Edit tour

Windows Analysis Report
Convert.exe

Overview

General Information

Sample name:	Convert.exe
Analysis ID:	1558891
MD5:	e14d3585a6b4feb3897d76d42c6b8d83
SHA1:	6d78a56a86327839f683f7fbf28c579896e5b05a
SHA256:	608c1b94fb38dc8c67287f4fb8523ecf99c205422b5c439cdbc61385dc1f7835
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Potential key logger detected (key state polling based)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Convert.exe (PID: 5920 cmdline: "C:\Users\user\Desktop\Convert.exe" MD5: E14D3585A6B4FEB3897D76D42C6B8D83)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Convert.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Convert.exe

String found in binary or memory: http://www.joshmadison.com/software

Source: C:\Users\user\Desktop\Convert.exe

Code function: 0_2_004597D5 GetAsyncKeyState,SendMessageA,

0_2_004597D5

Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_004560CD GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,		0_2_004560CD
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_00452C1A GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_00452C1A

Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_00455429	0_2_00455429
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_00451470	0_2_00451470
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_0044A620	0_2_0044A620
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_0044BE7C	0_2_0044BE7C

Source: C:\Users\user\Desktop\Convert.exe	Code function: String function: 004469E0 appears 76 times
Source: C:\Users\user\Desktop\Convert.exe	Code function: String function: 004428C0 appears 2745 times
Source: C:\Users\user\Desktop\Convert.exe	Code function: String function: 00453EEE appears 34 times
Source: C:\Users\user\Desktop\Convert.exe	Code function: String function: 00453DF5 appears 127 times
Source: C:\Users\user\Desktop\Convert.exe	Code function: String function: 00442D50 appears 350 times

Source: Convert.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean4.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Convert.exe

Code function: 0_2_0045377E __EH_prolog,FindResourceA,LoadResource,LockResource,IsWindowEnabled,EnableWindow,EnableWindow,GetActiveWindow,SetActiveWindow,

0_2_0045377E

Source: Convert.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Convert.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Convert.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Convert.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Convert.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: Convert.exe	Static PE information: section name: RT_CURSOR
Source: Convert.exe	Static PE information: section name: RT_BITMAP
Source: Convert.exe	Static PE information: section name: RT_ICON
Source: Convert.exe	Static PE information: section name: RT_MENU
Source: Convert.exe	Static PE information: section name: RT_DIALOG
Source: Convert.exe	Static PE information: section name: RT_STRING
Source: Convert.exe	Static PE information: section name: RT_ACCELERATOR
Source: Convert.exe	Static PE information: section name: RT_GROUP_ICON

Source: C:\Users\user\Desktop\Convert.exe

Code function: 0_2_0044C828 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0044C828

Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_004469E0 push eax; ret	0_2_004469FE
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_004359AD push es; iretd	0_2_004359B7
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_00446CB0 push eax; ret	0_2_00446CDE

Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_0044F3D0 GetPropA,CallWindowProcA,CallWindowProcA,IsIconic,CallWindowProcA,GetWindowLongA,SendMessageA,CallWindowProcA,CallWindowProcA,GetWindowLongA,GetClassNameA,lstrcmpA,CallWindowProcA,GetWindowLongA,CallWindowProcA,CallWindowProcA,CallWindowProcA,	0_2_0044F3D0
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_00445986 IsIconic,GetWindowPlacement,GetWindowRect,	0_2_00445986
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_00442A90 IsIconic,	0_2_00442A90
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_0044EC20 CallWindowProcA,DefWindowProcA,IsIconic,SendMessageA,GetWindowLongA,GetWindowLongA,GetWindowDC,GetWindowRect,InflateRect,InflateRect,SelectObject,OffsetRect,SelectObject,ReleaseDC,	0_2_0044EC20

Source: C:\Users\user\Desktop\Convert.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\Convert.exe

API coverage: 8.5 %

Source: C:\Users\user\Desktop\Convert.exe

Code function: 0_2_0044C828 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0044C828

Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_0044B865 SetUnhandledExceptionFilter,		0_2_0044B865
Source: C:\Users\user\Desktop\Convert.exe	Code function: 0_2_0044B877 SetUnhandledExceptionFilter,		0_2_0044B877

Source: C:\Users\user\Desktop\Convert.exe

Code function: 0_2_00455429 __EH_prolog,GetVersion,

0_2_00455429

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Application Window Discovery	Remote Services	21 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Convert.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.joshmadison.com/software	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.joshmadison.com/software	Convert.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558891
Start date and time:	2024-11-19 22:42:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Convert.exe
Detection:	CLEAN
Classification:	clean4.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 36 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: Convert.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.033949882605988
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Convert.exe
File size:	561'152 bytes
MD5:	e14d3585a6b4feb3897d76d42c6b8d83
SHA1:	6d78a56a86327839f683f7fbf28c579896e5b05a
SHA256:	608c1b94fb38dc8c67287f4fb8523ecf99c205422b5c439cdbc61385dc1f7835
SHA512:	076b9902adbac2a01a42f5a604eb64dcef661bafc119d03515893863ce99d429b69bdfa13579c3c8cafa489241d6b07f197f7de243f8e72e29f6112d49fdc7b2
SSDEEP:	6144:y/APOLEh6jVvtJa2N3RxQbJ94pzLNWX5VeoKpve1:1QJTxm+9NWX5VA
TLSH:	8DC4F113405E09D8DCC06C3B7F68C24A9A50ABF237900E6397DCBE6A175B54177ACAB7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:\|..T/..T/..T/..T/..T/..G/..T/..U/?.T/C._/..T/(.Z/..T/C.^/..T/T._/..T/l.R/..T/Rich..T/........................PE..L...h..8...

File Icon


Icon Hash:	07032307181b1a18

Static PE Info

General

Entrypoint:	0x446848
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x381BAF68 [Sun Oct 31 02:54:32 1999 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b8479b613de20959882f4cacef53e330

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00466F58h
push 00449208h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0045F1D4h]
xor edx, edx
mov dl, ah
mov dword ptr [00485294h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [00485290h], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [0048528Ch], ecx
shr eax, 10h
mov dword ptr [00485288h], eax
push 00000001h
call 00007FED78C2565Fh
pop ecx
test eax, eax
jne 00007FED78C2239Ah
push 0000001Ch
call 00007FED78C22458h
pop ecx
call 00007FED78C246B9h
test eax, eax
jne 00007FED78C2239Ah
push 00000010h
call 00007FED78C22447h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007FED78C2547Bh
call dword ptr [0045F140h]
mov dword ptr [004869B8h], eax
call 00007FED78C25339h
mov dword ptr [00485278h], eax
call 00007FED78C250E2h
call 00007FED78C25024h
call 00007FED78C224CDh
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [0045F144h]
call 00007FED78C24FB5h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007FED78C22398h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[C++] VS98 (6.0) build 8168
[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a448	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x41d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5f000	0x444	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5d1e6	0x5e000	dfdd185f413d1acb1a0b75c18262b6bd	False	0.30044880319148937	data	5.927869322301452	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5f000	0xcafa	0xd000	13cc6380a2ebaf739b1de0706208c2a7	False	0.5330341045673077	data	6.0482662906911555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6c000	0x1b4e8	0x18000	7f0397b04e3ca0fdebbbf7a099e314a5	False	0.07505289713541667	data	4.533934654618574	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x88000	0x41d8	0x5000	919b14682648b411e6875fc21d2bc714	False	0.244921875	data	3.2354218330227975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x89ec0	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.37987012987012986
RT_CURSOR	0x8a018	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4805194805194805
RT_CURSOR	0x8a150	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	English	United States	0.7
RT_BITMAP	0x8a230	0x5e4	Device independent bitmap graphic, 70 x 39 x 4, image size 1404	English	United States	0.34615384615384615
RT_BITMAP	0x8a900	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	English	United States	0.44565217391304346
RT_BITMAP	0x8a9b8	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	English	United States	0.28296703296703296
RT_BITMAP	0x8ab28	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	English	United States	0.37962962962962965
RT_ICON	0x887c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23118279569892472
RT_ICON	0x88aa8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.42905405405405406
RT_ICON	0x88bf8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23521505376344087
RT_ICON	0x88ee0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.4155405405405405
RT_MENU	0x89dd0	0xea	data	English	United States	0.6538461538461539
RT_DIALOG	0x89030	0x1fe	data	English	United States	0.5372549019607843
RT_DIALOG	0x89878	0x146	data	English	United States	0.6134969325153374
RT_DIALOG	0x89230	0x27c	data	English	United States	0.5267295597484277
RT_DIALOG	0x894b0	0x1d0	data	English	United States	0.5905172413793104
RT_DIALOG	0x89680	0x1f2	data	English	United States	0.5281124497991968
RT_DIALOG	0x899c0	0x78	data	English	United States	0.7833333333333333
RT_DIALOG	0x8a818	0xe8	data	English	United States	0.6336206896551724
RT_STRING	0x8ac70	0x82	StarOffice Gallery theme p, 536899072 objects, 1st n	English	United States	0.7153846153846154
RT_STRING	0x8acf8	0x2a	data	English	United States	0.5476190476190477
RT_STRING	0x8ad28	0x14a	data	English	United States	0.5060606060606061
RT_STRING	0x8ae78	0x4e2	data	English	United States	0.376
RT_STRING	0x8b6f0	0x2a2	data	English	United States	0.28338278931750743
RT_STRING	0x8b410	0x2dc	data	English	United States	0.36885245901639346
RT_STRING	0x8b360	0xac	data	English	United States	0.45348837209302323
RT_STRING	0x8c0c8	0xde	data	English	United States	0.536036036036036
RT_STRING	0x8b998	0x4c4	data	English	United States	0.3221311475409836
RT_STRING	0x8be60	0x264	data	English	United States	0.3741830065359477
RT_STRING	0x8c1a8	0x2c	data	English	United States	0.5227272727272727
RT_ACCELERATOR	0x8a010	0x8	data	English	United States	2.0
RT_GROUP_CURSOR	0x89ff8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x8a208	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States	1.0294117647058822
RT_GROUP_ICON	0x88bd0	0x22	data	English	United States	1.0
RT_GROUP_ICON	0x89008	0x22	data	English	United States	1.0294117647058822
RT_VERSION	0x89a38	0x398	OpenPGP Public Key	English	United States	0.46956521739130436

Imports

DLL	Import
KERNEL32.dll	HeapSize, GetACP, HeapReAlloc, HeapAlloc, RaiseException, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetStdHandle, GetFileType, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, GetEnvironmentStrings, LCMapStringW, HeapFree, SetHandleCount, GetEnvironmentStringsW, TerminateProcess, IsBadCodePtr, SetStdHandle, FindResourceA, LoadResource, WritePrivateProfileStringA, GetPrivateProfileStringA, GetPrivateProfileIntA, ExitProcess, GetCommandLineA, GetStartupInfoA, RtlUnwind, FlushFileBuffers, SetFilePointer, WriteFile, GetCurrentProcess, SetErrorMode, GetOEMCP, GetCPInfo, SizeofResource, GetProcessVersion, GetLastError, GlobalFlags, lstrcpynA, TlsGetValue, LocalReAlloc, TlsSetValue, EnterCriticalSection, GlobalReAlloc, LeaveCriticalSection, TlsFree, TlsAlloc, GetStringTypeA, GlobalHandle, DeleteCriticalSection, GetStringTypeW, SetUnhandledExceptionFilter, CloseHandle, InitializeCriticalSection, lstrcpyA, LocalAlloc, LoadLibraryA, MulDiv, SetLastError, GlobalGetAtomNameA, FreeLibrary, GetVersion, GetModuleHandleA, GlobalAddAtomA, GlobalFindAtomA, LocalFree, GetProcAddress, InterlockedDecrement, MultiByteToWideChar, WideCharToMultiByte, GlobalFree, InterlockedIncrement, GlobalUnlock, LockResource, IsBadReadPtr, LCMapStringA, GetModuleFileNameA, GetCurrentThread, WinExec, lstrlenA, lstrcatA, GetCurrentThreadId, GetProfileStringA, lstrcmpiA, lstrcmpA, GlobalDeleteAtom, GlobalAlloc, GlobalLock
USER32.dll	SetDlgItemTextA, IsDialogMessageA, SetWindowTextA, MoveWindow, ShowWindow, wvsprintfA, ClientToScreen, GetWindowDC, BeginPaint, EndPaint, TabbedTextOutA, DrawTextA, GrayStringA, GetAsyncKeyState, MapDialogRect, DestroyMenu, WindowFromPoint, DrawFocusRect, FillRect, PtInRect, GetClassNameA, GetSysColorBrush, LoadStringA, GetTopWindow, GetCapture, WinHelpA, GetClassInfoA, RegisterClassA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetWindowTextLengthA, GetWindowTextA, SendDlgItemMessageA, DefWindowProcA, CreateWindowExA, GetClassLongA, UpdateWindow, RemovePropA, GetMessageTime, GetForegroundWindow, SetForegroundWindow, GetWindow, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, CopyRect, EndDialog, SetActiveWindow, IsWindow, CreateDialogIndirectParamA, DestroyWindow, GetDlgItem, wsprintfA, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, GetFocus, GetNextDlgTabItem, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, GetKeyState, CallNextHookEx, ValidateRect, IsWindowVisible, PeekMessageA, GetCursorPos, SetWindowsHookExA, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, MessageBoxA, PostQuitMessage, PostMessageA, GetParent, ReleaseDC, GetDC, InflateRect, MessageBeep, SetWindowLongA, SetCursor, LoadIconA, LoadCursorA, EnableWindow, InvalidateRect, SetFocus, GetClientRect, GetWindowRect, IsIconic, AdjustWindowRectEx, ScreenToClient, MapWindowPoints, GetSysColor, UnhookWindowsHookEx, GetPropA, GetDlgCtrlID, SetPropA, GetSystemMenu, SendMessageA, EnableMenuItem, DeleteMenu, DrawIcon, GetSystemMetrics, GetMessagePos, RegisterWindowMessageA, SetWindowPos, CallWindowProcA, DefDlgProcA, ExcludeUpdateRgn, HideCaret, IsWindowUnicode, CharNextA, ShowCaret, UnregisterClassA
GDI32.dll	GetStockObject, GetTextExtentPoint32A, CreateBitmap, GetObjectA, PatBlt, SetTextColor, SetBkColor, GetClipBox, SaveDC, DeleteDC, SelectObject, RestoreDC, SetBkMode, SetMapMode, SetViewportOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, IntersectClipRect, DeleteObject, GetDeviceCaps, CreateSolidBrush, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, BitBlt, CreateCompatibleDC, GetTextMetricsA, CreateDIBitmap, OffsetViewportOrgEx, SetViewportExtEx, SetWindowExtEx, GetTextExtentPointA, CreateFontIndirectA
WINSPOOL.DRV	DocumentPropertiesA, ClosePrinter, OpenPrinterA
ADVAPI32.dll	RegSetValueExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegQueryValueExA, RegCreateKeyExA, RegOpenKeyExA, RegQueryValueA
SHELL32.dll	ShellExecuteA
COMCTL32.dll	DestroyPropertySheetPage, PropertySheetA, CreatePropertySheetPageA, ImageList_Destroy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	16:43:25
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\Convert.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Convert.exe"
Imagebase:	0x400000
File size:	561'152 bytes
MD5 hash:	E14D3585A6B4FEB3897D76D42C6B8D83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	58

