ea9
Opcode Fuzzy Hash: d66b48f41243cfb690ce08fd0b18b1f2680ef88a674324458656b270b05f0168
Instruction Fuzzy Hash: F1219876900758ABC710DF99D841BDEFBB8FF48720F10426EE819E3381D77959408BA9

Function 004B7CEB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004B7D21
wsprintfA.USER32 ref: 004B7D3D
GetClassInfoA.USER32(?,-00000058,?), ref: 004B7D4C

Strings

Afx:%x:%x:%x:%x:%x, xrefs: 004B7D37
Afx:%x:%x, xrefs: 004B7D1B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: wsprintf$ClassInfo
String ID: Afx:%x:%x$Afx:%x:%x:%x:%x:%x
API String ID: 845911565-79760390
Opcode ID: 1d9abc0cbef3323cee0063210ba967de1fa3ec50303a9122c7f52e33d91c13cf
Instruction ID: 5a8bda74eddac4319e8b917c89036378cba28885143a35fd341493ecf00882c3
Opcode Fuzzy Hash: 1d9abc0cbef3323cee0063210ba967de1fa3ec50303a9122c7f52e33d91c13cf
Instruction Fuzzy Hash: CC21FC71904219AF8F10DFA9DC819EF7BB9EF59755B00442AF909A3201E3389A51CBB9

Function 00428000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconA.SHELL32(00000001,?,?,00000058), ref: 00428079
DestroyIcon.USER32(?,?,?,00000058), ref: 00428086
Shell_NotifyIconA.SHELL32(?,?,00000000,00000058), ref: 004280B9

Strings

d, xrefs: 00428029
X, xrefs: 00428017

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Icon$NotifyShell_$Destroy
String ID: X$d
API String ID: 944232879-651813629
Opcode ID: aebacc99b8a6e8670a6f3132dfcebdf61974304dbf8bab06d3d8149e6037cb19
Instruction ID: c9add3872167d449326b0048b63d5c0db05f8faa5ba618e1ba0542bcd4958608
Opcode Fuzzy Hash: aebacc99b8a6e8670a6f3132dfcebdf61974304dbf8bab06d3d8149e6037cb19
Instruction Fuzzy Hash: 57214A756097009FE350DF15D804B9BBBE5BFC4705F40891EB9C893350EBB9E9488BA6

Function 0043106E Relevance: 7.9, APIs: 5, Instructions: 426COMMON

Download Yara Rule

APIs

CopyRect.USER32(?), ref: 00431095

Part of subcall function 00431600: __ftol.LIBCMT ref: 004316EC
Part of subcall function 00431600: __ftol.LIBCMT ref: 00431723
Part of subcall function 00431600: __ftol.LIBCMT ref: 00431759

SetRect.USER32(?,00000000,00000000,?,?), ref: 004310AA
__ftol.LIBCMT ref: 004312F2
__ftol.LIBCMT ref: 004313BE
__ftol.LIBCMT ref: 00431472

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: __ftol$Rect$Copy
String ID:
API String ID: 775608801-0
Opcode ID: 554ef46dee40649727cd47bd6ac04fc6a231a4c0aaea5f163241093ca1ebefed
Instruction ID: a34098bb871d2b31c46375a67c61623455a04585fa6c5b3c623b7790ff0ca0b7
Opcode Fuzzy Hash: 554ef46dee40649727cd47bd6ac04fc6a231a4c0aaea5f163241093ca1ebefed
Instruction Fuzzy Hash: A7F17671608705AFC384CF19C9C0A5BB7E5EBC8754F842A2EF58AC7320E734E9468B56

Function 0043CA90 Relevance: 7.7, APIs: 5, Instructions: 229COMMON

Download Yara Rule

APIs

CopyRect.USER32(?,00000000), ref: 0043CB19
GetClientRect.USER32(00000000,?), ref: 0043CB52
DPtoLP.GDI32 ref: 0043CBA8
GetClientRect.USER32(00000000,?), ref: 0043CC7C
DPtoLP.GDI32 ref: 0043CCD2

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Client$Copy
String ID:
API String ID: 472922470-0
Opcode ID: d5afab9f692e68c7bd3c86d8e49954a6c115174ba91db457ad69c1dca7ae9d55
Instruction ID: f69a55d2ce978c2f678b35f87c8141e3e192bcf0dc8cacacfcf51607bbb68bc7
Opcode Fuzzy Hash: d5afab9f692e68c7bd3c86d8e49954a6c115174ba91db457ad69c1dca7ae9d55
Instruction Fuzzy Hash: F581B0712083419FC724EF69C8D1A6FB7E5BBC8704F10592EF19AD3241DB78A805CBA6

Function 00475BA0 Relevance: 7.7, APIs: 5, Instructions: 211COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00475BC5

Part of subcall function 004B7A75: GetWindowTextLengthA.USER32(?), ref: 004B7A82
Part of subcall function 004B7A75: GetWindowTextA.USER32(?,00000000,00000000), ref: 004B7A9A

GetCurrentObject.GDI32(?,00000006), ref: 00475C35
OffsetRect.USER32(?,00000001,00000001), ref: 00475CFC

Part of subcall function 004B56A7: InterlockedDecrement.KERNEL32(-000000F4), ref: 004B56BB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: RectTextWindow$ClientCurrentDecrementInterlockedLengthObjectOffset
String ID:
API String ID: 2119403043-0
Opcode ID: da10d9db816834c0500ea994936025069d06d663b66bf77877cf9e6378e0dc6d
Instruction ID: 15aa0459b2de8aec65e73846d8b7bd9a90835fba4b9eb1e43e1b6ccf7179f047
Opcode Fuzzy Hash: da10d9db816834c0500ea994936025069d06d663b66bf77877cf9e6378e0dc6d
Instruction Fuzzy Hash: F88148756087409FC724DF14C884AAEB7E6BFC8710F508A1EF99A8B390D778E845CB56

Function 0042ABE0 Relevance: 7.7, APIs: 5, Instructions: 196windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0042ACBC
SendMessageA.USER32(?,00008003,00000000,00000000), ref: 0042ACD3
GetWindowRect.USER32(?,00000000), ref: 0042AD25
GetClientRect.USER32(?,00000000), ref: 0042AD7D
GetWindowRect.USER32(?,00000000), ref: 0042ADA1

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: RectWindow$ClientMessageSend
String ID:
API String ID: 1071774122-0
Opcode ID: 1074c532e2cbb40930e7def52dcb82267d68013f67e68b158099857fc316eeab
Instruction ID: b175877cd8d5f53e6e39fae816addef2294752e244717da6544fc3f7438ae813
Opcode Fuzzy Hash: 1074c532e2cbb40930e7def52dcb82267d68013f67e68b158099857fc316eeab
Instruction Fuzzy Hash: 3861DF71604311AFC720DF25E884A6FB7E9EF88744F004A1EF98597381DA78ED45CB9A

Function 004120E0 Relevance: 7.6, APIs: 5, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetTextExtentPoint32A.GDI32(?,004E4CC4,?,?), ref: 00412181
GetSystemMetrics.USER32(0000002E), ref: 00412195
GetWindowRect.USER32(?,?), ref: 004121B5
GetStockObject.GDI32(00000011), ref: 00412202
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 00412211

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ExtentMessageMetricsObjectPoint32RectSendStockSystemTextWindow
String ID:
API String ID: 3316701254-0
Opcode ID: 734ea12736f167692fb2d7905bdd47e3585505b103b53df74cc513909989bbb0
Instruction ID: cc8a615c2ffcbff060aaea5db7e4097ae98e21ec7a2637f4b0c601bbaf62f671
Opcode Fuzzy Hash: 734ea12736f167692fb2d7905bdd47e3585505b103b53df74cc513909989bbb0
Instruction Fuzzy Hash: 55418E71244740BFD324DB65CD85FAB73A9AB88714F004A1EF65297280DBB8E941CB59

Function 00475730 Relevance: 7.6, APIs: 5, Instructions: 127windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001009,00000000,00000000), ref: 00475746
ImageList_GetImageCount.COMCTL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00473FEE), ref: 004757CC
ImageList_GetImageCount.COMCTL32(?), ref: 004757F2
SendMessageA.USER32(?,00001006,00000000,?), ref: 00475837
SendMessageA.USER32(?,00001007,00000000,00000007), ref: 0047587A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Image$MessageSend$CountList_
String ID:
API String ID: 102003083-0
Opcode ID: cd277674f1f79063af1d1c3dbda630bc9c9a97d9d9275ed9fbea6b338a14196f
Instruction ID: bdc1252c9e347411d06e7ac3c9488ace6f5149bd203c49137cffd83252ffe0a0
Opcode Fuzzy Hash: cd277674f1f79063af1d1c3dbda630bc9c9a97d9d9275ed9fbea6b338a14196f
Instruction Fuzzy Hash: 3E4184755047419FC724DF19C880A9BBBE5FF88754F004A2EF899DB280D778E901CB9A

Function 00428D00 Relevance: 7.6, APIs: 5, Instructions: 104windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00428DD0
WinHelpA.USER32(?,00000000,00000002,00000000), ref: 00428DEB
GetMenu.USER32(?), ref: 00428DFB
SetMenu.USER32(?,00000000), ref: 00428E08
DestroyMenu.USER32(00000000), ref: 00428E13

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Menu$DestroyHelpWindow
String ID:
API String ID: 427501538-0
Opcode ID: 9103028a13aa59560731decfd397974f3fc5d549530cb02644aedbd82f5dda9a
Instruction ID: 0f035d91a27b4fabdb434802f22261102efc4bd493fed0eb1e1248dbc33c803f
Opcode Fuzzy Hash: 9103028a13aa59560731decfd397974f3fc5d549530cb02644aedbd82f5dda9a
Instruction Fuzzy Hash: 3B310371600629ABC314AF66EC44E6FB7ACFF45308F81491EF94593241DB39B8448BA9

Function 004351C0 Relevance: 7.6, APIs: 5, Instructions: 103synchronizationCOMMON

Download Yara Rule

APIs

midiStreamStop.WINMM(?,00000000,?,00000000,00434D2A,00000000,00506D88,0042B1F6,00506D88,?,00425DAF,00506D88,00423D66,00000001,00000000,000000FF), ref: 004351F5
midiOutReset.WINMM(?,?,00425DAF,00506D88,00423D66,00000001,00000000,000000FF), ref: 00435213
WaitForSingleObject.KERNEL32(?,000007D0,?,00425DAF,00506D88,00423D66,00000001,00000000,000000FF), ref: 00435236
midiStreamClose.WINMM(?,?,00425DAF,00506D88,00423D66,00000001,00000000,000000FF), ref: 00435273
midiStreamClose.WINMM(?,?,00425DAF,00506D88,00423D66,00000001,00000000,000000FF), ref: 004352A7

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: midi$Stream$Close$ObjectResetSingleStopWait
String ID:
API String ID: 3142198506-0
Opcode ID: b4747b54f625bec0209b13b6fa46a5786eb42e678772a998a881185714437e00
Instruction ID: db8de55214f7b6b0b6785d351009fe1658d7b66170f769ecf90532a10e107a19
Opcode Fuzzy Hash: b4747b54f625bec0209b13b6fa46a5786eb42e678772a998a881185714437e00
Instruction Fuzzy Hash: 403120B2700E418FCB209FA5D48495FB7E5BB98315B545A3FE146C6640C778E8458F98

Function 00424EC0 Relevance: 7.6, APIs: 5, Instructions: 92windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00424F30
GetMenu.USER32(?), ref: 00424F3F
DestroyAcceleratorTable.USER32(?), ref: 00424F8C
SetMenu.USER32(?,00000000), ref: 00424FA1
DestroyMenu.USER32(?), ref: 00424FB1

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Menu$Destroy$AcceleratorTableWindow
String ID:
API String ID: 1240299919-0
Opcode ID: 1a1202755860d4e703cdcaab4b26325b13936e4e6da1767e4c9b8406de7901aa
Instruction ID: 4ee870262807074d0916d1ff3999c463ca9b836179a839c9cf7fbd788b6249b6
Opcode Fuzzy Hash: 1a1202755860d4e703cdcaab4b26325b13936e4e6da1767e4c9b8406de7901aa
Instruction Fuzzy Hash: FE31B3726006156FC720EF65DD44E6B77E9EF85348B02892DFC09C7202EA38F805CBA5

Function 0042AA70 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

IsChild.USER32(?,?), ref: 0042AA8C

Part of subcall function 0041F660: IsChild.USER32(?,?), ref: 0041F6DD
Part of subcall function 0041F660: GetParent.USER32(?), ref: 0041F6F7

GetCursorPos.USER32(?), ref: 0042AAA4
GetClientRect.USER32(?,?), ref: 0042AAB3
PtInRect.USER32(?,?,?), ref: 0042AAD4
SetCursor.USER32(?,?,00000000,?,?,?,?,0042A700), ref: 0042AB52

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ChildCursorRect$ClientParent
String ID:
API String ID: 1110532797-0
Opcode ID: dd4b857b67b84ad738077dee3228aaed68f25400cc2803eb281928b46f0e9fe1
Instruction ID: 8b6dc39930e5a0ced6e2aee6b3c086c86acedd6692d0cbc40d0f7adf9dc7b8de
Opcode Fuzzy Hash: dd4b857b67b84ad738077dee3228aaed68f25400cc2803eb281928b46f0e9fe1
Instruction Fuzzy Hash: 3121C831B006116FC720EA25DC45F9F77EAAF94B14F444A2EF905D3280E638F856C7AA

Function 004B346F Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004B3474
GetParent.USER32(?), ref: 004B34B1
SendMessageA.USER32(?,00000464,00000104,00000000), ref: 004B34D9
GetParent.USER32(?), ref: 004B3502
SendMessageA.USER32(?,00000465,00000104,00000000), ref: 004B351F

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageParentSend$H_prolog
String ID:
API String ID: 1056721960-0
Opcode ID: 30332130629a6019b495304aff13eb85c9306d8846f9cde215c644082e5ab93b
Instruction ID: eb357e1a5aa29b8130e6d7a55eb6f09bbffba2c029971ef590bde1c6e1f3741e
Opcode Fuzzy Hash: 30332130629a6019b495304aff13eb85c9306d8846f9cde215c644082e5ab93b
Instruction Fuzzy Hash: DC315270500619ABCB14EFA6CC55FEEB774FF54319F50462EE421A71E1DB38AA06CB28

Function 004134F0 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 004BC124: __EH_prolog.LIBCMT ref: 004BC129
Part of subcall function 004BC124: GetWindowDC.USER32(?,?,?,00413521), ref: 004BC152

GetClientRect.USER32 ref: 00413532
GetWindowRect.USER32(?,?), ref: 00413541

Part of subcall function 004BBEDE: ScreenToClient.USER32(?,75C07310), ref: 004BBEF2
Part of subcall function 004BBEDE: ScreenToClient.USER32(?,75C07318), ref: 004BBEFB

OffsetRect.USER32(?,?,?), ref: 0041356C

Part of subcall function 004BBE1B: ExcludeClipRect.GDI32(?,?,?,?,?,75C0A5C0,?,?,0041357C,?), ref: 004BBE40
Part of subcall function 004BBE1B: ExcludeClipRect.GDI32(?,?,?,?,?,75C0A5C0,?,?,0041357C,?), ref: 004BBE55

OffsetRect.USER32(?,?,?), ref: 0041358F
FillRect.USER32(?,?,?), ref: 004135AA

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$Client$ClipExcludeOffsetScreenWindow$FillH_prolog
String ID:
API String ID: 2829754061-0
Opcode ID: 1aa5676be91313ab76d1287ff977a92033373e30b2c5ed3e396b4ae147a61c64
Instruction ID: 6b57ed543329a0b0fb3e46cf97ec793837c14f3a043e8284cf969ef4b7d99b78
Opcode Fuzzy Hash: 1aa5676be91313ab76d1287ff977a92033373e30b2c5ed3e396b4ae147a61c64
Instruction Fuzzy Hash: 39317175208701AFD714DF24C845EABB7E9EB88714F008A1EF496C7290DB78E945CB66

Function 0040F7F0 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0040F84A
VariantCopyInd.OLEAUT32(?), ref: 0040F85B
VariantClear.OLEAUT32(?), ref: 0040FBFB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Variant$ClearCopyInit
String ID:
API String ID: 1785138364-0
Opcode ID: 3b60fa9ce435c478363064584c731489168faad978cca61d110cbd39081d79ca
Instruction ID: eaef6a68b86a488d02f695768ce68024dedf599d2d8cb2edc95fd3e2ca707be9
Opcode Fuzzy Hash: 3b60fa9ce435c478363064584c731489168faad978cca61d110cbd39081d79ca
Instruction Fuzzy Hash: AA21C23A9046509FD3249B15D844B9FB7E8FB88B20F14453EF80593790C73CE889CB9A

Function 00475920 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 004B9917: GetWindowLongA.USER32(?,000000F0), ref: 004B9923

GetParent.USER32(?), ref: 00475944
GetClientRect.USER32(?,?), ref: 0047595D
InvalidateRect.USER32(?,?,00000001,?,?), ref: 004759AC
UpdateWindow.USER32(?), ref: 004759B2
InvalidateRect.USER32(?,00000000,00000000), ref: 004759D1

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Rect$InvalidateWindow$ClientLongParentUpdate
String ID:
API String ID: 529115757-0
Opcode ID: 2086ae7d6cdbb342519ed6d151f614fa753441b87be06555740fa7737cb4efdf
Instruction ID: 3fe938c3521b69bba30ddfaa06d0bbe573920943c06a43078d68b815023583f6
Opcode Fuzzy Hash: 2086ae7d6cdbb342519ed6d151f614fa753441b87be06555740fa7737cb4efdf
Instruction Fuzzy Hash: 54218EB5604301AFCB24DF21C881D6BB7E9EFC8314F10892EF98997350D678E80ACB65

Function 00419450 Relevance: 7.6, APIs: 5, Instructions: 56windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B3F08: SendMessageA.USER32(?,0000110C,00000000,00000040), ref: 004B3F29

SendMessageA.USER32(?,0000110A,00000004,?), ref: 00419475
SendMessageA.USER32(?,0000110A,00000004,00000000), ref: 00419495
SendMessageA.USER32(?,00001101,00000000,00000000), ref: 004194A7
SendMessageA.USER32(?,0000110A,00000004,00000000), ref: 004194B5
SendMessageA.USER32(?,00001101,00000000,00000000), ref: 004194C7

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fa5b21dec330ce19405ea19cdca0b320e46f9c5084bffc1218c457d49af308d7
Instruction ID: e61b541cfd3743305adb883e76e09d30ed8a21c896b2a8a4b1cb76b7b0736680
Opcode Fuzzy Hash: fa5b21dec330ce19405ea19cdca0b320e46f9c5084bffc1218c457d49af308d7
Instruction Fuzzy Hash: 630167B27407053AE634DE664CD1FA792AD9F98B56F00451EF702D72C4CAE8EC468678

Function 004B7C4A Relevance: 7.6, APIs: 5, Instructions: 52stringregistryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004B7C4F
GetClassInfoA.USER32(?,?,?), ref: 004B7C6A
RegisterClassA.USER32(?), ref: 004B7C75
lstrcatA.KERNEL32(00000034,?,00000001), ref: 004B7CAC
lstrcatA.KERNEL32(00000034,?), ref: 004B7CBA

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Classlstrcat$H_prologInfoRegister
String ID:
API String ID: 106226465-0
Opcode ID: f2c0fcf837c4aa4573f35f37b2f30dfed92e5b8b8a83f613e4dc362ca97cc20d
Instruction ID: 6d030322753ea00f9cdee06e96ef006cb86de793f40bad395c9334db410aef1b
Opcode Fuzzy Hash: f2c0fcf837c4aa4573f35f37b2f30dfed92e5b8b8a83f613e4dc362ca97cc20d
Instruction Fuzzy Hash: 1111E136504244BEDB10AF758C01AEE7FB8EF55714F00446FF805A7252C378A644CBB9

Function 004A8EAC Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,004A5E02,004A7737,00000000,?,?,00000000,00000001), ref: 004A8EAE
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 004A8EBC
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 004A8F08

Part of subcall function 004A61F6: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004A62EC

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 004A8EE0
GetCurrentThreadId.KERNEL32 ref: 004A8EF1

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 8d757476d02b74c2c58975bc1128f9060f433b362df01043e27203e65e428be6
Instruction ID: e8538e3a87473e58c4c6c7939ada5b112c7000a71d860cf573b400c450def5a0
Opcode Fuzzy Hash: 8d757476d02b74c2c58975bc1128f9060f433b362df01043e27203e65e428be6
Instruction Fuzzy Hash: F7F0F6355007129FD3202B30BC09A6F3A60DB527B2B10017EF981D62E1DF689C81879C

Function 0043DA30 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277COMMON

Download Yara Rule

APIs

GetCurrentObject.GDI32(?), ref: 0043DAFB
LPtoDP.GDI32(?,00000000,00000001), ref: 0043DB48
DPtoLP.GDI32(?,00000000,00000001), ref: 0043DB6B

Strings

!K, xrefs: 0043DD28

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CurrentObject
String ID: !K
API String ID: 844725943-3405271303
Opcode ID: f00f9c500a6190b8ee08a206c22d011b8981b7f36dfb2946cb2a71a1ae1bcc0a
Instruction ID: 2ad57e29ca33d791c95661d818cfb4e01e382bcae06b8fad9b1c9d780474970e
Opcode Fuzzy Hash: f00f9c500a6190b8ee08a206c22d011b8981b7f36dfb2946cb2a71a1ae1bcc0a
Instruction Fuzzy Hash: DCA1AD716083049BC718DF55D491A6FB7E9AFC8708F04691EF98683350CBB8ED04CBAA

Function 00471180 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000401,?,00513D34), ref: 0047128A
SendMessageA.USER32(00000000,00000410,?,00513D34), ref: 004712AA

Strings

4=Q, xrefs: 00471229

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID: 4=Q
API String ID: 3850602802-2863119746
Opcode ID: d0640ce81e792f2ae05edaf14108fcd6f7d63b63a271ec425847055e5e696083
Instruction ID: d02d9e57f2c811fc1918eadd3990b4e68d267675990f31607b1b01893f025837
Opcode Fuzzy Hash: d0640ce81e792f2ae05edaf14108fcd6f7d63b63a271ec425847055e5e696083
Instruction Fuzzy Hash: 76513A76A002019BD700DF29EC409AB77E6EBD4324F14853AED4CD7352D63AE94687D6

Function 004BB464 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 004BB480
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 004BB4D3
GlobalUnlock.KERNEL32(?), ref: 004BB56A

Strings

@, xrefs: 004BB4BD

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Global$ByteCharLockMultiUnlockWide
String ID: @
API String ID: 231414890-2766056989
Opcode ID: 9c9130e508bf8d53c0489424e09a6d507ce78bcb25fa8061870df10d9d28dcc5
Instruction ID: 33847f747efeb79834f3e656aeb54072441c939e331dd3b43b541cdfe3774935
Opcode Fuzzy Hash: 9c9130e508bf8d53c0489424e09a6d507ce78bcb25fa8061870df10d9d28dcc5
Instruction Fuzzy Hash: 4241F971800219EFCB10DF54C8819EEBBB8FF40354F14816AE8159B255D378A946CBE8

Function 00430950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00430530: GetObjectA.GDI32(?,00000018,?), ref: 0043056D
Part of subcall function 00430530: GetDeviceCaps.GDI32 ref: 00430607
Part of subcall function 00430530: GetSystemPaletteEntries.GDI32(?,00000000,000000FF,00000004), ref: 00430641
Part of subcall function 00430530: CreatePalette.GDI32(00000000), ref: 0043064C