Executed Functions

Function 0045377E Relevance: 13.6, APIs: 9, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00453783
FindResourceA.KERNEL32(?,00000000,00000005), ref: 004537BB
LoadResource.KERNEL32(?,00000000,?,?,?,00000007,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 004537C3

Part of subcall function 00454B50: UnhookWindowsHookEx.USER32(?), ref: 00454B75

LockResource.KERNEL32(?,?,?,?,00000007,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 004537D0
IsWindowEnabled.USER32(00000000), ref: 00453803
EnableWindow.USER32(00000000,00000000), ref: 00453811
EnableWindow.USER32(00000000,00000001), ref: 0045389F
GetActiveWindow.USER32 ref: 004538AA
SetActiveWindow.USER32(00000000,?,?,?,?,00000007,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 004538B8

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$Resource$ActiveEnable$EnabledFindH_prologHookLoadLockUnhookWindows
String ID:
API String ID: 401145483-0
Opcode ID: da0154b7b507c22309a0e933e74a2908b68f94bed98c4217167b8df5d42b6508
Instruction ID: 98b93588d90e1e639b6a9742903b1d970df520c87f22e19d718b66114bf5fbd9
Opcode Fuzzy Hash: da0154b7b507c22309a0e933e74a2908b68f94bed98c4217167b8df5d42b6508
Instruction Fuzzy Hash: 5A41D271900704DFDB21AF65C84966EB7F5AF44757F10012FF902A2293C7799E488B6A

Function 00455429 Relevance: 3.4, APIs: 2, Instructions: 422COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0045542E
GetVersion.KERNEL32(00000007,?,?,00000000,00000000,?,0000C000,00000000,00000000,00000007), ref: 004555E1

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: H_prologVersion
String ID:
API String ID: 1836448879-0
Opcode ID: f5a1ea65f5b732627b2b53c13a19c61731209395b38841e45dc6b831e2805def
Instruction ID: d0705d98a940ea30a19c661afe863039a069756a253712f0fe6c95cf36b42a14
Opcode Fuzzy Hash: f5a1ea65f5b732627b2b53c13a19c61731209395b38841e45dc6b831e2805def
Instruction Fuzzy Hash: E5E18D70500609EFDB04EF55C8A0BBE37A9EF04316F10851AFC169A293D73CDA1ADB69

Function 0045490E Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 170
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0045C5E4: TlsGetValue.KERNEL32(00484E6C,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4,?,00000000,?,0045161C,00000000,00000000,00000000,00000000), ref: 0045C623

CallNextHookEx.USER32(?,00000003,?,?), ref: 00454938
GetClassLongA.USER32(?,000000E6), ref: 0045497F
GlobalGetAtomNameA.KERNEL32(?,?,00000005,?,?,?,Function_0005B3E3), ref: 004549AB
lstrcmpiA.KERNEL32(?,ime), ref: 004549BA
GetWindowLongA.USER32(?,000000FC), ref: 00454A2D
SetWindowLongA.USER32(?,000000FC,00000000), ref: 00454A4E

Strings

AfxOldWndProc423, xrefs: 00454A8F, 00454A94, 00454A9F, 00454AA7, 00454AB0
ime, xrefs: 004549B4
,NH, xrefs: 00454919

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Long$Window$AtomCallClassGlobalHookNameNextValuelstrcmpi
String ID: ,NH$AfxOldWndProc423$ime
API String ID: 3731301195-4050890372
Opcode ID: bb06be974000b555a9968e69b9b8a62ae5865538f0e9669415c8f0eb0cc1c02a
Instruction ID: 294483681e820a23548d41c0ad6a0cd06ca66f4dfaeac4df0ff63b736be1a18d
Opcode Fuzzy Hash: bb06be974000b555a9968e69b9b8a62ae5865538f0e9669415c8f0eb0cc1c02a
Instruction Fuzzy Hash: 6C51AD71500214ABCB119F64DC48B6F3BA8FF8436AF10452AFD15AB292D738DD88CB9D

Function 0045C27D Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00484E88,00484E2C,00000000,?,00484E6C,00484E6C,0045C618,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4,?,00000000), ref: 0045C28C
GlobalAlloc.KERNELBASE(00002002,00000000,?,?,00484E6C,00484E6C,0045C618,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4,?,00000000), ref: 0045C2E1
GlobalHandle.KERNEL32(004F2990), ref: 0045C2EA
GlobalUnlock.KERNEL32(00000000), ref: 0045C2F3
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 0045C305
GlobalHandle.KERNEL32(004F2990), ref: 0045C31C
GlobalLock.KERNEL32(00000000), ref: 0045C323
LeaveCriticalSection.KERNEL32((iD,?,?,00484E6C,00484E6C,0045C618,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4,?,00000000), ref: 0045C329
GlobalLock.KERNEL32(00000000), ref: 0045C338
LeaveCriticalSection.KERNEL32(?), ref: 0045C381

Strings

(iD, xrefs: 0045C325

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID: (iD
API String ID: 2667261700-210869037
Opcode ID: 6216e95ebef3376faa826885c5afe3325a3459ff50a032fe908c9552e028735b
Instruction ID: 7d93b703dbcdf73a29f2a2c4c93ed2fa9e318b32972637177b23b21e5689aa5f
Opcode Fuzzy Hash: 6216e95ebef3376faa826885c5afe3325a3459ff50a032fe908c9552e028735b
Instruction Fuzzy Hash: A031A3B56007099FD7209F64DC89A2AB7E9FB44306F00493EF852C3662E775EC08CB15

Function 0045349A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0045349F
GetSystemMetrics.USER32(0000002A), ref: 00453550
GlobalLock.KERNEL32(00000000), ref: 004535DA
CreateDialogIndirectParamA.USER32(00000000,?,00000000,004532C0,00000000), ref: 0045360C

Strings

MS Shell Dlg, xrefs: 0045355E
Helv, xrefs: 00453584
MS Sans Serif, xrefs: 00453571

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CreateDialogGlobalH_prologIndirectLockMetricsParamSystem
String ID: Helv$MS Sans Serif$MS Shell Dlg
API String ID: 2364537584-2894235370
Opcode ID: 913fe67b96116e3149be5664a3a314f63f108ee41f8c32bbe04b137aaa7ad3c8
Instruction ID: 1c3becc7b9c527fe7ec71491e23523a39e55326b433cbffe80bc38fb2558441e
Opcode Fuzzy Hash: 913fe67b96116e3149be5664a3a314f63f108ee41f8c32bbe04b137aaa7ad3c8
Instruction Fuzzy Hash: 0661407190020AEFCF11EFA4D9859AEBBB1BF04346F10447FF905A6252D7388B49DB59

Function 00454733 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00454738
GetPropA.USER32(?,AfxOldWndProc423), ref: 00454750
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 004547AE

Part of subcall function 00454341: GetWindowRect.USER32(?,9EE), ref: 00454366
Part of subcall function 00454341: GetWindow.USER32(?,00000004), ref: 00454383

SetWindowLongA.USER32(?,000000FC,?), ref: 004547DE
RemovePropA.USER32(?,AfxOldWndProc423), ref: 004547E6
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 004547ED
GlobalDeleteAtom.KERNEL32(00000000), ref: 004547F4

Part of subcall function 0045431E: GetWindowRect.USER32(?,75A2FA40), ref: 0045432A

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 00454848

Strings

AfxOldWndProc423, xrefs: 00454746, 0045474E, 004547E4, 004547EC

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prologLongRemove
String ID: AfxOldWndProc423
API String ID: 2397448395-1060338832
Opcode ID: 28a8a9f3c3169b00de703e8599db74a22ed2976df0b4a337f4da5975e223bc32
Instruction ID: ec6644ab14724eef9f371e594410334e9bf45840f7ea4456a8d4dd96faea53f4
Opcode Fuzzy Hash: 28a8a9f3c3169b00de703e8599db74a22ed2976df0b4a337f4da5975e223bc32
Instruction Fuzzy Hash: C731A672800119BBCB01AFA5DD49EFF7B78FF4531AF00012AFE11A6152C7398958DB69

Function 00401FA5 Relevance: 12.1, APIs: 8, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00401FDC
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00401FEE
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00402000
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00402012
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00402024
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00402036
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00402048

Part of subcall function 00444870: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 0044487A

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 0040205A

Part of subcall function 00453EEE: lstrlenA.KERNEL32(?,?,?,0040218C,0048323C,-00000309,00000010,00000016,00401D80,00401DA0,-000002B9,00000004,00000014,Function_00001DF0,00453DF5,-00000269), ref: 00453EFF

Part of subcall function 00442F20: LoadIconA.USER32(00000000,004010AC), ref: 00442F36

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::$IconLoadlstrlen
String ID:
API String ID: 1758334495-0
Opcode ID: 07a8150609c8a2098f8dac22d0bdaa32cbd043d7c5fe77f76b51809630121fb7
Instruction ID: 9b413a1501943506eb4122cafa848c137ca9335ad7291723035c35a5e3d77b8e
Opcode Fuzzy Hash: 07a8150609c8a2098f8dac22d0bdaa32cbd043d7c5fe77f76b51809630121fb7
Instruction Fuzzy Hash: 1D518CB0A00249ABEB04EB98CD56BBEB771AF41309F14446DF5113B3C3CABD1A04DB69

Function 004566D9 Relevance: 10.6, APIs: 7, Instructions: 122
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetParent.USER32(00000000), ref: 0045670D
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00456736
UpdateWindow.USER32(00000000), ref: 00456752
SendMessageA.USER32(?,00000121,00000000,00000000), ref: 00456778
SendMessageA.USER32(00000000,0000036A,00000000,00000001), ref: 00456797
UpdateWindow.USER32(00000000), ref: 004567DA
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0045680D

Part of subcall function 00456D14: GetWindowLongA.USER32(00000000,000000F0), ref: 00456D20

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 8cdbcb6c4ca0c15e69e2745b258aa189284fe3fbe3b00540e88a65d96dfde682
Instruction ID: 44d22e18cf09cb2940c106192260cf572e0db62c290683bdd539b4d06806b1ae
Opcode Fuzzy Hash: 8cdbcb6c4ca0c15e69e2745b258aa189284fe3fbe3b00540e88a65d96dfde682
Instruction Fuzzy Hash: 7F4181306047419BD720AF268844A1BBAE4EFC5B5AF510A2EF85193253C779C84DCB9A

Function 0045B592 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,software,00000000,0002001F,00000000,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045B5C0
RegCreateKeyExA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison), ref: 0045B5E3
RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,0002001F,00000000,00000001,?,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison), ref: 0045B602
RegCloseKey.KERNELBASE(00000000,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045B612
RegCloseKey.ADVAPI32(?,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045B61C

Strings

software, xrefs: 0045B5AA

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: 8d4a95f6f07120ccfff84b860b8167118dbdd40b32547129c2c50c087fd93e60
Instruction ID: c61b4888db3ac8ff22d5cae91a86fce0ffa3fcf33db2878c6dc89867e9ab0747
Opcode Fuzzy Hash: 8d4a95f6f07120ccfff84b860b8167118dbdd40b32547129c2c50c087fd93e60
Instruction Fuzzy Hash: 9C11FB71900118FBCB21DB96DC84DEFFFBCEF85705F1440AAA504E2122D7709A04DBA5

Function 0045878C Relevance: 9.1, APIs: 6, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 004587B0
RegDeleteValueA.ADVAPI32(00000000,00000000,00000000,?,?,?,00401B79), ref: 004587D0
RegCloseKey.ADVAPI32(00000000,?,?,?,00401B79), ref: 00458802

Part of subcall function 0045B592: RegOpenKeyExA.KERNELBASE(80000001,software,00000000,0002001F,00000000,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045B5C0
Part of subcall function 0045B592: RegCreateKeyExA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison), ref: 0045B5E3
Part of subcall function 0045B592: RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,0002001F,00000000,00000001,?,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison), ref: 0045B602
Part of subcall function 0045B592: RegCloseKey.KERNELBASE(00000000,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045B612
Part of subcall function 0045B592: RegCloseKey.ADVAPI32(?,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045B61C

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,?), ref: 00458820

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Close$CreateDelete$OpenPrivateProfileStringValueWrite
String ID:
API String ID: 1886894508-0
Opcode ID: a9ee082286e0a3799e0f3d88705a2c50289139cfb249c0175c0e361eca5cccb1
Instruction ID: 6f3aeeb034ee4d5f55a730465e542814c4f863050b0a21a35300922f557e6870
Opcode Fuzzy Hash: a9ee082286e0a3799e0f3d88705a2c50289139cfb249c0175c0e361eca5cccb1
Instruction Fuzzy Hash: 01118236401615FBCB222F60DC04BAE3AA5EF08757F14443AFD15A5153DF39C8199B9A