GlobalAlloc.KERNEL32(00000002,?), ref: 004309DA
GlobalLock.KERNEL32(00000000), ref: 004309F5
GlobalUnlock.KERNEL32(00000000), ref: 00430A0E

Strings

!K, xrefs: 00430A2A, 00430A6E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Global$Palette$AllocCapsCreateDeviceEntriesLockObjectSystemUnlock
String ID: !K
API String ID: 1348334340-3405271303
Opcode ID: 5f9ce073571883819aed2fff0be33d75dc7fb4d162be5a573432168d5507b5af
Instruction ID: 396684f551febe174cad246fa71ec4422f717a7c6f7679e72be61d51108931fa
Opcode Fuzzy Hash: 5f9ce073571883819aed2fff0be33d75dc7fb4d162be5a573432168d5507b5af
Instruction Fuzzy Hash: 3F31CE755083448BC314EF18D894B6FFBE4BBD8714F400A2EF88183241DB78A948CBA6

Function 00445AD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B31FA: __EH_prolog.LIBCMT ref: 004B31FF
Part of subcall function 004B31FA: lstrcpynA.KERNEL32(?,?,00000104), ref: 004B32EC

Part of subcall function 004B3394: lstrlenA.KERNEL32(?,?,?,0000000C,?,?,0042F799,?,-00000001,00000000,?,?,?,004E9C90), ref: 004B339E
Part of subcall function 004B3394: GetFocus.USER32 ref: 004B33B9
Part of subcall function 004B3394: IsWindowEnabled.USER32(?), ref: 004B33E2
Part of subcall function 004B3394: EnableWindow.USER32(?,00000000), ref: 004B33F4
Part of subcall function 004B3394: GetOpenFileNameA.COMDLG32(?,?), ref: 004B341F
Part of subcall function 004B3394: EnableWindow.USER32(?,00000001), ref: 004B343D
Part of subcall function 004B3394: IsWindow.USER32(?), ref: 004B3443
Part of subcall function 004B3394: SetFocus.USER32(?), ref: 004B3451

Part of subcall function 004B346F: __EH_prolog.LIBCMT ref: 004B3474
Part of subcall function 004B346F: GetParent.USER32(?), ref: 004B34B1
Part of subcall function 004B346F: SendMessageA.USER32(?,00000464,00000104,00000000), ref: 004B34D9
Part of subcall function 004B346F: GetParent.USER32(?), ref: 004B3502
Part of subcall function 004B346F: SendMessageA.USER32(?,00000465,00000104,00000000), ref: 004B351F

Part of subcall function 004B99AD: SetWindowTextA.USER32(?,0042DEFA), ref: 004B99BB

Part of subcall function 004B56A7: InterlockedDecrement.KERNEL32(-000000F4), ref: 004B56BB

SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 00445B7D
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00445B8C

Part of subcall function 004B9AE8: SetFocus.USER32(?,00422B93), ref: 004B9AF2

Strings

out.prn, xrefs: 00445AF9
prn, xrefs: 00445AFE

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$MessageSend$Focus$EnableH_prologParent$DecrementEnabledFileInterlockedNameOpenTextlstrcpynlstrlen
String ID: out.prn$prn
API String ID: 4074345921-3109735852
Opcode ID: cbfe4f27e890598508b25791f6938c95b064ce35b6f9e057c8f9a8c785899e0d
Instruction ID: 688a9b11ccccdcc0930663070a8d3b28761791c4f2fc512f80c6ea8ab98f6259
Opcode Fuzzy Hash: cbfe4f27e890598508b25791f6938c95b064ce35b6f9e057c8f9a8c785899e0d
Instruction Fuzzy Hash: 3521A131144780ABD334EB19CC46FDBB7E4AB84B14F104A1EB5A9522D2CBBC6505CBA6

Function 00426A20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(?,WTWindow,00000000), ref: 00426A48
LoadCursorA.USER32(00000000,00007F00), ref: 00426A59
GetStockObject.GDI32(00000005), ref: 00426A63

Strings

WTWindow, xrefs: 00426A3C, 00426A46

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ClassCursorInfoLoadObjectStock
String ID: WTWindow
API String ID: 1762135420-3503404378
Opcode ID: b36549d0d914d4df452a0b481b35e8bcdc0d8a9b0a6b38d4e4ffffdea2b9fbc2
Instruction ID: df60b3a56a819b3155a9abba5a4746dc57c8597be2b171ca0c0a4320af396673
Opcode Fuzzy Hash: b36549d0d914d4df452a0b481b35e8bcdc0d8a9b0a6b38d4e4ffffdea2b9fbc2
Instruction Fuzzy Hash: CE118271909750AFC700DF269C8495FFBE8FF88355F81482EF98997211D73899448B5A

Function 004A6BDD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00537CE4), ref: 004A6C03
InterlockedDecrement.KERNEL32(00537CE4), ref: 004A6C18

Strings

|S, xrefs: 004A6BFC

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: |S
API String ID: 2172605799-2514068008
Opcode ID: 8a70864a73938998adad891790ed32f4dccdd5f5b8bc9795c3001d6a77fd2c91
Instruction ID: 1a735c3f61f0754bfcbc474c0658fe3c822514ed036d7865dc30eee238a31331
Opcode Fuzzy Hash: 8a70864a73938998adad891790ed32f4dccdd5f5b8bc9795c3001d6a77fd2c91
Instruction Fuzzy Hash: 38F046721052059FD324EB55ACCD98FA398FFF2326F29043FF540C6290CBA89C819959

Function 004A579C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00537CE4), ref: 004A57C2
InterlockedDecrement.KERNEL32(00537CE4), ref: 004A57D7

Strings

|S, xrefs: 004A57BB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: |S
API String ID: 2172605799-2514068008
Opcode ID: 3833986c2497696eb47bcf04576a3d8aa21d921e65336cf0b05038d7e5a6cb79
Instruction ID: 7c5001207371c21b9c6378b6654a44ad5754beb2ff09263aadb10ad9a93deb21
Opcode Fuzzy Hash: 3833986c2497696eb47bcf04576a3d8aa21d921e65336cf0b05038d7e5a6cb79
Instruction Fuzzy Hash: 20F0C272105A159FE320BB55ADC598FA394FBA2315F20043FF10096251DB6CAD81996A

Function 00471C90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00471C99
ScreenToClient.USER32(?,?), ref: 00471CB4
PostMessageA.USER32(?,00000401,00000000,00000000), ref: 00471CF9

Strings

@, xrefs: 00471CE6

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ClientCursorMessagePostScreen
String ID: @
API String ID: 4019823077-2766056989
Opcode ID: 5e15fc34aa9c20d755934cb0e2410045239b2fd4cacf9539c2fd4b9fc22eb0c6
Instruction ID: 51a6f68cf32ed041a02604745ba58382935058382f18bbd992528c8d27f6cbf0
Opcode Fuzzy Hash: 5e15fc34aa9c20d755934cb0e2410045239b2fd4cacf9539c2fd4b9fc22eb0c6
Instruction Fuzzy Hash: D6F0D171A04301BFCA20DF68D848E9FB7BCEB84701F00C91DF84993250D734E9088BAA

Function 004B1B37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00537CE4), ref: 004B1B43
InterlockedDecrement.KERNEL32(00537CE4), ref: 004B1B5A

Part of subcall function 004AB7E4: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB821
Part of subcall function 004AB7E4: EnterCriticalSection.KERNEL32(?,?,?,004A62AC,00000009,00000000,00000000,00000001,004A8ED1,00000001,00000074,?,?,00000000,00000001), ref: 004AB83C

InterlockedDecrement.KERNEL32(00537CE4), ref: 004B1B86

Strings

|S, xrefs: 004B1B3C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
String ID: |S
API String ID: 2038102319-2514068008
Opcode ID: 2091d326f8b50c0ac2e50dcabf86118c8d4652221fae681f170345c0594d58b7
Instruction ID: ff05cf0ebb860d2a52cf396324d937b19cd8a59325e12bb95fc61d905c1573c8
Opcode Fuzzy Hash: 2091d326f8b50c0ac2e50dcabf86118c8d4652221fae681f170345c0594d58b7
Instruction Fuzzy Hash: 8FF0593210510CBFEB102B55AC50CDE775CEFA5335F10403FF504091619BB4694289A8

Function 004BCB65 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 004BCB76
GetClassNameA.USER32(00000000,?,0000000A), ref: 004BCB91
lstrcmpiA.KERNEL32(?,combobox), ref: 004BCBA0

Strings

combobox, xrefs: 004BCB9A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: 86a8c73e6d7f539274fd16b3e3f783f24d05f70ed43ddc3741f9381549f579d6
Instruction ID: b1babafd2da8ef9f6266ba2816aa1bf52e2367203af4d3a6207e1a2bdbf15b34
Opcode Fuzzy Hash: 86a8c73e6d7f539274fd16b3e3f783f24d05f70ed43ddc3741f9381549f579d6
Instruction Fuzzy Hash: 9DE06531954508BBCF119F70EC8AE9D3B68EB00355F544232B412D51E0DA34F586CB69

Function 004A66BC Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405a44dfda4e045c6e36d223e8c9f04ad4585a5ea2610da8f04587c1cbb83fdc
Instruction ID: 97f92e14b0e8778e656e20f0f0fb3da6dc214c92f93dbfde683dc1069e70820b
Opcode Fuzzy Hash: 405a44dfda4e045c6e36d223e8c9f04ad4585a5ea2610da8f04587c1cbb83fdc
Instruction Fuzzy Hash: 0C91FBB1C01118AEDF21AB69DC41ADF7ABCEB66764F29012BF814B6291D73D8D40C76C

Function 004AD56C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,004F8590,004F8590,?,?,004ADA38,00000000,00000010,00000000,00000009,00000009,?,004A5421,00000010,00000000), ref: 004AD58D
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,004ADA38,00000000,00000010,00000000,00000009,00000009,?,004A5421,00000010,00000000), ref: 004AD5B1
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,004ADA38,00000000,00000010,00000000,00000009,00000009,?,004A5421,00000010,00000000), ref: 004AD5CB
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,004ADA38,00000000,00000010,00000000,00000009,00000009,?,004A5421,00000010,00000000,?), ref: 004AD68C
HeapFree.KERNEL32(00000000,00000000,?,?,004ADA38,00000000,00000010,00000000,00000009,00000009,?,004A5421,00000010,00000000,?,00000000), ref: 004AD6A3

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 6a8b2745da4aa8dd9de9ca4e30a4848a1b55bcf2de7d4a9afb5c3f8c6b32f367
Instruction ID: c3a009725ef91750e703fb04ade65f11fe4a9277f723fb6918dedd84692fca19
Opcode Fuzzy Hash: 6a8b2745da4aa8dd9de9ca4e30a4848a1b55bcf2de7d4a9afb5c3f8c6b32f367
Instruction Fuzzy Hash: 3431E2B0900705AFD7308F24DC45B36B7E0EB6A754F10453EE65A9BBA0EB78A854CB4C

Function 0040F839 Relevance: 6.3, APIs: 4, Instructions: 251COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0040F84A
VariantCopyInd.OLEAUT32(?), ref: 0040F85B
VariantChangeType.OLEAUT32(?,?,00000000,00000005), ref: 0040F997
VariantClear.OLEAUT32(?), ref: 0040FBFB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Variant$ChangeClearCopyInitType
String ID:
API String ID: 365082162-0
Opcode ID: 8408c71ecdf33fc3118385fa9a4b5d91f7e657fa7df750a546c7cd961cfbab59
Instruction ID: c07016446ca865a637681ae2b8f1fde98d5612610197dd2dd5fda1fe77f329c8
Opcode Fuzzy Hash: 8408c71ecdf33fc3118385fa9a4b5d91f7e657fa7df750a546c7cd961cfbab59
Instruction Fuzzy Hash: BE915F746082029FD324DF58C490B6BB7B5AB89700F24447EE981A7791D239EC8ADF5B

Function 00435B20 Relevance: 6.2, APIs: 4, Instructions: 246COMMON

Download Yara Rule

APIs

midiStreamOpen.WINMM(?,?,00000001,00436150,?,00030000,?,?,?,00000000), ref: 00435B4B
midiStreamProperty.WINMM ref: 00435C32
midiOutPrepareHeader.WINMM(?,?,00000040,00000001,00000000,?,?,?,00000000), ref: 00435D80

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: midi$Stream$HeaderOpenPrepareProperty
String ID:
API String ID: 2061886437-0
Opcode ID: 8b7b85342de1dabec75364b769756ba1552f42c49b123c194cf084c127b36374
Instruction ID: d01c14acd0f672ca75da158ccbd975eb8435906a11bf3e26fb9c8898987ec084
Opcode Fuzzy Hash: 8b7b85342de1dabec75364b769756ba1552f42c49b123c194cf084c127b36374
Instruction Fuzzy Hash: DFA18E716006068FD724DF28D890BAAB7F6FB88304F51892EE686C7750EB35F919CB44

Function 00432E20 Relevance: 6.2, APIs: 4, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9d2e125089e230be03272b3e26224c044ada6b0437df94fe704591abb048d6
Instruction ID: d078e81d687e5aaea821d16534621559cfe33d00fac3d1699afe0b63b12df700
Opcode Fuzzy Hash: cc9d2e125089e230be03272b3e26224c044ada6b0437df94fe704591abb048d6
Instruction Fuzzy Hash: 33514EB25083419FC310EF69C981A6BF7E8FB89714F404A2EF19583340DB79E908CB66

Function 004AF020 Relevance: 6.2, APIs: 4, Instructions: 170fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(000001D0,000001D0,00000000,000001D0,00000000,00000000,00000000,00000000), ref: 004AF09A
GetLastError.KERNEL32 ref: 004AF0A4
ReadFile.KERNEL32(?,?,00000001,000001D0,00000000), ref: 004AF16A
GetLastError.KERNEL32 ref: 004AF174

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 217c50c73d27b03c23b24fe4d50b0e26439745803c4ed4e0c17887d051e542db
Instruction ID: 9051600db17ac01be7b76268cd8ef22b873f8455af3d93596beedf8eef159953
Opcode Fuzzy Hash: 217c50c73d27b03c23b24fe4d50b0e26439745803c4ed4e0c17887d051e542db
Instruction Fuzzy Hash: F151A534504385DFDF218FD8C884BAA7BB0AF27304F5444ABE8618B351D7789D4ACB59

Function 00433C30 Relevance: 6.2, APIs: 4, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00433C42
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00433C9A
__ftol.LIBCMT ref: 00433D85
__ftol.LIBCMT ref: 00433D92

Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,00000000), ref: 004BB98E
Part of subcall function 004BB96C: SelectObject.GDI32(00411F45,?), ref: 004BB9A4

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ObjectSelect__ftol$ClientRect
String ID:
API String ID: 2514210182-0
Opcode ID: fddbf0cc31342cf47f7d835f1b79900d44014be4a5afd66448eda3c3dd135a92
Instruction ID: 097d24e383bdad0b99357f8dfa4c28ccbb0f37c62f03c2bc9efbb22c6fe3636e
Opcode Fuzzy Hash: fddbf0cc31342cf47f7d835f1b79900d44014be4a5afd66448eda3c3dd135a92
Instruction Fuzzy Hash: F551BDB1A083029FC714CF29C88096BBBE5FBC8701F148A2EF98593291D774DD498B96

Function 00447BB0 Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00447BEE
GetDC.USER32(?), ref: 00447D52
ReleaseDC.USER32(?,?), ref: 00447D76
DeleteObject.GDI32(?), ref: 00447DA8

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: DeleteObject$Release
String ID:
API String ID: 2600533906-0
Opcode ID: c55c0856ef87892f386ae3ced23adde7f19b553838a4b643ea0ea362308e5485
Instruction ID: f914c7d525b1ff10cbe0d7d9cb15ce9dfafd3668eb77c4375656ab90c7be240c
Opcode Fuzzy Hash: c55c0856ef87892f386ae3ced23adde7f19b553838a4b643ea0ea362308e5485
Instruction Fuzzy Hash: 58517EB1A042009FEB14DF28C8C0B9A7BE5BF54300F08857AEC49CF306DB359946CB65

Function 00412F50 Relevance: 6.1, APIs: 4, Instructions: 144windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B9AA6: IsWindowEnabled.USER32(?), ref: 004B9AB0

IsWindowVisible.USER32(?), ref: 00412F8A

Part of subcall function 004B7A75: GetWindowTextLengthA.USER32(?), ref: 004B7A82
Part of subcall function 004B7A75: GetWindowTextA.USER32(?,00000000,00000000), ref: 004B7A9A

Part of subcall function 004B4047: SendMessageA.USER32(?,00000466,00000000,00000000), ref: 004B4053

wsprintfA.USER32 ref: 00413024
SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 00413050
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0041305F

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$MessageSend$Text$EnabledLengthVisiblewsprintf
String ID:
API String ID: 1914814478-0
Opcode ID: 1ff5672b7a5c05030ea8dca174fd9403b9661dbfa8a1bea374175be8ddb13f66
Instruction ID: bcffb39bb1fd5fb4ac62587c8d97f8fdc02a1aff517936c729ea4ca29bdd41bf
Opcode Fuzzy Hash: 1ff5672b7a5c05030ea8dca174fd9403b9661dbfa8a1bea374175be8ddb13f66
Instruction Fuzzy Hash: 19515771608741AFD324DF14C981B9BB7F5BBC8B14F10891EE59A8B780CB79E801CB96

Function 004AEE30 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,?), ref: 004AEEF7

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 724fb606fbfcbda066a490f264ae99ac4bf5b5800e92bd926dc5038df420ab48
Instruction ID: e6e720f1790f549de3a6c365f544dccaa12b738b03f8796c1abc9f86f07dfcc0
Opcode Fuzzy Hash: 724fb606fbfcbda066a490f264ae99ac4bf5b5800e92bd926dc5038df420ab48
Instruction Fuzzy Hash: 3851D37190024CEFCB11DF6AC984A9EBBB5FF62340F1081AAF9259B251D734DA41CB69

Function 00416E40 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc77b8319e5e9f2d5083a412c68961ed71832e676dd6e071b265070187c87f1
Instruction ID: 38ef5d86a5bb55aca8c03c3717dda62d424f249f670af4266f476476d1ed14e8
Opcode Fuzzy Hash: ecc77b8319e5e9f2d5083a412c68961ed71832e676dd6e071b265070187c87f1
Instruction Fuzzy Hash: 3C316C763147019FE720DF29E881BAB73E5EB84714F014D2EF542DB281D675E8828BA9

Function 0043F920 Relevance: 6.1, APIs: 4, Instructions: 108windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0043F994
SendMessageA.USER32(?,000000B1,?,000000FF), ref: 0043F9ED
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0043F9FC
SendMessageA.USER32(?,000000C2,00000000,?), ref: 0043FA2A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$Window
String ID:
API String ID: 2326795674-0
Opcode ID: 1a34b4f1918982f5afb8e296f3d23751fce46679d27de4c6fdf80ee631b96422
Instruction ID: 6f547b9dc02c59687ef8c7c416d0a96bd5cd55170f45adfde745bb635eb58306
Opcode Fuzzy Hash: 1a34b4f1918982f5afb8e296f3d23751fce46679d27de4c6fdf80ee631b96422
Instruction Fuzzy Hash: 3541B3726487419FD320DB59D840B6BF7E4EB98720F448A2EF4A5973D1C378D409CBA6

Function 00476520 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

]"G, xrefs: 004765E8

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID: ]"G
API String ID: 0-3559913186
Opcode ID: 1362c6a4babbfb5b1be9d9b8e8be7288574cdd6d4d451afc7a822328402f9561
Instruction ID: 540b65ed9232267abbde1a3907145175255cec7d49206df7e0a00cb5a59574ba
Opcode Fuzzy Hash: 1362c6a4babbfb5b1be9d9b8e8be7288574cdd6d4d451afc7a822328402f9561
Instruction Fuzzy Hash: 5431D2723006059BCF18DF59E880ABAB39AEB50715B45C46FE90ACB205DB75D800DBA8

Function 00453CE0 Relevance: 6.1, APIs: 4, Instructions: 100windowCOMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(?), ref: 00453D6A
SendMessageA.USER32(?,00000030,00000000,00000000), ref: 00453DAE
SendMessageA.USER32(?,000000B1,?,000000FF), ref: 00453DE4
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00453DF3

Part of subcall function 004B99AD: SetWindowTextA.USER32(?,0042DEFA), ref: 004B99BB

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$BrushCreateSolidTextWindow
String ID:
API String ID: 3501373727-0
Opcode ID: 90c8b331a8517e585e3a0c19096cf093a7df751af5bea5285153f9d250ab5be3
Instruction ID: 332e826a61122815453a21c3ca5adc445db046fe95c89b4b26d42a32998ae84b
Opcode Fuzzy Hash: 90c8b331a8517e585e3a0c19096cf093a7df751af5bea5285153f9d250ab5be3
Instruction Fuzzy Hash: 533148B46047009FC354DF19C881B2AF7F5EB88B10F508A1EF99587391CB78E904CB59

Function 00473070 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00473085
SendMessageA.USER32(?,00000419,?,00000000), ref: 004730BC
SendMessageA.USER32(?,00000433,?,?), ref: 00473122
ClientToScreen.USER32(?,?), ref: 0047314E

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$ClientScreenWindow
String ID:
API String ID: 4074774880-0
Opcode ID: 7f149c26f12a1b4515179127850cc9698cc65ebbb711e446af87daace6f65720
Instruction ID: 3349bd06dc56a8c2f41b7190f0abe4633ac89b0b4fa40f142dc8975ab2c78949
Opcode Fuzzy Hash: 7f149c26f12a1b4515179127850cc9698cc65ebbb711e446af87daace6f65720
Instruction Fuzzy Hash: 02313CB1608301AFD324CF29D881A9FB7E4EB88794F40892EF95987340D774E9058B6A

Function 004B9C98 Relevance: 6.1, APIs: 4, Instructions: 85stringtimeCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(004B9C94,?,00000104,?,?,?,?,?,?,?,004B9C82,?), ref: 004B9CC2
GetFileTime.KERNEL32(00000000,004B9C82,?,?,?,?,?,?,?,?,?,004B9C82,?), ref: 004B9CE3
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,004B9C82,?), ref: 004B9CF2
GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,004B9C82,?), ref: 004B9D13

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: File$AttributesSizeTimelstrcpyn
String ID:
API String ID: 1499663573-0
Opcode ID: fc6b607fd979dd69a754143c57fec174864a418bc03e6f700f66080cf18dbd88
Instruction ID: 7e74ca12534bedb04af2f30cff0b43b5b386ed202d35761296958509e348da30
Opcode Fuzzy Hash: fc6b607fd979dd69a754143c57fec174864a418bc03e6f700f66080cf18dbd88
Instruction Fuzzy Hash: CE318E72500605AFD720DFA1C885EEBBBFCEB14310F104A2AE656D7290D774A984CBA4

Function 0041CFD0 Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 0041D068
ScreenToClient.USER32(?,?), ref: 0041D08A
ChildWindowFromPointEx.USER32(?,?,?,00000005), ref: 0041D0A0
GetFocus.USER32 ref: 0041D0AB

Part of subcall function 004B9AE8: SetFocus.USER32(?,00422B93), ref: 004B9AF2

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Focus$ChildClientFromMessagePointScreenWindow
String ID:
API String ID: 3117237277-0
Opcode ID: 07a676e86ad80c02e0a471a78678d71f2d63b7e378f0a37fde66402e9aafe534
Instruction ID: d40b407776c3bb5f4fe6862fdb83afdab694d0bd1db678f0dba43f59d89cffca
Opcode Fuzzy Hash: 07a676e86ad80c02e0a471a78678d71f2d63b7e378f0a37fde66402e9aafe534
Instruction Fuzzy Hash: F121A5717006026FD624AB24DC41FAFB7A9AF84308F04852EF94587285DB78F982C7A9