Function 0045718F Relevance: 9.0, APIs: 6, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 0045719C
GetSystemMetrics.USER32(0000000C), ref: 004571A3
GetDC.USER32(00000000), ref: 004571BC
GetDeviceCaps.GDI32(00000000,00000058), ref: 004571CD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004571D5
ReleaseDC.USER32(00000000,00000000), ref: 004571DD

Part of subcall function 0045C8F9: GetSystemMetrics.USER32(00000002), ref: 0045C90B
Part of subcall function 0045C8F9: GetSystemMetrics.USER32(00000003), ref: 0045C915

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
String ID:
API String ID: 1031845853-0
Opcode ID: 32c645c64c0c88e21e1e6760fad600102734d806a6787bcc403c20c96d65a2b9
Instruction ID: f34d25d9a2cdcd1207266ea491497547b6c9698f3f97edf1555c46dd97d9979d
Opcode Fuzzy Hash: 32c645c64c0c88e21e1e6760fad600102734d806a6787bcc403c20c96d65a2b9
Instruction Fuzzy Hash: 03F0B4306407009EF3206F729C89F2777A4EB84B57F00443EEA05876D2DAB4D8098FA6

Function 0045B6D8 Relevance: 7.6, APIs: 5, Instructions: 89
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0045B6DD
RegQueryValueExA.KERNELBASE(00000000,?,00000000,?,00000000,00000000,?,?,?,?,0040174E,?,Tab,00000000,00000000,?), ref: 0045B734
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,00000000,00000000,?,?,?,?,0040174E,?,Tab,00000000,00000000), ref: 0045B757
RegCloseKey.ADVAPI32(?,?,?,?,?,0040174E,?,Tab,00000000,00000000,?,00000001,Joshua F. Madison,00000000), ref: 0045B768
GetPrivateProfileStringA.KERNEL32(?,?,?,?,00001000,?), ref: 0045B7C2

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: QueryValue$CloseH_prologPrivateProfileString
String ID:
API String ID: 1022837590-0
Opcode ID: e46ed812ebcd0eed735108aee520f9476822b1447999bf2f3e489e395b036338
Instruction ID: 44907345674a0b299d63f074b4e65c43dffae4fc687dd9db5401260e06cabd85
Opcode Fuzzy Hash: e46ed812ebcd0eed735108aee520f9476822b1447999bf2f3e489e395b036338
Instruction Fuzzy Hash: 37319C71800109EBCF11DF91CC80CEE7B79FF88356F10812BF925A61A2D7749A59DBA9

Function 0045286D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00452880
SetWindowsHookExA.USER32(000000FF,00452BC2,00000000,00000000), ref: 00452890

Part of subcall function 0045C679: __EH_prolog.LIBCMT ref: 0045C67E

Strings

<RH, xrefs: 004528C0
@RH, xrefs: 0045289B

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID: <RH$@RH
API String ID: 2183259885-1948969457
Opcode ID: b7ec6b67002c0b47ce432b1014fc6059fe3398819f5500cdb96c8e4f9cc51f81
Instruction ID: d396268bd43029e223e293a62ef1f7d3ae03ae05cb571d909f69779fdf1fafba
Opcode Fuzzy Hash: b7ec6b67002c0b47ce432b1014fc6059fe3398819f5500cdb96c8e4f9cc51f81
Instruction Fuzzy Hash: AEF03731500710ABD7213FF1AD0DB1A7690DB05717F154AAFBD11AA1E3CB6C994C87AE

Function 0045C8D9 Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,?,?,0045C8D4), ref: 0045C950
GetProcessVersion.KERNELBASE(00000000,?,?,?,0045C8D4), ref: 0045C98D
LoadCursorA.USER32(00000000,00007F02), ref: 0045C9BB
LoadCursorA.USER32(00000000,00007F00), ref: 0045C9C6

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CursorLoadVersion$Process
String ID:
API String ID: 2246821583-0
Opcode ID: 94006e822738d8c0a952cc8d934e155c2ccaf511e89c357d3735fb82595d9940
Instruction ID: b48a6198f670fa47b188dfd69dbe823e9e9df5bc31cccfa3c1255626830e9c38
Opcode Fuzzy Hash: 94006e822738d8c0a952cc8d934e155c2ccaf511e89c357d3735fb82595d9940
Instruction Fuzzy Hash: 3E118CF1A00B508FD7249F3A988462ABBE5FB487067104D3FE18BC6B41D778E404CB54

Function 00458717 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(00000000,00000001,00000000,00000004,?,00000004,?,?,?,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 00458743
RegCloseKey.ADVAPI32(00000000,?,?,?,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045874C
wsprintfA.USER32 ref: 00458768
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00458781

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: b0650ab33bc79c6ef82f6a395923a50982506ce8dc2cd5190562353ec579e4d7
Instruction ID: dd32868c1ef65f31341a1bb3fc5d1545e0b16f7868a12cc30990e89297f8f6ce
Opcode Fuzzy Hash: b0650ab33bc79c6ef82f6a395923a50982506ce8dc2cd5190562353ec579e4d7
Instruction Fuzzy Hash: 3F01A232400619BBCB116F64DC05FAF3BA8FF08715F08443ABE11A6092EB74C9148B99

Function 0045CC0E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000000,00000000,00457913,00000000,00000000,00000000,00000000,?,00000000,?,0045161C,00000000,00000000,00000000,00000000,00446928), ref: 0045CC17
SetErrorMode.KERNELBASE(00000000,?,00000000,?,0045161C,00000000,00000000,00000000,00000000,00446928,00000000), ref: 0045CC1E

Part of subcall function 0045CC71: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0045CCA2
Part of subcall function 0045CC71: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0045CD43
Part of subcall function 0045CC71: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0045CD70

Strings

(iD, xrefs: 0045CC4C

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID: (iD
API String ID: 3389432936-210869037
Opcode ID: 4bc241f6ea99acc8e59851c3f0e31b09fcb7c30ff2c9a258b904a8c1d00a0c27
Instruction ID: a53af810a2dbace94bb21e2f8d3ce39be7d8af20c2c112e3bc959ff89a48d23e
Opcode Fuzzy Hash: 4bc241f6ea99acc8e59851c3f0e31b09fcb7c30ff2c9a258b904a8c1d00a0c27
Instruction Fuzzy Hash: 41F037B59043109FC715AF65D584A097BE4AF48712F05849FF8488B3A3CB78D848CF9A

Function 00454B04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0045C5E4: TlsGetValue.KERNEL32(00484E6C,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4,?,00000000,?,0045161C,00000000,00000000,00000000,00000000), ref: 0045C623

GetCurrentThreadId.KERNEL32 ref: 00454B26
SetWindowsHookExA.USER32(00000005,0045490E,00000000,00000000), ref: 00454B36

Strings

,NH, xrefs: 00454B0B

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CurrentHookThreadValueWindows
String ID: ,NH
API String ID: 933525246-3639332287
Opcode ID: c06ef7ee82b170c591540f6efe32f56ac8f6f7cf81c1def2283c28d1a12e491b
Instruction ID: 6a169f95c0a047cfc12d40dde56c961d2103461f51a8918edd89d5a6ca4a0dd8
Opcode Fuzzy Hash: c06ef7ee82b170c591540f6efe32f56ac8f6f7cf81c1def2283c28d1a12e491b
Instruction Fuzzy Hash: 27E0E5306007009ED3305B659805717B6E5EBC0717F00053FFA0586142D334E84CCB6E

Function 0044A474 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000060,00000000,00000000,0044A23C,00000000,?,?,?,004468B8), ref: 0044A49C
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0044A23C,00000000,?,?,?,004468B8), ref: 0044A4D0
VirtualAlloc.KERNELBASE(00000000,00100000,00002000,00000004,?,004468B8), ref: 0044A4EA
HeapFree.KERNEL32(00000000,?,?,004468B8), ref: 0044A501

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 61af974347b872a07f4b7306607b6dda1dca58ce8006f179ac9acdc2834f604b
Instruction ID: 55dd626d8b783c385f77cc67d7b969fb17b259d8f25e45d9803cbc5e8e79af4c
Opcode Fuzzy Hash: 61af974347b872a07f4b7306607b6dda1dca58ce8006f179ac9acdc2834f604b
Instruction Fuzzy Hash: 07113D70200740AFD7618F19ED45E2A7BB6FB54711B124E3EE552E61B1E3719815CF09

Function 0045B66C Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(00000000,00000001,00000000,?,00000000,?,?,?,?,?,?,?,004010E9,Settings,KelvinDisplay,00000001), ref: 0045B6A5
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,004010E9,Settings,KelvinDisplay,00000001), ref: 0045B6AE
GetPrivateProfileIntA.KERNEL32(?,00000001,?,?), ref: 0045B6CD

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ClosePrivateProfileQueryValue
String ID:
API String ID: 1423431592-0
Opcode ID: 862bd0827794025fae14a527a14a470708bcde9ac6e78e6483119b93491d697b
Instruction ID: c9eb61f766163713eb6570c6a68a409d02ed976402ecb9f183aa15fb62a42d16
Opcode Fuzzy Hash: 862bd0827794025fae14a527a14a470708bcde9ac6e78e6483119b93491d697b
Instruction Fuzzy Hash: 33012832000208FBCB129F50DC44FDF3BB9EB44756F14402AFD059A152D735DA1A9B99

Function 00452DCA Relevance: 4.5, APIs: 3, Instructions: 29windowCOMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00452DD7
TranslateMessage.USER32(?), ref: 00452DF7
DispatchMessageA.USER32(?), ref: 00452DFE

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Message$CallbackDispatchDispatcherTranslateUser
String ID:
API String ID: 2960505505-0
Opcode ID: 6d7b628f998d36c49933c3f22c51a096f8bed9a6c218e4199f7b96ff2ff12ca7
Instruction ID: 114a34e5ab7a9e3be72936cf454a402f9512b4fe0d2c037285c9c2bdb0269713
Opcode Fuzzy Hash: 6d7b628f998d36c49933c3f22c51a096f8bed9a6c218e4199f7b96ff2ff12ca7
Instruction Fuzzy Hash: ABE01B722006006BE7255B659E4CD7B77ACFFC5B13704043FFD01D5551C7A4EC4A8A66

Function 00454491 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00454496

Part of subcall function 0045C5E4: TlsGetValue.KERNEL32(00484E6C,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4,?,00000000,?,0045161C,00000000,00000000,00000000,00000000), ref: 0045C623

Strings

,NH, xrefs: 004544A1

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: H_prologValue
String ID: ,NH
API String ID: 3700342317-3639332287
Opcode ID: 205a8cc612772d84a78a5cd90d98d7b5b8806f966a5420d8c696290ac5a4ec49
Instruction ID: 476cb90345a7b26f2641065122c46203d4e468b54fd79bc93206c29508aecda2
Opcode Fuzzy Hash: 205a8cc612772d84a78a5cd90d98d7b5b8806f966a5420d8c696290ac5a4ec49
Instruction Fuzzy Hash: EE213972900209EFDF01DF54C481AEE7BB9FB44359F10006AFD05AB642D374AA99CBA4

Function 004024B6 Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00442A90: IsIconic.USER32(?), ref: 00442A9E

Part of subcall function 00457F70: __EH_prolog.LIBCMT ref: 00457F75
Part of subcall function 00457F70: BeginPaint.USER32(?,?,?,?,004024F9,?), ref: 00457F9E

Part of subcall function 00442A30: SendMessageA.USER32(?,00000000,00000000,00000027), ref: 00442A4A

GetSystemMetrics.USER32(0000000B), ref: 0040251A
GetSystemMetrics.USER32(0000000C), ref: 00402525

Part of subcall function 00442AD0: GetClientRect.USER32(?,E%@), ref: 00442AE2

Part of subcall function 004429A0: DrawIcon.USER32(00000000,?,?,?), ref: 004429BA

Part of subcall function 00457FE2: __EH_prolog.LIBCMT ref: 00457FE7
Part of subcall function 00457FE2: EndPaint.USER32(?,?,?,?,0040259D,?,?,?,?), ref: 00458004

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: H_prologMetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
String ID:
API String ID: 1530917984-0
Opcode ID: ac7fe77c354bd69772595e0a909d5f1603444fc2f62261e7f99027e1d3fb95b8
Instruction ID: 798e7ee3c695d11fd0cc983b99a1a29eb3c57542b4c828615645bff47f22bcc4
Opcode Fuzzy Hash: ac7fe77c354bd69772595e0a909d5f1603444fc2f62261e7f99027e1d3fb95b8
Instruction Fuzzy Hash: 02215C719002099BDB24EFA4DE52BEEB774FB08304F60426AF915A32D2DF786900CB58

Function 0045B626 Relevance: 3.0, APIs: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0045B592: RegOpenKeyExA.KERNELBASE(80000001,software,00000000,0002001F,00000000,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045B5C0
Part of subcall function 0045B592: RegCreateKeyExA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison), ref: 0045B5E3
Part of subcall function 0045B592: RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,0002001F,00000000,00000001,?,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison), ref: 0045B602
Part of subcall function 0045B592: RegCloseKey.KERNELBASE(00000000,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045B612
Part of subcall function 0045B592: RegCloseKey.ADVAPI32(?,?,00000000,?,Settings,KelvinDisplay,00000001,Joshua F. Madison,00000000), ref: 0045B61C

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,0002001F,00000000,00000000,?,?,?,?,?,?,0045B680,?), ref: 0045B656
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,0045B680,?,?,?,?,?,004010E9,Settings,KelvinDisplay,00000001), ref: 0045B65D