Function 004A3970 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 004A3996

Part of subcall function 004A9128: HeapCreate.KERNELBASE(00000000,00001000,00000000,004A39CE,00000001), ref: 004A9139
Part of subcall function 004A9128: HeapDestroy.KERNEL32 ref: 004A9178

GetCommandLineA.KERNEL32 ref: 004A39F6
GetStartupInfoA.KERNEL32(?), ref: 004A3A21
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004A3A44

Part of subcall function 004A3A9D: ExitProcess.KERNEL32 ref: 004A3ABA

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: 873566874d538816f43008a165908b583b5bcc52dd2c84707f29c5ec44d396c5
Instruction ID: 8ce6b002e4a447fa27dfc0a84d7836fbe34ed5b73d7f7fa40a59ae8cd6bfb1e2
Opcode Fuzzy Hash: 873566874d538816f43008a165908b583b5bcc52dd2c84707f29c5ec44d396c5
Instruction Fuzzy Hash: A921B6B1940755AFD708AFA6DC09A6E7BACEF26704F10052FF4019A391DF7C4940DB98

Function 00454590 Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000002D), ref: 004545B9
SystemParametersInfoA.USER32 ref: 00454613
CreateFontIndirectA.GDI32(?), ref: 00454621
CreatePalette.GDI32(00000300), ref: 00454679

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CreateSystem$FontIndirectInfoMetricsPaletteParameters
String ID:
API String ID: 934993634-0
Opcode ID: 828a7b85a37e210ea3a2f33f72521aa708873629572f7f5f4fa7d3b0e2349af9
Instruction ID: d3084bc69a949a50aa64d40f7fd161f6f89270a3f4325afa6f685461921fb7f9
Opcode Fuzzy Hash: 828a7b85a37e210ea3a2f33f72521aa708873629572f7f5f4fa7d3b0e2349af9
Instruction Fuzzy Hash: B1318E75404B408FD320CF25C888A9BFBF5FF95308F80896EE59A8B651DB75A448CB65

Function 0041D8F0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

StartPage.GDI32(?), ref: 0041D935
EndPage.GDI32(?), ref: 0041D95B

Part of subcall function 0042B8E0: wsprintfA.USER32 ref: 0042B8EF

Part of subcall function 004B99AD: SetWindowTextA.USER32(?,0042DEFA), ref: 004B99BB

UpdateWindow.USER32(?), ref: 0041D9AA
EndPage.GDI32(?), ref: 0041D9C2

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Page$Window$StartTextUpdatewsprintf
String ID:
API String ID: 104827578-0
Opcode ID: eed53501be4d68b368ec47ca1d1dc50780c9e4301c32fd66cd11f8b42f115f32
Instruction ID: 589aeea76b4e0705a9f5892d0182a9c08713dd0031085f68fb13875f061bb2f6
Opcode Fuzzy Hash: eed53501be4d68b368ec47ca1d1dc50780c9e4301c32fd66cd11f8b42f115f32
Instruction Fuzzy Hash: 442141B1A11F009FC3249B3ADC88ADBB7E4EFC5705F54482EE49FC7210E634A4458B59

Function 00414010 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetParent.USER32(000000D0), ref: 0041403C
GetParent.USER32(?), ref: 00414051
SetParent.USER32(?,?), ref: 0041406F
GetWindowRect.USER32(?,?), ref: 00414084

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Parent$RectWindow
String ID:
API String ID: 2276825053-0
Opcode ID: 95642da11e4ec409d9d24c8069c19d9106f07a0ebaf50f5aa27224c4d4ffb8f1
Instruction ID: 2eed01020eeb1f16c14b6d57897540545103c0d550a254f477e00191a82f36b9
Opcode Fuzzy Hash: 95642da11e4ec409d9d24c8069c19d9106f07a0ebaf50f5aa27224c4d4ffb8f1
Instruction Fuzzy Hash: F911AFB1204705AFD724EF65D885EABB7EDEBC8300F004A1EB94583345EA79EC468774

Function 004759E0 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00475AC0: GetTopWindow.USER32(75C11AC0), ref: 00475ACD
Part of subcall function 00475AC0: IsWindowVisible.USER32(00000000), ref: 00475AE2
Part of subcall function 00475AC0: GetTopWindow.USER32(00000000), ref: 00475AED
Part of subcall function 00475AC0: GetWindow.USER32(00000000,00000002), ref: 00475B08

GetWindowRect.USER32(?,?), ref: 00475A48
IntersectRect.USER32(?,?,?), ref: 00475A55
IsRectEmpty.USER32(?), ref: 00475A60

Part of subcall function 004BBEDE: ScreenToClient.USER32(?,75C07310), ref: 004BBEF2
Part of subcall function 004BBEDE: ScreenToClient.USER32(?,75C07318), ref: 004BBEFB

RedrawWindow.USER32(?,00000705,00000000,00000705,?,?,?,?,?,75C11AC0,?,004C4278,000000FF,004759C6,?,?), ref: 00475A89

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$Rect$ClientScreen$EmptyIntersectRedrawVisible
String ID:
API String ID: 1303225554-0
Opcode ID: fb4b542858f37d75578bba7463082fc062c2fc1a79a539c8c388faa7a79491c8
Instruction ID: 1cb0ea64bf5466e5123a5a01818131be20faa865bd55d67f4d7ed95bb730a88c
Opcode Fuzzy Hash: fb4b542858f37d75578bba7463082fc062c2fc1a79a539c8c388faa7a79491c8
Instruction Fuzzy Hash: 5B21B371108B05ABC300DF54D885EAFB3E9FFC8714F404E1EF14557290E778A9498BA6

Function 00476310 Relevance: 6.1, APIs: 4, Instructions: 63windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000030,?,00000001), ref: 0047636D
SendMessageA.USER32(?,00000030,?,00000001), ref: 00476386
GetStockObject.GDI32(00000011), ref: 00476391
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 004763A4

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$ObjectStock
String ID:
API String ID: 1309931672-0
Opcode ID: 27ef1c9809e9f9f80e9ecf746651091ac62edb461fbf664de10e256ed5a04283
Instruction ID: 83fd498339ad49a3b5336a20ab12fb62284434035e39fb51bb26532d75c4520d
Opcode Fuzzy Hash: 27ef1c9809e9f9f80e9ecf746651091ac62edb461fbf664de10e256ed5a04283
Instruction Fuzzy Hash: 99118E32300711ABC754DF55E854FAFB3AAAF88B50F05841EFA189B280C774EC41CBA5

Function 00411650 Relevance: 6.1, APIs: 4, Instructions: 63windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000030,?,00000001), ref: 004116AD
SendMessageA.USER32(?,00000030,?,00000001), ref: 004116C6
GetStockObject.GDI32(00000011), ref: 004116D1
SendMessageA.USER32(?,00000030,00000000,00000001), ref: 004116E4

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$ObjectStock
String ID:
API String ID: 1309931672-0
Opcode ID: dbd76d84e3fb6e371384bd99609535f451aee5728b8c5fbb1e41b5a990710c0c
Instruction ID: c584a19feae8caa4d2fbb9d7d1892e30dfcb7993c816eca09a157f92ba6765af
Opcode Fuzzy Hash: dbd76d84e3fb6e371384bd99609535f451aee5728b8c5fbb1e41b5a990710c0c
Instruction Fuzzy Hash: 13116032300710ABCA54DF59E844F9BB3AAAF88B10F05841AF6059B291C775FC81CBA5

Function 00472BE0 Relevance: 6.1, APIs: 4, Instructions: 62windowCOMMON

Download Yara Rule

APIs

ImageList_GetIcon.COMCTL32(?,?,00000000,00000000,?,?,00472DCD,00000000,?,?,?,?,004712E2), ref: 00472BFB
SendMessageA.USER32(?,0000040F,00000000,00000000), ref: 00472C16
DestroyIcon.USER32(00000000,?,?,?,004712E2), ref: 00472C25
DestroyIcon.USER32(?,?,?,?,004712E2), ref: 00472C5D

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Icon$Destroy$ImageList_MessageSend
String ID:
API String ID: 1019128568-0
Opcode ID: 940da4e25818543b9752e71a49b9738ef702b8449227d6609815b70e30645d30
Instruction ID: 0c1a492bfdf0fd186808ccbacd1e3363ef03f1e3f4310df547ee2a23f501205f
Opcode Fuzzy Hash: 940da4e25818543b9752e71a49b9738ef702b8449227d6609815b70e30645d30
Instruction Fuzzy Hash: 9B118F31300A12AFD7299F65D984F9FB7A9FF64740F00852EE55AD7200D7B4E84487A9

Function 0041F820 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 0041F82D

Part of subcall function 0041F660: IsChild.USER32(?,?), ref: 0041F6DD
Part of subcall function 0041F660: GetParent.USER32(?), ref: 0041F6F7

SendMessageA.USER32(00000000,000000F0,00000000,00000000), ref: 0041F886
SendMessageA.USER32(00000000,000000F1,00000000,00000000), ref: 0041F896
GetWindow.USER32(00000000,00000002), ref: 0041F89B

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSendWindow$ChildParent
String ID:
API String ID: 1043810220-0
Opcode ID: fbc2123e0d96337199ae89bc6ce24a995754b50033166662c3fb1ad31498f8ca
Instruction ID: eb986038dec96e91c8eb99dcd19fea324c5517a910c9452105ed604e9b57cdf0
Opcode Fuzzy Hash: fbc2123e0d96337199ae89bc6ce24a995754b50033166662c3fb1ad31498f8ca
Instruction Fuzzy Hash: 1201D831381B13B6E231A6299C46FAF725C9F41B50F100132F704AB2D0DF68FC86816C

Function 00444BA0 Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00444BBB
SendMessageA.USER32(?,000083EB,?,00000000), ref: 00444BE5
SendMessageA.USER32(?,000083EC,?,00000000), ref: 00444BF9
SendMessageA.USER32(?,000083E9,?,00000000), ref: 00444C1C

Part of subcall function 004B99D4: GetDlgCtrlID.USER32(?), ref: 004B99DE

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID:
API String ID: 1383977212-0
Opcode ID: 9d67598affa84f1974182ada1ead0d8344d136920b7071fb87880868efbf2840
Instruction ID: 04de4db42cde287b3f245e7281852d002a06c6a52febaa3d5c067599c9c174df
Opcode Fuzzy Hash: 9d67598affa84f1974182ada1ead0d8344d136920b7071fb87880868efbf2840
Instruction Fuzzy Hash: A6014FB2200A187BE650A76A8CC5E6FB3ADABC4B05B04851EF64187381CE69EC424778

Function 004AE893 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000100,.K,004AE86B,.K,.K,00000100,00000000,004B092E,00000000), ref: 004AE8CD
GetLastError.KERNEL32 ref: 004AE8D7

Strings

.K, xrefs: 004AE893
.K, xrefs: 004AE894, 004AE899, 004AE8C5, 004AE8E3

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: .K$.K
API String ID: 918212764-663606781
Opcode ID: 9b7233ef9dc89d5d9b7b0b7723698eca9ea7247c0f9b8e995ae4816cc7585dd6
Instruction ID: 5eaf4b67f42ddee1b52249e0f868142718485f7bb125e16fc0aa5d38b2cc0582
Opcode Fuzzy Hash: 9b7233ef9dc89d5d9b7b0b7723698eca9ea7247c0f9b8e995ae4816cc7585dd6
Instruction Fuzzy Hash: FB01F23350561055CB70323B6C49AAF22285F93B74F65051FF825872E1DF1CD88250AD

Function 004B5D5C Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 004B5D90
GetCurrentProcess.KERNEL32(?,00000000), ref: 004B5D96
DuplicateHandle.KERNEL32(00000000), ref: 004B5D99
GetLastError.KERNEL32(00000000), ref: 004B5DB3

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast
String ID:
API String ID: 3907606552-0
Opcode ID: b5cf61755c4a9be336184cd5dad5e61aa188e557e1b739d738f786eb299cf5ba
Instruction ID: 1a6e3a3744e795e6ed6b636ee01d6f399091fcf1b6f7b8ea9e9083b261b018f4
Opcode Fuzzy Hash: b5cf61755c4a9be336184cd5dad5e61aa188e557e1b739d738f786eb299cf5ba
Instruction Fuzzy Hash: 9A018431700700ABEB50ABA9CC49F9ABBEDDF84750F144126F905CB291EAA4ED408B78

Function 004B4445 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WindowFromPoint.USER32(?,?), ref: 004B445D
GetParent.USER32(00000000), ref: 004B446A
ScreenToClient.USER32(00000000,?), ref: 004B448B
IsWindowEnabled.USER32(00000000), ref: 004B44A4

Part of subcall function 004BCB65: GetWindowLongA.USER32(00000000,000000F0), ref: 004BCB76

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$ClientEnabledFromLongParentPointScreen
String ID:
API String ID: 2204725058-0
Opcode ID: 8580a51de6d55d4a441fc80c504a6dec27439c6a11f6c7d3a72e9722db5e65fd
Instruction ID: 1f7bdae28dab305d360205145f13ea31954c50778c6c50480c19b7249f00734e
Opcode Fuzzy Hash: 8580a51de6d55d4a441fc80c504a6dec27439c6a11f6c7d3a72e9722db5e65fd
Instruction Fuzzy Hash: 0C01BC36600900BB87129B58DC48EAFBBBAEF85741B14402AF901D7311EB38ED51977D

Function 00477960 Relevance: 6.0, APIs: 4, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 004779A8
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004779B1
HeapFree.KERNEL32(00000000), ref: 004779B8
RedrawWindow.USER32(?,00000000,00000000,00000705), ref: 004779C8

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: HeapWindow$FreeLongProcessRedraw
String ID:
API String ID: 660112752-0
Opcode ID: 40efdb257ea8e123a8f99d099717e4bc1db92f2a60eca0c815b5bb9697546de2
Instruction ID: ec1dd31e464e2832a08094ca73febed34770d41032bc4a8fdfa5ac8b21b8219d
Opcode Fuzzy Hash: 40efdb257ea8e123a8f99d099717e4bc1db92f2a60eca0c815b5bb9697546de2
Instruction Fuzzy Hash: CC012DF3609B10ABD3208B64DC84E5BB364B7C4751F518626FB49D7340D734EC008B98

Function 004B8711 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 004B871C
GetTopWindow.USER32(00000000), ref: 004B872F
GetTopWindow.USER32(?), ref: 004B875F
GetWindow.USER32(00000000,00000002), ref: 004B877A

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 8a32d054f5e920c69c41b42258b2b957983ac1071edd2215c5a80c8f81393ceb
Instruction ID: 57e9e7ef7e6194651ae1d2c3cfc0d4e672d37763deac4f1e23bed629c8139d55
Opcode Fuzzy Hash: 8a32d054f5e920c69c41b42258b2b957983ac1071edd2215c5a80c8f81393ceb
Instruction Fuzzy Hash: 82018F3210161AAB8B622B668C04EDF3A5C9F4075CF25412AFD0095210EF79C951D6BD

Function 004B878A Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 004B8798
SendMessageA.USER32(00000000,?,?,?), ref: 004B87CE
GetTopWindow.USER32(00000000), ref: 004B87DB
GetWindow.USER32(00000000,00000002), ref: 004B87F9

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$MessageSend
String ID:
API String ID: 1496643700-0
Opcode ID: 123128ce87065a593dcaf03f0ec77d178b87a7274c84dec1fd7c01657b50980e
Instruction ID: c300d533f26741f17420f5b952dcb65a8f1c1ebd3dcaad63b265ce95b3539102
Opcode Fuzzy Hash: 123128ce87065a593dcaf03f0ec77d178b87a7274c84dec1fd7c01657b50980e
Instruction Fuzzy Hash: 4D01D73200161AFBCF526F95DC04EDF3B2AAF44358F15401AFA1055161CF3AC961EBB9

Function 004BD4E7 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 004BD513
RegCloseKey.ADVAPI32(00000000,?,?), ref: 004BD51C
wsprintfA.USER32 ref: 004BD538
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 004BD551

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: 55338c1f309a404401d9c868272ab9f4f6ca6d0702989e1d39e43ca5fec2223b
Instruction ID: 1bb7cfc17142b4de0cdb17ad078f0deddb9ad7ff137177b98d816c062740a4c6
Opcode Fuzzy Hash: 55338c1f309a404401d9c868272ab9f4f6ca6d0702989e1d39e43ca5fec2223b
Instruction Fuzzy Hash: 05016232400615BBCB225F68DC09FEF3BA9BF08718F044426BA15D6161E774D554DB98

Function 00446580 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004465C3
wsprintfA.USER32 ref: 004465D9

Strings

gfff, xrefs: 0044658B
%d.%d, xrefs: 004465D3

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: wsprintf
String ID: %d.%d$gfff
API String ID: 2111968516-3773932281
Opcode ID: a0951475fac3eef7aa27ba027a1680770343b585676463262a6b0c3f060366b4
Instruction ID: 8dbeea4c0d68c72181f02f367585d9ac8bdff7c54cb3bf98bb05fef1018f65c1
Opcode Fuzzy Hash: a0951475fac3eef7aa27ba027a1680770343b585676463262a6b0c3f060366b4
Instruction Fuzzy Hash: 84F0506170031167C75CA51F7C15F1B6B9AEBDA711F05843FF444CB394D530DC1142AA

Function 004B298B Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(005341E0,00000001), ref: 004B29B3
InitializeCriticalSection.KERNEL32(005341C8,?,?,?,004B294A), ref: 004B29BE
EnterCriticalSection.KERNEL32(005341C8,?,?,?,004B294A), ref: 004B29FD

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalSection$EnterExchangeInitializeInterlocked
String ID:
API String ID: 3643093385-0
Opcode ID: c1013772b75b280e31b405a7d4c4c9768158f4cb4d27ac40711c6df3e91c5e92
Instruction ID: d7d8fddfbb58993ccb920f5fe0a0fd7d9c47a6d98cf8cdbf4669ba2f08fedf5a
Opcode Fuzzy Hash: c1013772b75b280e31b405a7d4c4c9768158f4cb4d27ac40711c6df3e91c5e92
Instruction Fuzzy Hash: 40F0A4B9344A109AC6A19750BE85EAB3B94F374791F100627F505C2260D3F86DC5EF3D

Function 004B8E79 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,0000000C,?), ref: 004B8EB7
SetBkColor.GDI32(00000000,00000000), ref: 004B8EC3
GetSysColor.USER32(00000008), ref: 004B8ED3
SetTextColor.GDI32(00000000,?), ref: 004B8EDD

Part of subcall function 004BCB65: GetWindowLongA.USER32(00000000,000000F0), ref: 004BCB76

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Color$LongObjectTextWindow
String ID:
API String ID: 2871169696-0
Opcode ID: 3139a7fd2ad4dceaa2347f9c3c533d2e73abe20ec168ef87189cbdda9fa89e0e
Instruction ID: 8950ddbe38399221bcffca5b7d1f4ab30e48d40c442e42a7e49eb3153586aa36
Opcode Fuzzy Hash: 3139a7fd2ad4dceaa2347f9c3c533d2e73abe20ec168ef87189cbdda9fa89e0e
Instruction Fuzzy Hash: 00014B32100209ABDFA19F64DC49BEF3B69EB00356F14492AF901D42E0CB74D892DBA9

Function 004BC007 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

GetWindowExtEx.GDI32(?,?), ref: 004BC018
GetViewportExtEx.GDI32(?,?), ref: 004BC025
MulDiv.KERNEL32(?,00000000,00000000), ref: 004BC04A
MulDiv.KERNEL32(?,00000000,00000000), ref: 004BC065

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ViewportWindow
String ID:
API String ID: 1589084482-0
Opcode ID: b014b24f38ff7a93ecb1a6675a016cc68c9b0b121fb33181b62c2e904dcb1295
Instruction ID: 99597ec6858bca825da82a90112dc4b01508fc0b354a8e4b9392ad0cc8edb3cc
Opcode Fuzzy Hash: b014b24f38ff7a93ecb1a6675a016cc68c9b0b121fb33181b62c2e904dcb1295
Instruction Fuzzy Hash: B3F069B2800118BFEB106B62DC06CAEBBBDFF50390711442EF85192030EB716D509B58

Function 00475AC0 Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(75C11AC0), ref: 00475ACD
IsWindowVisible.USER32(00000000), ref: 00475AE2
GetTopWindow.USER32(00000000), ref: 00475AED
GetWindow.USER32(00000000,00000002), ref: 00475B08

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Window$Visible
String ID:
API String ID: 3657826678-0
Opcode ID: c165b26a8ce818d573ede95b1deb55b93f88f3000a9308c5c029522818f50df3
Instruction ID: bdbf759779b86bce7922318a878fd6474e9ef00210502f79ff5bb5fb13a3c698
Opcode Fuzzy Hash: c165b26a8ce818d573ede95b1deb55b93f88f3000a9308c5c029522818f50df3
Instruction Fuzzy Hash: 0DF02732602E21738222666A6C85DEFB39C5F85750B454136F90CEB201DA58FC0182FD

Function 00444520 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 0044452F
PtInRect.USER32(?,?,?), ref: 00444544

Part of subcall function 004B9AA6: IsWindowEnabled.USER32(?), ref: 004B9AB0

Part of subcall function 00444960: UpdateWindow.USER32(00000002), ref: 0044497D

GetCapture.USER32 ref: 0044456C
SetCapture.USER32(00000002), ref: 00444577

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CaptureRectWindow$ClientEnabledUpdate
String ID:
API String ID: 2789096292-0
Opcode ID: ddc21f8543bd3c381111100056528f05d561ae8c79d24bec9b9edc6ab3ea986c
Instruction ID: a4369c4ca2475948a4acdeebe74a15eb988f1ff9e01dcaaeea87b42edcf37acb
Opcode Fuzzy Hash: ddc21f8543bd3c381111100056528f05d561ae8c79d24bec9b9edc6ab3ea986c
Instruction Fuzzy Hash: 26F04F71204A10BBEB60AB25DC45E6F73ADBF98700B44491EF541D2258DF79E9018BA9

Function 00419AC0 Relevance: 6.0, APIs: 4, Instructions: 35registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 00419ADA
RegQueryValueA.ADVAPI32 ref: 00419AFE
lstrcpyA.KERNEL32(?,00000000), ref: 00419B11
RegCloseKey.ADVAPI32(?), ref: 00419B1C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CloseOpenQueryValuelstrcpy
String ID:
API String ID: 534897748-0
Opcode ID: f26c431da274902331ba5722c92b3d105d21dfe255d7cf8212bcf338492f7356
Instruction ID: cae5afd43b227076c4cccce386348624075d6ac9f4522ef4bb6cf6289d6c7d78
Opcode Fuzzy Hash: f26c431da274902331ba5722c92b3d105d21dfe255d7cf8212bcf338492f7356
Instruction Fuzzy Hash: 14F03C79104301BFD324DB10D898EAFBBA8FBC4754F00891DB98882250D670E884CBE2

Function 004BCC4F Relevance: 6.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004BCC5C
GetWindowTextA.USER32(?,?,00000100), ref: 004BCC78
lstrcmpA.KERNEL32(?,?), ref: 004BCC8C
SetWindowTextA.USER32(?,?), ref: 004BCC9C