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CloseCreate$Open
String ID:
API String ID: 1740278721-0
Opcode ID: ece89ff9e27392351063d3da15b131e84b9e1b289f6a5605be3dfad71202d11b
Instruction ID: d74613434f6e8538f058d287375a677dbbae4dc778eedcd368bb9b45f7b053be
Opcode Fuzzy Hash: ece89ff9e27392351063d3da15b131e84b9e1b289f6a5605be3dfad71202d11b
Instruction Fuzzy Hash: AEE0E576100128BB87219B92DC48CEFBF7CDE4ABA17000026FA05D2002E7749A04E7F6

Function 00454ECF Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 00454EF6
CallWindowProcA.USER32(?,?,?,?,?), ref: 00454F0B

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ProcWindow$Call
String ID:
API String ID: 2316559721-0
Opcode ID: 7f8b2ae733801aa31f9fcb09af72d71580687bb7c9c6fb80734d74b62beb4dc7
Instruction ID: 6f6274d84f339fa319656e092030713e6ea8177d3648f4f4380c13f1ff765eaf
Opcode Fuzzy Hash: 7f8b2ae733801aa31f9fcb09af72d71580687bb7c9c6fb80734d74b62beb4dc7
Instruction Fuzzy Hash: 63F01536100218FFCF218F98DC04D9B7BBAFF08356B048429FA45CA931D732E864AB54

Function 00449B70 Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,004468A6,00000001), ref: 00449B81

Part of subcall function 00449DD7: HeapAlloc.KERNEL32(00000000,00000140,00449B95), ref: 00449DE4

HeapDestroy.KERNEL32 ref: 00449B9F

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: c1590b95cbf526d1b6628b7873dc2edbac3bbc338dd40ce35fd812d1e8cd4a67
Instruction ID: ab74aa89f519fd71b8fbe14c357845d094e55221ae37e337c0e77ec6d58037b3
Opcode Fuzzy Hash: c1590b95cbf526d1b6628b7873dc2edbac3bbc338dd40ce35fd812d1e8cd4a67
Instruction Fuzzy Hash: AFE012706503415AFB501B30BD05B6B36D4AF54783F15883AF904D41E1FB65C980E609

Function 00453399 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004533D1

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Parent
String ID:
API String ID: 975332729-0
Opcode ID: 08f4c2bd48526c9cfb8c3a7313729ba8a41c582d9f40741d302698e66cf575a4
Instruction ID: 12f98c70ef10b89fa042fee519576ab3c4eb5d567def964ff8e27f7b3fcad0b8
Opcode Fuzzy Hash: 08f4c2bd48526c9cfb8c3a7313729ba8a41c582d9f40741d302698e66cf575a4
Instruction Fuzzy Hash: 9D01A5312006456FDF215E61DD44EAB7769FF863A7B04463BFD1182293D639CD149628

Function 004478BF Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004478A3,000000E0,00447890,?,00449D81,00000018,00000000,?,?,0044A94C,00000009), ref: 00447904

Part of subcall function 00449D61: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0044A94C,00000009,?,?,?,00448BFB,00000001,00000074,?,004468B8), ref: 00449D9E
Part of subcall function 00449D61: EnterCriticalSection.KERNEL32(?,?,?,0044A94C,00000009,?,?,?,00448BFB,00000001,00000074,?,004468B8), ref: 00449DB9

Part of subcall function 00449DC2: LeaveCriticalSection.KERNEL32(?,004478E3,00000009,?,00000009,00000000,?,004478A3,000000E0,00447890,?,00449D81,00000018,00000000,?), ref: 00449DCF

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitializeLeave
String ID:
API String ID: 495028619-0
Opcode ID: 61126d368c5eb4e0dd7a4b0c7549888455258f13e7de5de0f299ab65840813c1
Instruction ID: 41bd63fb9085bba79c2f24d571cf3d11cd07bb8ba6db70164324e86721868a75
Opcode Fuzzy Hash: 61126d368c5eb4e0dd7a4b0c7549888455258f13e7de5de0f299ab65840813c1
Instruction Fuzzy Hash: 9CE02B33D4462063F52132246C05B8B22409F50760F2E0136FD04BB2D1E7585C0293DD

Function 00455D0D Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00455D39

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Parent
String ID:
API String ID: 975332729-0
Opcode ID: 3a58532f6f7df2c9b0ba7cb571ef937022752a45bdb41f7a942dbd2b474571e9
Instruction ID: f4a9b55db240ca2c250a95c7a84196b8897aa33e03b0442244e38fc37f39f453
Opcode Fuzzy Hash: 3a58532f6f7df2c9b0ba7cb571ef937022752a45bdb41f7a942dbd2b474571e9
Instruction Fuzzy Hash: CCE065336046119BD6105A25481877BA3B4AF91753F158827FC01EB202D36CAC4E45A9

Function 00456CE1 Relevance: 1.5, APIs: 1, Instructions: 17windowCOMMON

Download Yara Rule

APIs

IsDialogMessageA.USER32(?,00442790,?,004566D2,?,00453394,?,?,?,?,00442790,?), ref: 00456D0A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: DialogMessage
String ID:
API String ID: 547518314-0
Opcode ID: 805a2b1335c19945732ff63014e9b3d6bd41c3f5670a70f4461dc6766ab70b9b
Instruction ID: 4512f4996a5bebb4b272478126e4e917de99f22bd9d8a73d4536355e1e60e972
Opcode Fuzzy Hash: 805a2b1335c19945732ff63014e9b3d6bd41c3f5670a70f4461dc6766ab70b9b
Instruction Fuzzy Hash: A7E086311042029FC3119B54D804A8B7BF1AF89311B0689AAF84587232C7759899CB49

Function 00442B10 Relevance: 1.5, APIs: 1, Instructions: 16windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000080,?,00000001), ref: 00442B2B

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f941b5fdf46dfd4267327040be8346ee89cb3ced6b5c347970432cde5f1bd2dc
Instruction ID: 3f75bca768d374a156aba251a72f36df4d15edc6a312130f617f666c627a3d02
Opcode Fuzzy Hash: f941b5fdf46dfd4267327040be8346ee89cb3ced6b5c347970432cde5f1bd2dc
Instruction Fuzzy Hash: 9FD05EB5A0420CBBD744CF88D845D5AB7ACFB08300F108198FD0887300C631EE008BE4

Function 00442D50 Relevance: 1.5, APIs: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000180,00000000,?), ref: 00442D69

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1ba1eacaa75fa3447a7a28400f2db2e59ce313f9ce17f641ff442b34e2ca2365
Instruction ID: f427ec7693af7c509973b2cedd14604df3c7b2afe657c4f2031cb8f95b468294
Opcode Fuzzy Hash: 1ba1eacaa75fa3447a7a28400f2db2e59ce313f9ce17f641ff442b34e2ca2365
Instruction Fuzzy Hash: 6ED09EB5645208BBD704CF84DC41E6A7768E748701F208199FE0457341C571AE1197D9

Function 0045726B Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

LoadStringA.USER32(?,?,?,?), ref: 00457282

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 10169ac30c0d2cb54471ec7d1adf86448e6d29b0ba182f2bd7d4f1c29b20be10
Instruction ID: d4b7c4c26dac0776ceaf7030a1f258f3e8310c78a0ba04107466acb386b970cb
Opcode Fuzzy Hash: 10169ac30c0d2cb54471ec7d1adf86448e6d29b0ba182f2bd7d4f1c29b20be10
Instruction Fuzzy Hash: 6BD0A77650D3629BC711DF609C04C4FBBA8BF54311F044C9EFC8083112C329D408CB66

Function 00442F20 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00000000,004010AC), ref: 00442F36

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: IconLoad
String ID:
API String ID: 2457776203-0
Opcode ID: bbe1fe7061d80a883b27332858ff83816a9bda51d39bd289755170f992d3d992
Instruction ID: 73e4ab46f59bb8b7f3d15ecd6c5a13c762f622c74e8ced92e8edcf229f7b7b40
Opcode Fuzzy Hash: bbe1fe7061d80a883b27332858ff83816a9bda51d39bd289755170f992d3d992
Instruction Fuzzy Hash: B7C012B18083096B9700AB95EC0692AB7ACDF05341B40457ABC04D3305C939D92455AD

Function 00456DAA Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000001), ref: 00456DB8

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 12b161bcd9e75f1b888a572112c44781bbc0576cfc20599dba1ced74c39ed207
Instruction ID: 861068de24ad344938fdfe7c7a2e485c1d1c3da7141f22d378cbd8097d36c4a7
Opcode Fuzzy Hash: 12b161bcd9e75f1b888a572112c44781bbc0576cfc20599dba1ced74c39ed207
Instruction Fuzzy Hash: DAD09E743042019FDB458F60C948A1AB7B1BF94705F619979F4468B126D736DC1EEB05

Function 00456E7C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000004,0045674F,00000001), ref: 00456E8A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 269e9099fa06fdd6cf444dbdeba75f542f5c9b875810315aa21e485c2abd5f8b
Instruction ID: 8ddd1a6a3c87dc1787ba2f188bfa9a1ab466d6095c115c74ab3e566f78352d12
Opcode Fuzzy Hash: 269e9099fa06fdd6cf444dbdeba75f542f5c9b875810315aa21e485c2abd5f8b
Instruction Fuzzy Hash: 89D09E342052009FCF059F60C948A16B7A2BF94705FA18579F4498B122D736DC16EB45

Function 0044A916 Relevance: 1.3, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,?,?,?,?,00448BFB,00000001,00000074,?,004468B8), ref: 0044A96B

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 12b899011d5b14afe1234b8e966710f407b067cafd2ccaefc2e16218df47993a
Instruction ID: 6b460d658860f0a34e7cc12fb820d9cb4fe933037b74f9edceb3fd36004f3c82
Opcode Fuzzy Hash: 12b899011d5b14afe1234b8e966710f407b067cafd2ccaefc2e16218df47993a
Instruction Fuzzy Hash: 090128B2980A1076F72266251C41B5F22189B907B5F1B0A3BFD54673E2DB2C8C1053AF

Non-executed Functions

Function 0044F3D0 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 298COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,00000000), ref: 0044F415
CallWindowProcA.USER32(00000000), ref: 0044F437

Part of subcall function 0044E120: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 0044E146
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E15E
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E16A

Strings

#32770, xrefs: 0044F5E6

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Prop$CallProcRemoveWindow
String ID: #32770
API String ID: 2276450057-463685578
Opcode ID: 6f0463397d14bdb65bdd8239633e9b6b9758ae977eab37f47e40db2de9541177
Instruction ID: 04f3067fadea49d501e4fea9a5c3d1be9916b7ddd1b6c972520d7f3c784b89ca
Opcode Fuzzy Hash: 6f0463397d14bdb65bdd8239633e9b6b9758ae977eab37f47e40db2de9541177
Instruction Fuzzy Hash: B781F63270130477F610BB15EC44EAF775CEB96765F40083BFA4183252D729A90A87BB

Function 0044BE7C Relevance: 26.7, Strings: 21, Instructions: 417COMMON

Download Yara Rule

Strings

9, xrefs: 0044C10D
9, xrefs: 0044BEEB
1, xrefs: 0044C0C1
0, xrefs: 0044C01D
9, xrefs: 0044BF3D
1, xrefs: 0044C0F4
c, xrefs: 0044BF6B
0, xrefs: 0044C0EA
9, xrefs: 0044C0FD
0, xrefs: 0044BF58
0, xrefs: 0044C11B
+, xrefs: 0044BF4E
-, xrefs: 0044BF53
0, xrefs: 0044BFA6
9, xrefs: 0044BF91
e, xrefs: 0044BF74
C, xrefs: 0044BF5D
E, xrefs: 0044BF66
9, xrefs: 0044C0C9
+, xrefs: 0044C071
-, xrefs: 0044C07A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID:
String ID: +$+$-$-$0$0$0$0$0$1$1$9$9$9$9$9$9$C$E$c$e
API String ID: 0-1157002505
Opcode ID: 56b21115e3039a55b992c6c24b6dec10e2047b2b5065f12bc7b26b63e2393686
Instruction ID: ab315fc37b25b0874ef0f8e9977bb22301f8eb590a81d3722905248c9db57bd4
Opcode Fuzzy Hash: 56b21115e3039a55b992c6c24b6dec10e2047b2b5065f12bc7b26b63e2393686
Instruction Fuzzy Hash: 34E1BD31D46249DEFB658FA4C8917FEBBB1EB44304F2C406BD401E6282D7BD8982DB59

Function 0044EC20 Relevance: 19.7, APIs: 13, Instructions: 220windowCOMMON

Download Yara Rule

APIs

CallWindowProcA.USER32(00000000,00000000,?,?,?), ref: 0044EC5A
DefWindowProcA.USER32(00000000,?,?,?), ref: 0044EC6D
IsIconic.USER32(00000000), ref: 0044EC8F
SendMessageA.USER32(00000000,000011EF,00000000,00000001), ref: 0044ECBC
GetWindowLongA.USER32(00000000,000000F0), ref: 0044ECCB
GetWindowDC.USER32(00000000), ref: 0044ED0C
GetWindowRect.USER32(00000000,?), ref: 0044ED1A
InflateRect.USER32(?,000000FF,000000FF), ref: 0044ED5D
InflateRect.USER32(?,000000FF,000000FF), ref: 0044ED80
SelectObject.GDI32(00000000,00000000), ref: 0044ED8E
OffsetRect.USER32(?,?,00000000), ref: 0044EDE4

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$Rect$InflateProc$CallIconicLongMessageObjectOffsetSelectSend
String ID:
API String ID: 2215177122-0
Opcode ID: 9096c6537060c45b65de663de7f86eac3484782fb5f67c6b651282e0749f665c
Instruction ID: e45655a65217ef7d55729dd72c06eadf1864866102b75462febfb58216b9d507
Opcode Fuzzy Hash: 9096c6537060c45b65de663de7f86eac3484782fb5f67c6b651282e0749f665c
Instruction Fuzzy Hash: 57818A71508301AFD300CF69DC85E6BBBE8FB88718F148A2EF98497291D775E905CB66

Function 0044C828 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,00449D09,?,Microsoft Visual C++ Runtime Library,00012010,?,004673DC,?,0046742C,?,?,?,Runtime Error!Program: ), ref: 0044C83A
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0044C852
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0044C863
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0044C870

Strings

,tF, xrefs: 0044C896
user32.dll, xrefs: 0044C835
MessageBoxA, xrefs: 0044C84C
GetActiveWindow, xrefs: 0044C85D
GetLastActivePopup, xrefs: 0044C865

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: ,tF$GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-3657989805
Opcode ID: 07dad6bc0fcfb431e2441b77d96014447e09aaf89f89b46655ea6e1a91e8c6ab
Instruction ID: 38a94bf91023067f81d8986411577e6cded91bc7ff83c9e3405c4d9af4f1e50e
Opcode Fuzzy Hash: 07dad6bc0fcfb431e2441b77d96014447e09aaf89f89b46655ea6e1a91e8c6ab
Instruction Fuzzy Hash: 66014831B05711BFD751AFB59CC095F3EE9AA48792314083FE105C2225E779C845DB5D

Function 00451470 Relevance: 12.2, APIs: 8, Instructions: 163COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000002), ref: 00451483
SizeofResource.KERNEL32(?,00000000,?,75A44920,00000000,75A3CF90,?,?,?,?,?,?,?,?,0044F0C1,00000001), ref: 0045149D
LoadResource.KERNEL32(?,00000000,?,75A44920,00000000,75A3CF90,?,?,?,?,?,?,?,?,0044F0C1,00000001), ref: 004514A7

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Resource$FindLoadSizeof
String ID:
API String ID: 507330600-0
Opcode ID: 060a04dba71a98dc694b900d63f153f605b6b467a75d166a3c6f00940cfe8094
Instruction ID: b9ad16fa2e07dc23ab9736d7445d30646d3623cd559dd939402308f3dde518fc
Opcode Fuzzy Hash: 060a04dba71a98dc694b900d63f153f605b6b467a75d166a3c6f00940cfe8094
Instruction Fuzzy Hash: F841DD323047155BE70CCE299856AAF77D2EBC9351F048A3EF946C3382CB75D909C2A6

Function 004560CD Relevance: 6.0, APIs: 4, Instructions: 38keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00456D14: GetWindowLongA.USER32(00000000,000000F0), ref: 00456D20

GetKeyState.USER32(00000010), ref: 004560F1
GetKeyState.USER32(00000011), ref: 004560FA
GetKeyState.USER32(00000012), ref: 00456103
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 00456119

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 6be3c9b72b0f71bf2ce85cffb0d6049bce25e4ce3c043166b1e4cee5040837c8
Instruction ID: 8f54c0375ccd941a27c1d2196513093acca5702bc2ef27c8b8990537eb5c854e
Opcode Fuzzy Hash: 6be3c9b72b0f71bf2ce85cffb0d6049bce25e4ce3c043166b1e4cee5040837c8
Instruction Fuzzy Hash: 8BF0E972700B4626E92033579C41FBD05544B40BDAF52063AFF01AB1D7899D880A4278

Function 00445986 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585d5d74d3cd7d479584df758bea8d504f3d112cd754a0eeb72701c0602a9e6a
Instruction ID: 7167ebfada025e3e4a02c64d86556d1939cc32b8bff48ed9ef7e527fbaa4d526
Opcode Fuzzy Hash: 585d5d74d3cd7d479584df758bea8d504f3d112cd754a0eeb72701c0602a9e6a
Instruction Fuzzy Hash: 36F03CB1100609FBFF01AF61CC059AF3B6CAF00365B44802BFC16D5162EB38CA55EB5A

Function 00452C1A Relevance: 4.5, APIs: 3, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000010), ref: 00452C41
GetKeyState.USER32(00000011), ref: 00452C4A
GetKeyState.USER32(00000012), ref: 00452C53

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: bae5e39ec2c45d0456b1b0aad6012a5b38e217533565ba2da5d45849e8de58ce
Instruction ID: 9f948d4526c63fbe5bfb71a8ee088b272acec2408ced8b181ccad04ac819f452
Opcode Fuzzy Hash: bae5e39ec2c45d0456b1b0aad6012a5b38e217533565ba2da5d45849e8de58ce
Instruction Fuzzy Hash: 35E09B3570125B9DEE09A2548B00FDD77905B037D2F008467EF44AB1AFC6E8D84BA769

Function 00442A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00442A9E

Strings

$@, xrefs: 00442A97

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Iconic
String ID: $@
API String ID: 110040809-1661285546
Opcode ID: 6e08d12cc0a8983e1a769ca19d97ea331bd7e4365c821f8963b03fa420bf5a7a
Instruction ID: b3eef7d6ba28f44eb5ea11bf9b7590eb8c1a32cac2c26afeef82ca5222a7781f
Opcode Fuzzy Hash: 6e08d12cc0a8983e1a769ca19d97ea331bd7e4365c821f8963b03fa420bf5a7a
Instruction Fuzzy Hash: D9C08C7091830CEB8708CFC8E800C1AB7BCEB08321B0002EDFC0883301DA32EE108A99

Function 004597D5 Relevance: 3.0, APIs: 2, Instructions: 37keyboardwindowCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32(00000011), ref: 004597F2
SendMessageA.USER32(?,00000475,00000000,?), ref: 0045981A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: AsyncMessageSendState
String ID:
API String ID: 929296675-0
Opcode ID: fc7a4ba6a77f202cfb716dae4a16191c8cadd1e866b8b6cdfddd284e7f3f0bde
Instruction ID: dc6a4b2696d44a39bbce16041ef1d63b54cd5d5a5b442bbf147e5bca472b7c23
Opcode Fuzzy Hash: fc7a4ba6a77f202cfb716dae4a16191c8cadd1e866b8b6cdfddd284e7f3f0bde
Instruction Fuzzy Hash: C0F0B435220701EADE242A159C44BAF2298AB56712F60443BF902D6292C698DC8981ED

Function 0044B865 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0004B81F), ref: 0044B86A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e5e189204656cb01ef1273a0acc651df7c657344f95e4d47acacab6e57b664db
Instruction ID: 7dee9ab5ac3f178706456eda9818325ac9f53c089aeadc4391a134732a196e17
Opcode Fuzzy Hash: e5e189204656cb01ef1273a0acc651df7c657344f95e4d47acacab6e57b664db
Instruction Fuzzy Hash: D7A002B4542B40CFEB407F60EC496087A64EA45B03B248D7BE951C2376DB74C484BBAE

Function 0044B877 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0044B87C

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c646c560611be07d48e28c2905ba54f700b34fc8bab0143ca62da25bb652adfd
Instruction ID: 7e5ce99fa8e3ba7c662aa20d0136c199dd1490983f33dcc9ebc7b2bfe5d7f4ef
Opcode Fuzzy Hash: c646c560611be07d48e28c2905ba54f700b34fc8bab0143ca62da25bb652adfd
Instruction Fuzzy Hash:

Function 0044A620 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: c7680e2bbcb83ed5b8c641c15e97bc60505aff7dde7ac397ddd3aeca95614676
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 92B19E7594020ADFEB25CF04C5D0AA9BBA1FF58318F24C1AED85A5B342C735EE52CB90

Function 00450860 Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 263windowstringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0045086E
SendMessageA.USER32(?,00000157,00000000,00000000), ref: 0045089A
HideCaret.USER32(?), ref: 004508B0
GetWindowRect.USER32(?,?), ref: 004508BC
GetParent.USER32(?), ref: 004508C3
ScreenToClient.USER32(00000000,?), ref: 004508D7
ScreenToClient.USER32(00000000,?), ref: 004508E3
GetDC.USER32(00000000), ref: 004508E6
GetWindowLongA.USER32(?,000000F4), ref: 00450918
SendMessageA.USER32(00000000,00001944,00000000,0000029A), ref: 00450945
SendMessageA.USER32(00000000,00001943,00000000,0000029A), ref: 00450966
GetClassNameA.USER32(00000000,?,00000010), ref: 00450978
lstrcmpA.KERNEL32(?,ComboBox), ref: 00450988
GetParent.USER32(00000000), ref: 004509AC
MapWindowPoints.USER32(00000000,0000029A,?,00000002), ref: 004509C3
ReleaseDC.USER32(00000000,00000000), ref: 004509CB
GetDC.USER32(?), ref: 004509D6
GetWindowLongA.USER32(00000000,000000F0), ref: 004509EC
GetWindow.USER32(00000000,00000005), ref: 00450A07
GetWindowRect.USER32(00000000,?), ref: 00450A13
SendMessageA.USER32(00000000,00000157,00000000,00000000), ref: 00450A50
ReleaseDC.USER32(?,00000000), ref: 00450A60
ShowCaret.USER32(?), ref: 00450A67
GetSystemMetrics.USER32(00000002), ref: 00450AA8
GetSystemMetrics.USER32(00000002), ref: 00450B07
GetSystemMetrics.USER32(00000015), ref: 00450B58
ReleaseDC.USER32(00000000,00000000), ref: 00450B7A
ShowCaret.USER32(?), ref: 00450B88

Strings

ComboBox, xrefs: 00450982

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$MessageSend$CaretLongMetricsReleaseSystem$ClientParentRectScreenShow$ClassHideNamePointslstrcmp
String ID: ComboBox
API String ID: 930961256-1152790111
Opcode ID: 4b2ca26e7a594a790a2dec069ad3a96b87dcc36fe59f609416c0d7e9f39aeb91
Instruction ID: f5147c4b033b9d93762802ae08093f6761e9fd95ea63cc5852bb2a7ebcdd4689
Opcode Fuzzy Hash: 4b2ca26e7a594a790a2dec069ad3a96b87dcc36fe59f609416c0d7e9f39aeb91
Instruction Fuzzy Hash: 90918075508305AFE3109F64CC89F6FB7A8FB8571AF00092EFA4196292D778D909CB5B

Function 0044EF70 Relevance: 45.6, APIs: 18, Strings: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004869C0,?,?,?,?,?,?,?,?,?,?,?,?,0044E4E7), ref: 0044EF7B
GetDC.USER32(00000000), ref: 0044EF83
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0044EF94
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0044EF9B
GetSystemMetrics.USER32(00000001), ref: 0044EFB9
GetSystemMetrics.USER32(00000000), ref: 0044EFC4
ReleaseDC.USER32(00000000,00000000), ref: 0044EFDA
GlobalAddAtomA.KERNEL32(C3d), ref: 0044EFF4
LeaveCriticalSection.KERNEL32(004869C0,?,?,?,?,?,?,?,?,?,?,?,?,0044E4E7), ref: 0044F010
GlobalAddAtomA.KERNEL32(C3dNew), ref: 0044F027
GlobalAddAtomA.KERNEL32(C3dL), ref: 0044F039
GlobalAddAtomA.KERNEL32(C3dH), ref: 0044F046
GlobalAddAtomA.KERNEL32(C3dLNew), ref: 0044F06A
GlobalAddAtomA.KERNEL32(C3dHNew), ref: 0044F077
GlobalAddAtomA.KERNEL32(C3dD), ref: 0044F09B
GetSystemMetrics.USER32(0000002A), ref: 0044F0AE
GetClassInfoA.USER32(00000000,00467608,?), ref: 0044F0F1
GetClassInfoA.USER32(00000000,00008002,?), ref: 0044F10E

Strings

C3dNew, xrefs: 0044F022
C3dHNew, xrefs: 0044F072
C3d, xrefs: 0044EFE9
@tH, xrefs: 0044F0CC
C3dD, xrefs: 0044F096
C3dLNew, xrefs: 0044F065
C3dH, xrefs: 0044F041
C3dL, xrefs: 0044F034

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: AtomGlobal$MetricsSystem$CapsClassCriticalDeviceInfoSection$EnterLeaveRelease
String ID: @tH$C3d$C3dD$C3dH$C3dHNew$C3dL$C3dLNew$C3dNew
API String ID: 1233821986-2076519394
Opcode ID: 42f675b9099dbfe8f6312d69e4b1d4e1020238b1d82b51919c972022c5c79b86
Instruction ID: 397aeb2101c05f1bf1ba85f28c133a4b07b683c0c5a28ca5a6feff08b39ed30c
Opcode Fuzzy Hash: 42f675b9099dbfe8f6312d69e4b1d4e1020238b1d82b51919c972022c5c79b86
Instruction Fuzzy Hash: 3341D6B4A403009AF750EF64EC46B5F77A4BB44B55F11087BE800972E1DBB9C9498B6E

Function 0044FCF0 Relevance: 37.8, APIs: 25, Instructions: 294windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0044E200: SetBkColor.GDI32(?), ref: 0044E21D
Part of subcall function 0044E200: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044E26A
Part of subcall function 0044E200: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044E299
Part of subcall function 0044E200: SetBkColor.GDI32(?,?), ref: 0044E2B7
Part of subcall function 0044E200: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044E2E2
Part of subcall function 0044E200: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044E31C

InflateRect.USER32(?,000000FF,000000FF), ref: 0044FD32
IsWindowEnabled.USER32(?), ref: 0044FD45
InflateRect.USER32(?,000000FF,000000FF), ref: 0044FD6C
PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 0044FD83
PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 0044FD9C
PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 0044FDB4
PatBlt.GDI32(?,?,?,00000001,00000001,00F00021), ref: 0044FDCE
SelectObject.GDI32(?,00000000), ref: 0044FDF3
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 0044FE17
PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 0044FE37
SelectObject.GDI32(?,00000000), ref: 0044FE4D
PatBlt.GDI32(?,00000000,?,?,00000001,00F00021), ref: 0044FE7B
PatBlt.GDI32(?,00000000,00000000,00000001,00000000,00F00021), ref: 0044FE9C
InflateRect.USER32(?,000000FF,000000FF), ref: 0044FEB2
SelectObject.GDI32(?,00000000), ref: 0044FECC
PatBlt.GDI32(?,00000000,?,?,?,00F00021), ref: 0044FEF4
IsWindowEnabled.USER32(?), ref: 0044FEFF
SetTextColor.GDI32(?,00000000), ref: 0044FF10
OffsetRect.USER32(?,00000001,00000001), ref: 0044FF9C