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: 565b0ff28dcdeeb86a9215bfa862aabf4e9c7133901a3d7ce3ddc58aa23914d0
Instruction ID: 0f5bc465835f0355f183f68376a5543f3c675079c0935ff069fd38d6049a7afd
Opcode Fuzzy Hash: 565b0ff28dcdeeb86a9215bfa862aabf4e9c7133901a3d7ce3ddc58aa23914d0
Instruction Fuzzy Hash: 85F0FE75500118ABCF626F24EC48EDE7FB9EB28391F408061F84DD5160D77499958B98

Function 004A3B42 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004A3BD2

Strings

pow, xrefs: 004A3BAA, 004A3BC7

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 6d1be0206977d2c42d8614ab2518edec5b2aa33d7dd1a6e70778b07cca543eeb
Instruction ID: 614ee805c0e1c64d293bd913ac8d11bf53f3a3a24f8751d287ab96853bc21904
Opcode Fuzzy Hash: 6d1be0206977d2c42d8614ab2518edec5b2aa33d7dd1a6e70778b07cca543eeb
Instruction Fuzzy Hash: 73513621A0960186DB117F18C80137B6BD49B73721F3089ABF086463A9FB3D8ED5A65E

Function 0043FD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CopyRect.USER32(?,00000000), ref: 0043FEA0
IsRectEmpty.USER32(?), ref: 0043FEAB

Part of subcall function 0043CF80: CreateFontIndirectA.GDI32(?), ref: 0043D0AC

Part of subcall function 00453CE0: CreateSolidBrush.GDI32(?), ref: 00453D6A
Part of subcall function 00453CE0: SendMessageA.USER32(?,00000030,00000000,00000000), ref: 00453DAE
Part of subcall function 00453CE0: SendMessageA.USER32(?,000000B1,?,000000FF), ref: 00453DE4
Part of subcall function 00453CE0: SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00453DF3

Strings

!K, xrefs: 0043FF56

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$CreateRect$BrushCopyEmptyFontIndirectSolid
String ID: !K
API String ID: 4199050670-3405271303
Opcode ID: eb58d2718eaac08f05511b29d8e8ee82875bdca20831a136a1d3094341cd86e5
Instruction ID: 5ca30e49bc85f3bca1d3ef77891c1026384728387acde730741feae2fffa1aa2
Opcode Fuzzy Hash: eb58d2718eaac08f05511b29d8e8ee82875bdca20831a136a1d3094341cd86e5
Instruction Fuzzy Hash: 2261A2716087419FD314DB25C841B6BB7E9BBDD708F00592EF58683281EBB8E809CB66

Function 004200D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00423AD0: GetCurrentThreadId.KERNEL32 ref: 00423AF5
Part of subcall function 00423AD0: IsWindow.USER32(00010456), ref: 00423B11
Part of subcall function 00423AD0: SendMessageA.USER32(00010456,000083E7,?,00000000), ref: 00423B2A
Part of subcall function 00423AD0: ExitProcess.KERNEL32 ref: 00423B3F

DeleteCriticalSection.KERNEL32(00507808,?,?,?,?,?,?,?,?,0042B15D), ref: 0042010A

Part of subcall function 004B7738: __EH_prolog.LIBCMT ref: 004B773D

Strings

#, xrefs: 00420383
!, xrefs: 004200F8

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalCurrentDeleteExitH_prologMessageProcessSectionSendThreadWindow
String ID: !$#
API String ID: 2888814780-2504090897
Opcode ID: a22c422921cdf1853287caaad1a964932c92eef3efbcd746aa91fcf200c8a74e
Instruction ID: aa5f54ece0ac9a33689aa275f60b1d36a90cc6a28a814d8cca718daa0efd33f2
Opcode Fuzzy Hash: a22c422921cdf1853287caaad1a964932c92eef3efbcd746aa91fcf200c8a74e
Instruction Fuzzy Hash: F79191740087818AE351EF78C4957DABFD4AFA1348F54084EE4D947393DBB96288CBB6

Function 00436D70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

, xrefs: 00436DA9

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 52f70e4b1c05a1fb3fdf4dfc1a22a1016693d85ebb7ce87a1f44f5471c152465
Instruction ID: 4075c9dc3c7b7b578a62e081b5fea093ed2ab50dd9026256392c36802d27a733
Opcode Fuzzy Hash: 52f70e4b1c05a1fb3fdf4dfc1a22a1016693d85ebb7ce87a1f44f5471c152465
Instruction Fuzzy Hash: F6519175204342AFD314DF19C891BAFB7A4FF99358F10462EF94283291D739E885CB9A

Function 00418500 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000401,00000000,?), ref: 0041862A
SendMessageA.USER32(?,00000402,?,00000000), ref: 00418657

Strings

msctls_progress32, xrefs: 004185DE

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID: msctls_progress32
API String ID: 3850602802-3107856198
Opcode ID: 9b96d6d13537effcbf76e5970cde5fe9a472c42bc957588b32b76c6ac0c049cb
Instruction ID: bba825777818e37f9b2e4a631336126a07e4cd79b151d142f264410a64fd0a32
Opcode Fuzzy Hash: 9b96d6d13537effcbf76e5970cde5fe9a472c42bc957588b32b76c6ac0c049cb
Instruction Fuzzy Hash: 3D413E71704B019BD318CA19CD91B6BB3E6EB88B04F14892EF646C7780DA79EC418B55

Function 004A84E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004A84F4

Strings

, xrefs: 004A853D
, xrefs: 004A8519

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: f5619b743ba16e76016e267963a2028237f57d758cc7283c77ba6b4b2a004643
Instruction ID: 145e4368d98f0300aaf23344c92dc6d757a95b316a8dbac81b93e26f8b45cad4
Opcode Fuzzy Hash: f5619b743ba16e76016e267963a2028237f57d758cc7283c77ba6b4b2a004643
Instruction Fuzzy Hash: D8419C3180825C6FEB259724CC89BFB3FADEB3B700F0414EAD545C7252CA694E08DB66

Function 00436B02 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

, xrefs: 00436B45

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: fe1f0954ef2e07c4cb42a1b27fa0231a082b0df5d7fa51894ea3a6601d41936b
Instruction ID: 0761f2057cda869b57eeb76ad42b8489528ecaa485b09d8cfcb2d66bf59a0dc6
Opcode Fuzzy Hash: fe1f0954ef2e07c4cb42a1b27fa0231a082b0df5d7fa51894ea3a6601d41936b
Instruction Fuzzy Hash: 8E417D71108341AFD354DF24C854BABB7A4FB98724F008A2EF49687290DB78E945CF9A

Function 004B20DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004B0658: SetFilePointer.KERNEL32(00000000,?,00000000,00000000,00000000,?,004AEE7D,?,00000000,00000002,00000001,?,?), ref: 004B0682
Part of subcall function 004B0658: GetLastError.KERNEL32 ref: 004B068F

SetEndOfFile.KERNEL32(00000000,?,?,?,00000100,?,?,?,004B095A,00000000,?), ref: 004B21BA
GetLastError.KERNEL32(?,?,?,00000100,?,?,?,004B095A,00000000,?), ref: 004B21D8

Strings

ZK, xrefs: 004B2121, 004B21A3, 004B2190, 004B2158

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ErrorFileLast$Pointer
String ID: ZK
API String ID: 1697706070-2930135333
Opcode ID: 6ee6e68608b756f9d9eb7d3604567cc743414df891c10b107c46bf0a751d936d
Instruction ID: 023cf47c6d7ebcc903c64dd6405c8847236af536fc23da2293f3e43e92337e97
Opcode Fuzzy Hash: 6ee6e68608b756f9d9eb7d3604567cc743414df891c10b107c46bf0a751d936d
Instruction Fuzzy Hash: DF3109725001147BCF213F6DCD05BCE3B65AF11364F014137FA189A2A1DA79CD5197B8

Function 0041A140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000005), ref: 0041A220
LoadCursorA.USER32(00000000,00007F00), ref: 0041A22E

Strings

_EL_Timer, xrefs: 0041A237

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CursorLoadObjectStock
String ID: _EL_Timer
API String ID: 3794545487-970978732
Opcode ID: e540b94b0b71b5e6d023e64fedc04ac6c83104314ca2d3ba70a67ece4b3c82dd
Instruction ID: 9cf81fc25a8b263a97143532a07da9f7e6f8d3051ccb479a3c9da809900ca6d9
Opcode Fuzzy Hash: e540b94b0b71b5e6d023e64fedc04ac6c83104314ca2d3ba70a67ece4b3c82dd
Instruction Fuzzy Hash: 3A317AB1658B10AFD354DB58CC41F6BB7E4EB88B50F104A1EFA5687380D679A840CB96

Function 00414990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000005), ref: 00414A61
LoadCursorA.USER32(00000000,00007F00), ref: 00414A6F

Part of subcall function 0042C750: GetClassInfoA.USER32(?,?,00000000), ref: 0042C768

Strings

_EL_Label, xrefs: 00414A78

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: ClassCursorInfoLoadObjectStock
String ID: _EL_Label
API String ID: 1762135420-1571322718
Opcode ID: 5bb2ad3c5eb2a1a9c1ba41fdd19cfc4499a01463db662fbf1258736675b1db57
Instruction ID: bb24d4fe0337837411ef20cdfdce07aee1989f76f1a24c60c31ce2e34d22fbad
Opcode Fuzzy Hash: 5bb2ad3c5eb2a1a9c1ba41fdd19cfc4499a01463db662fbf1258736675b1db57
Instruction Fuzzy Hash: 753180B1608740AFD314DB58CC41F6BB7E9EBC8B44F104A1EF65A87390D775A840CBA6

Function 00471710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00471769
SendMessageA.USER32(?,00001007,00000000,0000001F), ref: 004717EF

Strings

4=Q, xrefs: 00471776

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend
String ID: 4=Q
API String ID: 3850602802-2863119746
Opcode ID: 978919987b221f7cd9165ce4159f062bf6820f68401806f6d3d8d91e0bc29a3e
Instruction ID: 4bd2ccdabd76339a407b3c5e0ec50a61175d5eb53773b505f92b62f5f420513a
Opcode Fuzzy Hash: 978919987b221f7cd9165ce4159f062bf6820f68401806f6d3d8d91e0bc29a3e
Instruction Fuzzy Hash: D2317A703057018FD328CF2AC980B57B3E9AF88704F00892EE599D7790E778F8058B5A

Function 0041E360 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 004BBD89: GetClipBox.GDI32(?,?), ref: 004BBD90

IsRectEmpty.USER32(?), ref: 0041E3BA

Part of subcall function 004BC3D5: __EH_prolog.LIBCMT ref: 004BC3DA
Part of subcall function 004BC3D5: CreateSolidBrush.GDI32(?), ref: 004BC3F7

FillRect.USER32(?,?,00000000), ref: 0041E3E7

Strings

!K, xrefs: 0041E3ED

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: H_prologRect$BeginBrushClipCreateEmptyFillPaintSolid
String ID: !K
API String ID: 3827101677-3405271303
Opcode ID: 6bf64853c19500f915336bd556246aa986dbfb7c4853aa062142c5ba4a7b45a9
Instruction ID: 094f5b8802c280430d10874cc996d7a39e695f61d4be9431ce8e88cdabccee5a
Opcode Fuzzy Hash: 6bf64853c19500f915336bd556246aa986dbfb7c4853aa062142c5ba4a7b45a9
Instruction Fuzzy Hash: C331B0351087409FD314EB25C885FABB7E8BF88704F50891EF9A583291DB7CD909CB66

Function 0042CCB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(?,00000408), ref: 0042CD23
LoadCursorA.USER32(00000000,00000002), ref: 0042CD52

Strings

`WN, xrefs: 0042CD38

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CursorLoad
String ID: `WN
API String ID: 3238433803-3540563254
Opcode ID: fcadf86ec453d631e53eb5e856b93ea1bbbfe17f55aacd36c08c9142cb725ab9
Instruction ID: be01c11ae982f37eccc216bca7d986e9c756889b26d90936dbaca1658c825f0c
Opcode Fuzzy Hash: fcadf86ec453d631e53eb5e856b93ea1bbbfe17f55aacd36c08c9142cb725ab9
Instruction Fuzzy Hash: EC116A3BF1063087CA30662EBCC059F5B15EBD5376B95093BEA19DB341D328EC0182A9

Function 00414140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 004BBD89: GetClipBox.GDI32(?,?), ref: 004BBD90

IsRectEmpty.USER32(?), ref: 004141A4

Part of subcall function 00411510: GetSysColor.USER32(0000000F), ref: 0041151D

Part of subcall function 004BC3D5: __EH_prolog.LIBCMT ref: 004BC3DA
Part of subcall function 004BC3D5: CreateSolidBrush.GDI32(?), ref: 004BC3F7

FillRect.USER32(?,?,00000000), ref: 004141D6

Strings

!K, xrefs: 004141DC

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: H_prologRect$BeginBrushClipColorCreateEmptyFillPaintSolid
String ID: !K
API String ID: 534515830-3405271303
Opcode ID: f8a5f14fc883e57c435fdb8d6d21aed98cb2b85539edfb210743b23830a2c6c6
Instruction ID: c50bb90846091720d8996782c007d2dbfc8f25144d0a63d239ec7b23fdfd8c11
Opcode Fuzzy Hash: f8a5f14fc883e57c435fdb8d6d21aed98cb2b85539edfb210743b23830a2c6c6
Instruction Fuzzy Hash: 5D21B371604B409FD324DF64C880B9BB7E8BB88704F14491EF5A6C3290DB3CE444CB66

Function 0041DEA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 004BC1D8: __EH_prolog.LIBCMT ref: 004BC1DD
Part of subcall function 004BC1D8: BeginPaint.USER32(?,?,?,?,00414189), ref: 004BC206

Part of subcall function 004BBD89: GetClipBox.GDI32(?,?), ref: 004BBD90

IsRectEmpty.USER32(?), ref: 0041DEDD

Part of subcall function 00411510: GetSysColor.USER32(0000000F), ref: 0041151D

Part of subcall function 004BC3D5: __EH_prolog.LIBCMT ref: 004BC3DA
Part of subcall function 004BC3D5: CreateSolidBrush.GDI32(?), ref: 004BC3F7

FillRect.USER32(?,?,00000000), ref: 0041DF10

Strings

!K, xrefs: 0041DF16

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: H_prologRect$BeginBrushClipColorCreateEmptyFillPaintSolid
String ID: !K
API String ID: 534515830-3405271303
Opcode ID: d10cc01c4768692b84a836518711f9c0665cb5b9cb680c53eb262762e818072b
Instruction ID: d3cb11100dd0ace3d29e2fe2d7bb41c3b21d80e012725788e0a8556c92c0ac2b
Opcode Fuzzy Hash: d10cc01c4768692b84a836518711f9c0665cb5b9cb680c53eb262762e818072b
Instruction Fuzzy Hash: AC11C2B5408341AFC300EF65C885F9BBBE4BB84708F108A1DF496832A1EB38D148CB66

Function 00471900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B3F84: SendMessageA.USER32(00001111,00001111,00000000,?), ref: 004B3FA4

SendMessageA.USER32(?,0000110B,00000009,00000000), ref: 00471934
IsWindow.USER32(?), ref: 0047193B

Strings

F, xrefs: 00471920

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: MessageSend$Window
String ID: F
API String ID: 2326795674-1304234792
Opcode ID: 6c1d61ee08511c0768dc03e32f159275afde6fbab87142245f7c767d17f82972
Instruction ID: ebecfea81f93519afd0c8c5d1bcd5d918eeb730993ec61683a00531ef5efade0
Opcode Fuzzy Hash: 6c1d61ee08511c0768dc03e32f159275afde6fbab87142245f7c767d17f82972
Instruction Fuzzy Hash: E60152B1108300AFE354DF19C894F6FB7F9AFC8B04F04491DF58997290D7B4A9458B96

Function 004B7738 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004B773D

Strings

p9S, xrefs: 004B7761
09S, xrefs: 004B7769

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: H_prolog
String ID: 09S$p9S
API String ID: 3519838083-4002301087
Opcode ID: d98bfb0758bfb9605f410283387019ed834621bf77ceb8ca16275b4890d90335
Instruction ID: 9a8ebb72261e5020d102edbb96c6a16f0dcfc0d462faebb47e3f4fe7056f64e0
Opcode Fuzzy Hash: d98bfb0758bfb9605f410283387019ed834621bf77ceb8ca16275b4890d90335
Instruction Fuzzy Hash: ED018471A05210DFCB349F98C6087EAB7E0AB44711F15026FE456977E1CBBCAD40CAAA

Function 004752F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000100C,000000FF,00000001), ref: 00475316
PostMessageA.USER32(?,00000401,00000000,00000000), ref: 0047532C

Strings

, xrefs: 004752F8

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Message$PostSend
String ID:
API String ID: 2264170824-3916222277
Opcode ID: 4a2acede1f02b972368f543e31ec70e902ad57438776fc05366ae1175e35fb66
Instruction ID: ad21b36583d69675f69583d2f0b1280566a37a72f1d6c7d0311cfbbb53149bcc
Opcode Fuzzy Hash: 4a2acede1f02b972368f543e31ec70e902ad57438776fc05366ae1175e35fb66
Instruction Fuzzy Hash: 4EE04831244B11ABE6345B258C45F9F73A96B14750F00CA1EB555DA2E0C6F5E8818B68

Function 00471C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00471C43
PostMessageA.USER32(?,00000401,00000000,00000000), ref: 00471C59

Strings

, xrefs: 00471C28

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: Message$PostSend
String ID:
API String ID: 2264170824-3916222277
Opcode ID: 0f288e8033af5d4e1c764a64200bf1a8730b4349b67f7cab9f3dd8389c2c00d2
Instruction ID: 16bb4f7c4288139a0ba4627263af5aadf71ace5476c8866c28feb3ae67c3da2f
Opcode Fuzzy Hash: 0f288e8033af5d4e1c764a64200bf1a8730b4349b67f7cab9f3dd8389c2c00d2
Instruction Fuzzy Hash: E6E04831740701BFE638AB659C45F9B72AF6B14701F10C91EF246E62D1C6F4E8408768

Function 004BF0BA Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004BF117
LeaveCriticalSection.KERNEL32(?,?), ref: 004BF127
LocalFree.KERNEL32(?), ref: 004BF130
TlsSetValue.KERNEL32(?,00000000), ref: 004BF146

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 45f9777ee6324497e982a87fcc2105ef59c909e0123d7c366f91aacc3830a9de
Instruction ID: 5dca740819604beb7ecad0ec15c1b4a248cfd03b5fbb938f61ea0b3dc0288558
Opcode Fuzzy Hash: 45f9777ee6324497e982a87fcc2105ef59c909e0123d7c366f91aacc3830a9de
Instruction Fuzzy Hash: CE218931200200EFD7209F58CC84FAA77A4FF80705F10847AE9068B2A2C7B9FC84CB64

Function 004AD0CA Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,004ACE92,00000000,00000000,00000000,004A53C3,00000000,00000000,?,00000000,00000000,00000000), ref: 004AD0F2
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,004ACE92,00000000,00000000,00000000,004A53C3,00000000,00000000,?,00000000,00000000,00000000), ref: 004AD126
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 004AD140
HeapFree.KERNEL32(00000000,?), ref: 004AD157

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: ea4d9ddfcee35be3cd01ad4b5a5911cf4596073997e46267321fdb62b3cbe641
Instruction ID: ca1038dea857308b4774172b59078ba8a43023a0f47d58afa04b95413a5f021f
Opcode Fuzzy Hash: ea4d9ddfcee35be3cd01ad4b5a5911cf4596073997e46267321fdb62b3cbe641
Instruction Fuzzy Hash: 21118CB0A0460A9FC7318F18EC45D267BF1FBAA7607515A2AF562C76B0C770AC49EF14

Function 004BFE97 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00533BA0,?,00000000,?,?,004BF262,00000010,?,00000000,?,?,?,004BEC49,004BECAC,004BE528,004BEC4F), ref: 004BFED2
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,004BF262,00000010,?,00000000,?,?,?,004BEC49,004BECAC,004BE528,004BEC4F), ref: 004BFEE4
LeaveCriticalSection.KERNEL32(00533BA0,?,00000000,?,?,004BF262,00000010,?,00000000,?,?,?,004BEC49,004BECAC,004BE528,004BEC4F), ref: 004BFEED
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,004BF262,00000010,?,00000000,?,?,?,004BEC49,004BECAC,004BE528,004BEC4F,004BA417), ref: 004BFEFF

Part of subcall function 004BFE04: GetVersion.KERNEL32(?,004BFEA7,?,004BF262,00000010,?,00000000,?,?,?,004BEC49,004BECAC,004BE528,004BEC4F,004BA417,004BB6B6), ref: 004BFE17

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: ca5d864003c370cb75af0a8f81bf025ad4d8dae02377c4f0752ff9a88e41eb55
Instruction ID: cfe7a9c13677556438ff0fb35f17a9f8df4e7d92288df88243c64746bb06d7df
Opcode Fuzzy Hash: ca5d864003c370cb75af0a8f81bf025ad4d8dae02377c4f0752ff9a88e41eb55
Instruction Fuzzy Hash: 9EF03C7100120AEFD750EFA4FC949A6F3ACFB20316B000437E60592232D738F69DDAA8

Function 004AB7BB Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,004A8E4B,?,004A39E0), ref: 004AB7C8
InitializeCriticalSection.KERNEL32(?,004A8E4B,?,004A39E0), ref: 004AB7D0
InitializeCriticalSection.KERNEL32(?,004A8E4B,?,004A39E0), ref: 004AB7D8
InitializeCriticalSection.KERNEL32(?,004A8E4B,?,004A39E0), ref: 004AB7E0

Memory Dump Source

Source File: 00000000.00000002.2892997982.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2892974190.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893089437.00000000004C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893119171.00000000004E1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893140853.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893156785.00000000004E5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893177184.00000000004EE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893197707.00000000004EF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893218216.00000000004F6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.00000000004FA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000506000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000532000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893238218.0000000000537000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2893327611.000000000053A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uCLkYbZQoA.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: e58d8a4a8d46058ce0cef70d8c5028b5cce2a68f705a8dbdbd9fe4a03012bf72
Instruction ID: 632426aebf6f5e1e08d8b945314849d125fe98e4afb3530d9b0912cfaed84aa3
Opcode Fuzzy Hash: e58d8a4a8d46058ce0cef70d8c5028b5cce2a68f705a8dbdbd9fe4a03012bf72
Instruction Fuzzy Hash: 2AC002318018369ACA912B55FD058AA3F65EF0526070201F7A104590708E213C70DFDC

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uCLkYbZQoA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: uCLkYbZQoA.exePID: 7268, Parent PID: 2580

Windows Analysis Report
uCLkYbZQoA.exe

Function 00422D50 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 287
libraryloaderCOMMON

Function 00449020 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 370
commemorythreadCOMMON

Function 0040F400 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158
comregistryCOMMON

Function 0047A520 Relevance: 93.4, APIs: 52, Strings: 1, Instructions: 621
windowCOMMON

Function 004790C0 Relevance: 65.0, APIs: 43, Instructions: 488
windowCOMMON

Function 004797D0 Relevance: 40.8, APIs: 27, Instructions: 303
windowCOMMON

Function 004B7382 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 170
stringCOMMON

Function 004B8FAE Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 174
windowCOMMON

Function 00412260 Relevance: 19.9, APIs: 13, Instructions: 372
COMMON

Function 00473BD0 Relevance: 19.9, APIs: 13, Instructions: 371
windowCOMMON

Function 00477A80 Relevance: 19.7, APIs: 13, Instructions: 230
COMMON

Function 00477520 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 182
stringCOMMON

Function 004BEE45 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99
memoryCOMMON

Function 004B71A7 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99
COMMON

Function 00411DA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 267
windowCOMMON