Part of subcall function 0044E200: SetBkColor.GDI32(?,00000000), ref: 0044E324

DrawTextA.USER32(?,?,?,?,00000020), ref: 0044FFD4
GetFocus.USER32 ref: 0044FFE0
InflateRect.USER32(?,00000001,00000001), ref: 0044FFF1
IntersectRect.USER32(?,?,?), ref: 00450002
DrawFocusRect.USER32(?,?), ref: 0045000E
SelectObject.GDI32(?,00000000), ref: 00450021

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Rect$Text$ColorInflateObjectSelect$DrawEnabledFocusWindow$IntersectOffset
String ID:
API String ID: 1611134597-0
Opcode ID: 64d775622533a21e220d4ae0205307bdb6521d46f92e4c71f8f5d3f70b2ae6bc
Instruction ID: 482c56d6678bdf716fbb3a76561fb12629bb58070e0fb16d5a232d5d047e60c4
Opcode Fuzzy Hash: 64d775622533a21e220d4ae0205307bdb6521d46f92e4c71f8f5d3f70b2ae6bc
Instruction Fuzzy Hash: B4B15871208301AFE300DF58CD88E6BB7E8FB88715F004A2DF559D2292D775E949CB66

Function 00450580 Relevance: 30.2, APIs: 20, Instructions: 246COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,00000000), ref: 004505C5
CallWindowProcA.USER32(00000000), ref: 004505ED

Part of subcall function 0044E120: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 0044E146
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E15E
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E16A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Prop$CallProcRemoveWindow
String ID:
API String ID: 2276450057-0
Opcode ID: e3351b2e6c3c1e552f273ab11ae49265e9547592f73b94d650992a0afac3cf68
Instruction ID: 08df090749a6c86d03e1448c2218fc783d203d679a388a40f9cb91f8c021fa9e
Opcode Fuzzy Hash: e3351b2e6c3c1e552f273ab11ae49265e9547592f73b94d650992a0afac3cf68
Instruction Fuzzy Hash: 29611A766413156BE220AB14EC44FAF3758EB85763F100536FE4093393D71DA90986BF

Function 00459C2A Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00003020), ref: 00459C46
GetDlgItem.USER32(?,00003020), ref: 00459C7F
GetWindowRect.USER32(00000000,?), ref: 00459C8D
MapDialogRect.USER32(?,?), ref: 00459CB1
SetWindowPos.USER32(?,00000000,00000000,00000000,?,00000020,00000016), ref: 00459CDE
GetDlgItem.USER32(?,00481E50), ref: 00459CF3
GetWindowRect.USER32(00000000,?), ref: 00459D05
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000015,?), ref: 00459D24
GetWindowRect.USER32(?,?), ref: 00459D3E
GetWindowRect.USER32(?,?), ref: 00459D85
GetDlgItem.USER32(?,00000001), ref: 00459D8C
GetWindowRect.USER32(00000000,?), ref: 00459D97
GetDlgItem.USER32(?,00481E50), ref: 00459DBD
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00444B96), ref: 00459DCC
EnableWindow.USER32(?,00000000), ref: 00459DD6

Strings

, xrefs: 00459CAA

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$Rect$Item$DialogEnableShow
String ID:
API String ID: 763981185-3916222277
Opcode ID: 4f5bace98bce3194aaca412c0a00ce4b1a0b49e6e12e4649228dc11adc283f3f
Instruction ID: 40afbb5e2e47bb1826aea24485709fc0d7b03dc913777e156ab87fe6f2222d84
Opcode Fuzzy Hash: 4f5bace98bce3194aaca412c0a00ce4b1a0b49e6e12e4649228dc11adc283f3f
Instruction Fuzzy Hash: AF51EAB1900209EFDF11AFA5DD89DAFBBBDEF08345F10452AF901A2152D7389D09CB28

Function 004563CE Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00456D14: GetWindowLongA.USER32(00000000,000000F0), ref: 00456D20

GetParent.USER32(?), ref: 004563F9
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 0045641C
GetWindowRect.USER32(?,?), ref: 00456435
GetWindowLongA.USER32(00000000,000000F0), ref: 00456448
CopyRect.USER32(?,?), ref: 00456495
CopyRect.USER32(?,?), ref: 0045649F
GetWindowRect.USER32(00000000,?), ref: 004564A8
CopyRect.USER32(?,?), ref: 004564C4

Strings

(, xrefs: 00456460
@, xrefs: 00456437

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: ($@
API String ID: 808654186-1311469180
Opcode ID: 347572b96a1f165e280f6a36f9653e422315dd223811af27d6f77145a25b9c97
Instruction ID: cd12697c8c048b51ec6cfe59020c4f8684575f30c3091c4fcf409b7f890b6b06
Opcode Fuzzy Hash: 347572b96a1f165e280f6a36f9653e422315dd223811af27d6f77145a25b9c97
Instruction Fuzzy Hash: E5519272900219AFDF10DBA8DC45EEEBBB9AF44311F15412AFD01F3286DA34E8098B58

Function 00445858 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,?,75A44A40,00445991,?,?,?,?,?,?,?,004564B6,00000000,00000002,00000028), ref: 0044587A
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00445892
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 004458A3
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 004458B4
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 004458C5
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 004458D6
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 004458E7

Strings

MonitorFromRect, xrefs: 004458AE
MonitorFromPoint, xrefs: 004458BF
GetMonitorInfoA, xrefs: 004458E1
MonitorFromWindow, xrefs: 0044589D
GetSystemMetrics, xrefs: 0044588C
EnumDisplayMonitors, xrefs: 004458D0
USER32, xrefs: 00445875

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-2376520503
Opcode ID: 7026af3d613aa0c3700aeaa3f9c097e269384c4b12618694bcc19e0677dc46b4
Instruction ID: 8c46abafa513193f1d07c3da810188802d7ce7fc46f2c6a62fcabed473a56ce0
Opcode Fuzzy Hash: 7026af3d613aa0c3700aeaa3f9c097e269384c4b12618694bcc19e0677dc46b4
Instruction Fuzzy Hash: 3811E271A06712ABE711AF6ABCC152EBEACB688750767083FD004D2652EF784445AB2D

Function 0044EED0 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 44stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004869C0,75A44920,771AB510,?,?,?,?,?,?,?,?,?,?,?,?,0044E4E7), ref: 0044EEE7
GetProfileStringA.KERNEL32(windows,kanjimenu,roman,?,00000009), ref: 0044EF10
lstrcmpiA.KERNEL32(?,kanji), ref: 0044EF22
GetProfileStringA.KERNEL32(windows,hangeulmenu,english,?,00000009), ref: 0044EF45
lstrcmpiA.KERNEL32(?,hangeul), ref: 0044EF51
LeaveCriticalSection.KERNEL32(004869C0,?,?,?,?,?,?,?,?,?,?,?,?,0044E4E7), ref: 0044EF63

Strings

kanji, xrefs: 0044EF16
windows, xrefs: 0044EF0B, 0044EF40
roman, xrefs: 0044EF01
hangeul, xrefs: 0044EF4B
english, xrefs: 0044EF36
hangeulmenu, xrefs: 0044EF3B
kanjimenu, xrefs: 0044EF06

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalProfileSectionStringlstrcmpi$EnterLeave
String ID: english$hangeul$hangeulmenu$kanji$kanjimenu$roman$windows
API String ID: 1105401458-111014456
Opcode ID: 4c3af4a1db09fd1b8f7beec5f6aab5d4b90bdf55bcc45b86bb883ddb7bde3641
Instruction ID: 191212876157a78d561bbd920da455072d5ba219b2de2d19bdb3031a40892c90
Opcode Fuzzy Hash: 4c3af4a1db09fd1b8f7beec5f6aab5d4b90bdf55bcc45b86bb883ddb7bde3641
Instruction Fuzzy Hash: 8001D4B6644305BAD220FB64ED06F8E3F989745F65F200C77F504A20DAD6A9D20C876F

Function 0045A259 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 209windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0045A25E

Part of subcall function 0045C679: __EH_prolog.LIBCMT ref: 0045C67E

SendMessageA.USER32(?,000001A1,00000000,00000000), ref: 0045A2B4
GetSysColor.USER32(00000005), ref: 0045A2CC

Part of subcall function 00456EA3: IsWindowEnabled.USER32(?), ref: 00456EAD

GetSysColor.USER32(0000000D), ref: 0045A301
CreateCompatibleDC.GDI32(00000000), ref: 0045A32C
SelectObject.GDI32(?,?), ref: 0045A356
CopyRect.USER32(?,?), ref: 0045A36D
CopyRect.USER32(?,?), ref: 0045A3A6
FillRect.USER32(?,?,?), ref: 0045A417
BitBlt.GDI32(?,?,?,?,?,?,?,00000000,00CC0020), ref: 0045A44D
SelectObject.GDI32(?,?), ref: 0045A459

Strings

`NH, xrefs: 0045A273

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Rect$ColorCopyH_prologObjectSelect$CompatibleCreateEnabledFillMessageSendWindow
String ID: `NH
API String ID: 2145091578-2708191515
Opcode ID: 9f95f27956812d5a72cd40a5f052fcec92d8a0a6ffe557a0f1b67f95e691388b
Instruction ID: 70bc50098859aece617cdcab2df485cc50c0f84c97a0012ec716c5704940e02c
Opcode Fuzzy Hash: 9f95f27956812d5a72cd40a5f052fcec92d8a0a6ffe557a0f1b67f95e691388b
Instruction Fuzzy Hash: 99818931D00209AFDF11DFA4C885AAEBBB5FF08305F14826AEC05E7292DB74A949CF55

Function 0044E821 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000FC), ref: 0044E83D
RemovePropA.USER32(?,00000000), ref: 0044E873
SetWindowLongA.USER32(?,000000FC,00000000), ref: 0044E879
RemovePropA.USER32(?,00000000), ref: 0044E8A7
SetWindowLongA.USER32(?,000000FC,00000000), ref: 0044E8AD
GetWindow.USER32(?,00000005), ref: 0044E902
GetWindow.USER32(00000000,00000002), ref: 0044E913

Strings

iH, xrefs: 0044E821

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$Long$PropRemove
String ID: iH
API String ID: 3256693057-671714768
Opcode ID: 71bbb19fc30a0a8a53cc650c85607471b80cb6831db3aa6405de9dc21c46187c
Instruction ID: d784b0b894c1bb10fbbcaf2406d950b1b81471438916dcd71e91cf1a1a67c3ff
Opcode Fuzzy Hash: 71bbb19fc30a0a8a53cc650c85607471b80cb6831db3aa6405de9dc21c46187c
Instruction Fuzzy Hash: 46213AB65015216AFB407779BC40E7F228CEF49715B12063AF910C3292FB69CC0287BD

Function 0044DF40 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 83stringCOMMON

Download Yara Rule

APIs

GetPropA.USER32(?,00000000), ref: 0044DF59
GetPropA.USER32(?,00000000), ref: 0044DF6D
GetPropA.USER32(?,00000000), ref: 0044DF81
GetPropA.USER32(?,00000000), ref: 0044DF95
GetPropA.USER32(?,00000000), ref: 0044DFA9
GetPropA.USER32(?,00000000), ref: 0044DFB9
IsWindowUnicode.USER32(?), ref: 0044DFD6
GetClassNameA.USER32(?,?,00000010), ref: 0044DFE8
lstrcmpiA.KERNEL32(?,edit), ref: 0044DFF8
SetWindowLongA.USER32(?,000000FC,?), ref: 0044E008
SetPropA.USER32(?,00000000,00000000), ref: 0044E019

Strings

edit, xrefs: 0044DFF2

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Prop$Window$ClassLongNameUnicodelstrcmpi
String ID: edit
API String ID: 4088303749-2167791130
Opcode ID: 4977a0ca70fbd462df30f69a24d0f194bad25583e6eec4894d691e1561da5d7e
Instruction ID: 61505c5790e136d37025cb11f14072e73272d11d50699b1b3379778df887dd02
Opcode Fuzzy Hash: 4977a0ca70fbd462df30f69a24d0f194bad25583e6eec4894d691e1561da5d7e
Instruction Fuzzy Hash: B721C6A65021226AB350BB79AC05FBF26DCAF49645B010839FD14C2151F76AC942877E

Function 00444366 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 88stringprocessCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,004440DC), ref: 004443A8

Part of subcall function 0044411B: RegOpenKeyExA.ADVAPI32(?,80000000,00000000,00000001,?), ref: 0044413A
Part of subcall function 0044411B: RegQueryValueA.ADVAPI32(?,00000000,?,00000104), ref: 00444167
Part of subcall function 0044411B: lstrcpyA.KERNEL32(004443D7,?), ref: 00444178
Part of subcall function 0044411B: RegCloseKey.ADVAPI32(?), ref: 00444182

lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?), ref: 004443EB
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00444464
lstrcatA.KERNEL32(00000000,00481988,?,?), ref: 00444499
lstrcatA.KERNEL32(00000000,00000000), ref: 004444AA
WinExec.KERNEL32(?,004440DC), ref: 004444BB

Strings

.htm, xrefs: 004443C2
\shell\open\command, xrefs: 004443DF
open, xrefs: 004443A1
"%1", xrefs: 00444417
, xrefs: 004443B1

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: lstrcat$CloseExecExecuteOpenQueryShellValuelstrcpylstrlen
String ID: $"%1"$.htm$\shell\open\command$open
API String ID: 2095745534-2117809343
Opcode ID: a4b4687578586a3d41bfcb3d09f533bd23965947a11887b6bdc35d530c439532
Instruction ID: a3c79ad545996efa026fd2fb51d2bbf3220b69afb3cc17673bc816c52ba152af
Opcode Fuzzy Hash: a4b4687578586a3d41bfcb3d09f533bd23965947a11887b6bdc35d530c439532
Instruction Fuzzy Hash: A2318DB9D41318ABEB10DB90DC89BDD7778AB58301F108AEAF51DA3241D3B49A84CF55

Function 00444386 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 83stringprocessCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,004440DC), ref: 004443A8

Part of subcall function 0044411B: RegOpenKeyExA.ADVAPI32(?,80000000,00000000,00000001,?), ref: 0044413A
Part of subcall function 0044411B: RegQueryValueA.ADVAPI32(?,00000000,?,00000104), ref: 00444167
Part of subcall function 0044411B: lstrcpyA.KERNEL32(004443D7,?), ref: 00444178
Part of subcall function 0044411B: RegCloseKey.ADVAPI32(?), ref: 00444182

lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?), ref: 004443EB
lstrlenA.KERNEL32(?,?,?,?,?), ref: 00444464
lstrcatA.KERNEL32(00000000,00481988,?,?), ref: 00444499
lstrcatA.KERNEL32(00000000,00000000), ref: 004444AA
WinExec.KERNEL32(?,004440DC), ref: 004444BB

Strings

.htm, xrefs: 004443C2
\shell\open\command, xrefs: 004443DF
open, xrefs: 004443A1
"%1", xrefs: 00444417
, xrefs: 004443B1

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: lstrcat$CloseExecExecuteOpenQueryShellValuelstrcpylstrlen
String ID: $"%1"$.htm$\shell\open\command$open
API String ID: 2095745534-2117809343
Opcode ID: 3ce191d076076bd43ed04a0d09b9f119ac7e7a7a11a376a283e35f8f9bc092c4
Instruction ID: f046a019f503a7fc56761149c3aa06bdd61ee2a759f7292e8e074a5db26a18eb
Opcode Fuzzy Hash: 3ce191d076076bd43ed04a0d09b9f119ac7e7a7a11a376a283e35f8f9bc092c4
Instruction Fuzzy Hash: BC319EB994031CABDB10DF90DC89BDDB778BB58305F104AEAF519A3281D3B49A84CF65

Function 004513A0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?), ref: 004513B4
GetProcAddress.KERNEL32(00000000,DisableThreadLibraryCalls), ref: 004513C0
EnterCriticalSection.KERNEL32(004869C0), ref: 004513DC
GetVersion.KERNEL32 ref: 004513EE
GetSystemMetrics.USER32(00000007), ref: 00451432
GetSystemMetrics.USER32(00000008), ref: 0045143C
GetSystemMetrics.USER32(00000004), ref: 00451446
GetSystemMetrics.USER32(0000001E), ref: 0045144F
LeaveCriticalSection.KERNEL32(004869C0), ref: 0045145B

Strings

KERNEL32.DLL, xrefs: 004513AF
DisableThreadLibraryCalls, xrefs: 004513BA

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: MetricsSystem$CriticalSection$AddressEnterHandleLeaveModuleProcVersion
String ID: DisableThreadLibraryCalls$KERNEL32.DLL
API String ID: 1414939872-3863293605
Opcode ID: f7abba66597511521dab04471458c54eb54ecae5de7d3b1772180962d425a6fe
Instruction ID: fb0f9484f22d2e5e5095961da27c472b94919276c693382aba93f78b4b1cbc42
Opcode Fuzzy Hash: f7abba66597511521dab04471458c54eb54ecae5de7d3b1772180962d425a6fe
Instruction Fuzzy Hash: DC1151B0814715EAD750BF24ED1975F3E60EB01B16F11883EE985972B1E779C8488B4E

Function 0044F740 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 128threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0044F747
EnterCriticalSection.KERNEL32(004869C0), ref: 0044F754
LeaveCriticalSection.KERNEL32(004869C0), ref: 0044F79C
CallNextHookEx.USER32(00000000,?,?,?), ref: 0044F7B3
LeaveCriticalSection.KERNEL32(004869C0), ref: 0044F7CE
GetWindowLongA.USER32(?,000000F0), ref: 0044F812
SendMessageA.USER32(?,000011F0,00000000,00000001), ref: 0044F839
GetParent.USER32(?), ref: 0044F8A1
CallNextHookEx.USER32(00000000,?,?,?), ref: 0044F8DE

Strings

DjH, xrefs: 0044F76C

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalSection$CallHookLeaveNext$CurrentEnterLongMessageParentSendThreadWindow
String ID: DjH
API String ID: 1151315845-1875359361
Opcode ID: 6a64dae5912ba8e52ce471284cfdbeabbd804498d55e49b02759bcae75d365ee
Instruction ID: d68dca49f87fbffe5f9d7aaddebd40d9e196b6bb7031100808ebbe94d78ffa97
Opcode Fuzzy Hash: 6a64dae5912ba8e52ce471284cfdbeabbd804498d55e49b02759bcae75d365ee
Instruction Fuzzy Hash: B7419CB19003419BE714EF18EC45B6B73A4FB55719F01483AF90597692E778A80CCB6A

Function 00459584 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 004595A5
GetWindowLongA.USER32(00000000,000000F0), ref: 004595B6
IsWindowEnabled.USER32(00000000), ref: 004595C0
GetDlgItem.USER32(?,004666A8), ref: 004595D9
GetWindowLongA.USER32(00000000,000000F0), ref: 004595E2
IsWindowEnabled.USER32(?), ref: 004595EF
GetFocus.USER32 ref: 00459617
IsWindowEnabled.USER32(00000000), ref: 0045961E
SetFocus.USER32(?), ref: 0045962C

Strings

\F, xrefs: 00459600

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$Enabled$FocusItemLong
String ID: \F
API String ID: 1558694495-1837130337
Opcode ID: 24b16d1bf5114749864de1890cbeb364abea97ee20588e21ff449420f15ab95e
Instruction ID: c6882aa29c24beebf7dfe9a8a867be32a38a24ee3ed0a77ce138ddb2fa7c5efd
Opcode Fuzzy Hash: 24b16d1bf5114749864de1890cbeb364abea97ee20588e21ff449420f15ab95e
Instruction Fuzzy Hash: D1116D71104305EBDB11AF65EC48A1BBBA8FF54353F10453AFD42822B3EB29DC1C8A5A

Function 0044F160 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004869C0,?,0044E5BF), ref: 0044F166
GlobalDeleteAtom.KERNEL32(00000000), ref: 0044F1A2
GlobalDeleteAtom.KERNEL32(00000000), ref: 0044F1BD
GlobalDeleteAtom.KERNEL32(00000000), ref: 0044F1D0
GlobalDeleteAtom.KERNEL32(00000000), ref: 0044F1E3
GlobalDeleteAtom.KERNEL32(00000000), ref: 0044F1F6
GlobalDeleteAtom.KERNEL32(00000000), ref: 0044F209
GlobalDeleteAtom.KERNEL32(00000000), ref: 0044F21C
LeaveCriticalSection.KERNEL32(004869C0,?,0044E5BF), ref: 0044F22D

Strings

@tH, xrefs: 0044F16C

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: AtomDeleteGlobal$CriticalSection$EnterLeave
String ID: @tH
API String ID: 3843206905-3163496834
Opcode ID: 6b5cf8d5651c0e2ede6e4fb9c9bca488bf361a519a309a20dee0486d30686d84
Instruction ID: 366b6ecb6c0cc8fd04b4a142062c83e7bde9017afde63cfdeea87f4fff5a362b
Opcode Fuzzy Hash: 6b5cf8d5651c0e2ede6e4fb9c9bca488bf361a519a309a20dee0486d30686d84
Instruction Fuzzy Hash: 9B112BE9C02611D1E7557BA4EC097AE3668A708714F06497AE810876F1D7BC8CC9CBAD

Function 00450D20 Relevance: 16.7, APIs: 11, Instructions: 199COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,00000000), ref: 00450D64
CallWindowProcA.USER32(00000000), ref: 00450D89

Part of subcall function 0044E120: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 0044E146
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E15E
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E16A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Prop$CallProcRemoveWindow
String ID:
API String ID: 2276450057-0
Opcode ID: 0325b7a9fd1aa84b178b40ad3b7d3711d88a5607fac080c6ceaefec6557843b5
Instruction ID: 1fc2387ce81d80cd78a752a48189347c9a285ef9ccc9efb136f60511dafa7fe4
Opcode Fuzzy Hash: 0325b7a9fd1aa84b178b40ad3b7d3711d88a5607fac080c6ceaefec6557843b5
Instruction Fuzzy Hash: 4F51917AA04200BFD254DB55DC85D7FB7B8EBCA716F44482EFD4483212E239AC498766

Function 004510B0 Relevance: 16.6, APIs: 11, Instructions: 140windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 004510BE
GetClientRect.USER32(?,?), ref: 004510D9
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 0045110B
SelectObject.GDI32(?,00000000), ref: 00451119
SetBkMode.GDI32(?,00000002), ref: 0045112A
GetParent.USER32(?), ref: 00451138
SendMessageA.USER32(00000000), ref: 0045113F
SelectObject.GDI32(?,00000000), ref: 00451149
SelectObject.GDI32(?,00000000), ref: 0045116B
SelectObject.GDI32(?,00000000), ref: 0045117B
OffsetRect.USER32(?,000000FF,000000FF), ref: 004511D2

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ObjectSelect$MessageRectSend$ClientLongModeOffsetParentWindow
String ID:
API String ID: 3606012576-0
Opcode ID: 8ef5488d82fcf8ffecbe8806a5e055cc3fa00ea10724d77ba6061b25ed431504
Instruction ID: dde9e1e2fa3cd7ba32b1e11d4ed19899c7b70c36a2a825e0908bb1268dd4ae3b
Opcode Fuzzy Hash: 8ef5488d82fcf8ffecbe8806a5e055cc3fa00ea10724d77ba6061b25ed431504
Instruction Fuzzy Hash: 444117762443017BE210AB44AC46F7F33ACEB85B26F4405B9FB01A61D3D669D90987BB

Function 00449BE5 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00449C52
GetStdHandle.KERNEL32(000000F4,004673DC,00000000,?,00000000,?), ref: 00449D28
WriteFile.KERNEL32(00000000), ref: 00449D2F

Strings

<program name unknown>, xrefs: 00449C62
Runtime Error!Program: , xrefs: 00449CB8
p'H, xrefs: 00449BF3
Microsoft Visual C++ Runtime Library, xrefs: 00449CFE
..., xrefs: 00449CA4

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $p'H
API String ID: 3784150691-660142619
Opcode ID: 5390a25a3750ea5658afd050b1b6d435617a8f97822e91970f44ce2234eed55c
Instruction ID: 7457db582058daa92303dab0c13eb31fafe36f930245dacd1f1243bcfb482f54
Opcode Fuzzy Hash: 5390a25a3750ea5658afd050b1b6d435617a8f97822e91970f44ce2234eed55c
Instruction Fuzzy Hash: D231C572A00218AEEF20EA61CD45F9F37ACEB45308F50086BF148D6151EA78DD458B5A

Function 0045A75A Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0045C679: __EH_prolog.LIBCMT ref: 0045C67E

Part of subcall function 00456D14: GetWindowLongA.USER32(00000000,000000F0), ref: 00456D20

SendMessageA.USER32(?,000001A1,00000000,00000000), ref: 0045A7A3
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 0045A7B2
SendMessageA.USER32(?,0000018E,00000000,00000000), ref: 0045A7CB
SendMessageA.USER32(?,0000018E,00000000,00000000), ref: 0045A7F3
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 0045A802
SendMessageA.USER32(?,00000198,?,?), ref: 0045A818
PtInRect.USER32(?,000000FF,?), ref: 0045A824

Strings

`NH, xrefs: 0045A773

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: MessageSend$H_prologLongRectWindow
String ID: `NH
API String ID: 2846605207-2708191515
Opcode ID: 7721bee9cac3cee2f3940bb2810650675d3d59f0025003bc4f8f2e6e1f441eaf
Instruction ID: 1c424adacdfc6fb3f40e3886e759d3497867bfd24a21c0cc36754b90bf3d89a9
Opcode Fuzzy Hash: 7721bee9cac3cee2f3940bb2810650675d3d59f0025003bc4f8f2e6e1f441eaf
Instruction Fuzzy Hash: BC315C70A0020DFFDB10DF94CC80DAEB7F9EB44349B20856AF911A72A1D734AE56DB14

Function 00457858 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 00457874
GetStockObject.GDI32(0000000D), ref: 0045787C
GetObjectA.GDI32(00000000,0000003C,?), ref: 00457889
GetDC.USER32(00000000), ref: 00457898
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004578AF
MulDiv.KERNEL32(?,00000048,00000000), ref: 004578BB
ReleaseDC.USER32(00000000,00000000), ref: 004578C6

Strings

System, xrefs: 0045786D, 004578DC

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 8bd566eca733602bd7c54c4663d2516961db3fb6eff9eb229e298b4e0f1d23ee
Instruction ID: 4c17c03f74adb425e6832893047fbe7024611f9ec729ff1b75e06c6a5946294a
Opcode Fuzzy Hash: 8bd566eca733602bd7c54c4663d2516961db3fb6eff9eb229e298b4e0f1d23ee
Instruction Fuzzy Hash: D6117731A00318ABEB106B91DD49F9F3BB8AB04756F004035FA05E61C2D7759D09C7A5

Function 004568A4 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00000800,00000000,00000400,00456B9E,00000000,00020000,?,?,00000000), ref: 004568AD
LoadLibraryA.KERNEL32(COMCTL32.DLL,?,00000000,?,?,?,?,?,?,?,?,004534E2,00000010,00000000), ref: 004568B6
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004568CA
#17.COMCTL32(?,00000000,?,?,?,?,?,?,?,?,004534E2,00000010,00000000), ref: 004568E5
#17.COMCTL32(?,00000000,?,?,?,?,?,?,?,?,004534E2,00000010,00000000), ref: 00456901
FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,004534E2,00000010,00000000), ref: 0045690D

Strings

InitCommonControlsEx, xrefs: 004568C2
COMCTL32.DLL, xrefs: 004568A6, 004568AC, 004568B3

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx
API String ID: 1437655972-4218389149
Opcode ID: eaae830ffc490a080bcc8b500297ae7eeb38d6ff8276ab9b27e8ae68237090cc
Instruction ID: 0026f93c61030dfd8041533a1903991f27fd15e8a5e372a56f892ad58c08b69e
Opcode Fuzzy Hash: eaae830ffc490a080bcc8b500297ae7eeb38d6ff8276ab9b27e8ae68237090cc
Instruction Fuzzy Hash: 64F0A476600712D783116BA4DC4895B77E8AB847637560436FD40E3213DB38CC098BBF

Function 0044A9EA Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0046746C,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 0044AA2C
LCMapStringA.KERNEL32(00000000,00000100,00467468,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 0044AA48
LCMapStringA.KERNEL32(?,00000100,00000020,00000001,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 0044AA91
MultiByteToWideChar.KERNEL32(00000000,00000101,00000020,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 0044AAC9
MultiByteToWideChar.KERNEL32(00000000,00000001,00000020,00000001,00000100,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 0044AB21
LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 0044AB37
LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 0044AB6A
LCMapStringW.KERNEL32(?,00000100,00000100,00000100,?,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 0044ABD2

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 5d03075eaee799eaab2f2c0cda81d02038ba3afc7d2971726a915066aef551e5
Instruction ID: e9160448b05074c11c83fb93dafd07d3ba8640c47529e9f32b01884e274a85b5
Opcode Fuzzy Hash: 5d03075eaee799eaab2f2c0cda81d02038ba3afc7d2971726a915066aef551e5
Instruction Fuzzy Hash: 0A51AF31540649EFEF218F94CC45EAF7FB9FB49744F10412AF910A2260C3399C60DB6A

Function 0045990E Relevance: 13.6, APIs: 9, Instructions: 133windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(00000000), ref: 0045997C
EnableWindow.USER32(00000000,00000000), ref: 00459988
GetCapture.USER32 ref: 00459996
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 004599A5
PropertySheetA.COMCTL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 004599C1
EnableWindow.USER32(00000000,00000001), ref: 00459A2A
GetActiveWindow.USER32 ref: 00459A34
SetActiveWindow.USER32(00000000,?,?,?,?,00000000,00000000), ref: 00459A40
EnableWindow.USER32(?,00000001), ref: 00459A6A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$Enable$Active$CaptureEnabledMessagePropertySendSheet
String ID:
API String ID: 61310451-0
Opcode ID: 1f8f90d0c93405f245c6e28c9c070102e81c42d15f52ea049057e8a4fdff6bcb
Instruction ID: 700f715ac8be9d74ff4e9923eba93b49295d174e3bf3eb500676cc98484c3ba1
Opcode Fuzzy Hash: 1f8f90d0c93405f245c6e28c9c070102e81c42d15f52ea049057e8a4fdff6bcb
Instruction Fuzzy Hash: 4641B870200745DBD720AF66C849A2F77D9AB44B13F10092EF94697293DB79DC4C8A6E

Function 0045CB09 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0045C679: __EH_prolog.LIBCMT ref: 0045C67E

GetModuleHandleA.KERNEL32(COMCTL32.DLL,0045CBB9,00000000,?,00000000,?,00459118,?,?,00459B9F,?,?,?,00459B9F,?), ref: 0045CB32
FindResourceA.KERNEL32(00000000,51E800FC,00000005), ref: 0045CB56
LoadResource.KERNEL32(?,00000000,?,00459118,?,?,00459B9F,?,?,?,00459B9F,?), ref: 0045CB60
GlobalAlloc.KERNEL32(00000040,?,?,00459118,?,?,00459B9F,?,?,?,00459B9F,?), ref: 0045CB7E
lstrcpyA.KERNEL32(00000000,?,?,00459118,?,?,00459B9F,?,?,?,00459B9F,?), ref: 0045CB8A

Strings

PRH, xrefs: 0045CB14
COMCTL32.DLL, xrefs: 0045CB2D

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Resource$AllocFindGlobalH_prologHandleLoadModulelstrcpy
String ID: COMCTL32.DLL$PRH
API String ID: 2873249453-3910225594
Opcode ID: 9652763ab29abc54da5b5a2e876ed3a15ae4f7f064f59f1b8d8517a3eef3dae0
Instruction ID: 583d652d788cd64b103c78e33a8f9ef976a52c7c19ea301d5215e51c7902548f
Opcode Fuzzy Hash: 9652763ab29abc54da5b5a2e876ed3a15ae4f7f064f59f1b8d8517a3eef3dae0
Instruction Fuzzy Hash: 17118675500704AFD7105F62EC89E7B77A8EF45762B00842AFD46C72A1DA34DD44C769

Function 00449882 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,004468DE), ref: 0044989D
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,004468DE), ref: 004498B1
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,004468DE), ref: 004498DD
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,004468DE), ref: 00449915
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,004468DE), ref: 00449937
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,004468DE), ref: 00449950
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,004468DE), ref: 00449963
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004499A1

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: b3292558ff180e2b0d11a7dca15f5ac3a0993d9b26b5e16da60fd2ec5182a278
Instruction ID: 2a3d4880afff4fb191ef2fd030393cbeac246ebb7bea17e55ebffad9b4ce5788
Opcode Fuzzy Hash: b3292558ff180e2b0d11a7dca15f5ac3a0993d9b26b5e16da60fd2ec5182a278
Instruction Fuzzy Hash: 6B3138F25082616FF7203F799CC493B769CEA46768715093FF942C3301DA299C45A3AE

Function 004527AB Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 004527CB
lstrcmpA.KERNEL32(?,?), ref: 004527D7
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 004527E9
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0045280C
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00452814
GlobalLock.KERNEL32(00000000), ref: 00452821
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 0045282E
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 0045284C

Part of subcall function 004582F4: GlobalFlags.KERNEL32(?), ref: 004582FE
Part of subcall function 004582F4: GlobalUnlock.KERNEL32(?), ref: 00458315
Part of subcall function 004582F4: GlobalFree.KERNEL32(?), ref: 00458320

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 069c3bafd60a2c41e47fe54d5531a40b6420b5ff857b1e6df0e75553219b0aea
Instruction ID: 50f9f10b6d1f2abd7f7addf3e0cb699295217664b34100745cac7f4410f29db0
Opcode Fuzzy Hash: 069c3bafd60a2c41e47fe54d5531a40b6420b5ff857b1e6df0e75553219b0aea
Instruction Fuzzy Hash: 6311E371500600BAEB21ABB6CD4AEAF7ABDEF81705F10042EFA08C5113DB79ED01D728

Function 00451241 Relevance: 10.6, APIs: 7, Instructions: 140COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,00000000), ref: 00451293
CallWindowProcA.USER32(00000000), ref: 004512B5

Part of subcall function 0044E120: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 0044E146
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E15E
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E16A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Prop$CallProcRemoveWindow
String ID:
API String ID: 2276450057-0
Opcode ID: 2930514d60974a4fe9434182ca6338801401d6968415ae75531059d30f00c42b
Instruction ID: c9c559a4b73dd02660d94846fd9b01b92250e4340c3a6b8665e55215ec00dc4c
Opcode Fuzzy Hash: 2930514d60974a4fe9434182ca6338801401d6968415ae75531059d30f00c42b
Instruction Fuzzy Hash: B031D7766012106BE2019799AC45E9F776CEBD5366F04043BFE05C7252E239990A87BB

Function 0045AA09 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000019F,00000000,00000000), ref: 0045AA2D
GetParent.USER32(?), ref: 0045AA34

Part of subcall function 00456D14: GetWindowLongA.USER32(00000000,000000F0), ref: 00456D20

SendMessageA.USER32(?,00000187,00000000,00000000), ref: 0045AA87
SendMessageA.USER32(?,00000111,?,?), ref: 0045AAD8
SendMessageA.USER32(?,00000185,00000000,00000000), ref: 0045AB63

Strings

, xrefs: 0045AA0A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: MessageSend$LongParentWindow
String ID:
API String ID: 779260966-3916222277
Opcode ID: a26c7ac25dc8cb317ecafe63ef74fd9602cee214648a5c1e44bda1fa0e3807c6
Instruction ID: dc05e6654dcace5e50168eb004c85ac35bfee2bcfdef00d082189895d863d84b
Opcode Fuzzy Hash: a26c7ac25dc8cb317ecafe63ef74fd9602cee214648a5c1e44bda1fa0e3807c6
Instruction Fuzzy Hash: E231C8707103146FCA247A768C44D3F76DDEB44B4AB114A2EFE42D72C3CA2DEC19866A

Function 0045A0E0 Relevance: 10.6, APIs: 7, Instructions: 131windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0045A0E5
SendMessageA.USER32(?,000001A1,?,00000000), ref: 0045A122

Part of subcall function 00456EA3: IsWindowEnabled.USER32(?), ref: 00456EAD

GetSysColor.USER32(00000008), ref: 0045A159
GetSysColor.USER32(00000005), ref: 0045A168
GetSysColor.USER32(0000000E), ref: 0045A188
GetSysColor.USER32(0000000D), ref: 0045A197
DrawFocusRect.USER32(?,?), ref: 0045A242

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Color$DrawEnabledFocusH_prologMessageRectSendWindow
String ID:
API String ID: 338454814-0
Opcode ID: 8bbb38d88341ea49e5dd207e5d9ebc32b5bb2cc3a7adb3f5f4410ed9f4b49c25
Instruction ID: 44261271046533f2b43b390b51872b877eabfbd689529b650b18e0acb6df31e2
Opcode Fuzzy Hash: 8bbb38d88341ea49e5dd207e5d9ebc32b5bb2cc3a7adb3f5f4410ed9f4b49c25
Instruction Fuzzy Hash: E441AD70600605AFDB04DF64C889BAEBBB5BF48306F10862AED4597392CB78D958CF95

Function 0044E200 Relevance: 10.6, APIs: 7, Instructions: 109COMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?), ref: 0044E21D
ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044E26A
ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044E299
SetBkColor.GDI32(?,?), ref: 0044E2B7
ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044E2E2
ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 0044E31C
SetBkColor.GDI32(?,00000000), ref: 0044E324

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Text$Color
String ID:
API String ID: 3751486306-0
Opcode ID: 430047934fa1ee890450ab0ee3858bfb6cccff8bc77f43618346c9b19d7ce5ff
Instruction ID: aa6ef8d3b081ebc78c5bdb76412d51329c27497cf9ca4539dbcf152f6aa073be
Opcode Fuzzy Hash: 430047934fa1ee890450ab0ee3858bfb6cccff8bc77f43618346c9b19d7ce5ff
Instruction Fuzzy Hash: BD416F70644301AFE320DF14DC86F2AB7E4FB85B00F188869FA549B2C1D774E809CB6A

Function 0044E5E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

DjH, xrefs: 0044E643

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID:
String ID: DjH
API String ID: 0-1875359361
Opcode ID: 24505fc770218e36500d0a997682f7db0c18a796312e30a9ac9f3b5d094c7646
Instruction ID: 8dbc6434fd214016bf2a20539dc4ca31f1f876eef12620df58c2b00de6982f80
Opcode Fuzzy Hash: 24505fc770218e36500d0a997682f7db0c18a796312e30a9ac9f3b5d094c7646
Instruction Fuzzy Hash: 8A3180726001108BE3A8EF2DED4971A33A1F791315F13C93EE506A7AA1C37A8845CF1D

Function 00458C3C Relevance: 10.6, APIs: 7, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00458C45
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00458C62
GetFocus.USER32 ref: 00458C74
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00458C84
GetLastActivePopup.USER32(?), ref: 00458CA7
SendMessageA.USER32(00000000,00000365,00000000,00000000), ref: 00458CB7
SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 00458CD6

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastPopup
String ID:
API String ID: 3219385341-0
Opcode ID: 6074c2259d7d6f20f88ee4415e2269e291cc46dfc16c43fc054c126e490ed0cd
Instruction ID: 65bf77bb3fca10cb3b214c45128794493886788594644a91a7f01707161b7b32
Opcode Fuzzy Hash: 6074c2259d7d6f20f88ee4415e2269e291cc46dfc16c43fc054c126e490ed0cd
Instruction Fuzzy Hash: 281186722022087BD6126B71DD89C3F7A6CDB81797711042FFD01A3213DF29EC0A567A

Function 0044FBC0 Relevance: 10.6, APIs: 7, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?), ref: 0044FBD0
GetWindowLongA.USER32(?,000000F0), ref: 0044FBD9
InflateRect.USER32(?,00000001,00000001), ref: 0044FC38
GetParent.USER32(?), ref: 0044FC3F
ScreenToClient.USER32(00000000,?), ref: 0044FC53
ScreenToClient.USER32(00000000,?), ref: 0044FC5B
InvalidateRect.USER32(00000000,?,00000000), ref: 0044FC71

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Rect$ClientScreenWindow$InflateInvalidateLongParent
String ID:
API String ID: 1809568455-0
Opcode ID: 7e29218d984d874019a9a9b17c704a3a65a7578f46dd44b122e8715e901cecf8
Instruction ID: 3e329220eba7502826ee1f454a4ef46d235abcaef2a2a1c4c223e5823c063fb9
Opcode Fuzzy Hash: 7e29218d984d874019a9a9b17c704a3a65a7578f46dd44b122e8715e901cecf8
Instruction Fuzzy Hash: D821473160430AAFE714EEA4D8D4FBB73A9FF84761F00092EF95597291D728D809CB26

Function 004459F1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 00445A2F
GetSystemMetrics.USER32(00000000), ref: 00445A47
GetSystemMetrics.USER32(00000001), ref: 00445A4E
lstrcpyA.KERNEL32(-00000028,DISPLAY,00000028), ref: 00445A72

Strings

B, xrefs: 00445A10
DISPLAY, xrefs: 00445A6C

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: B$DISPLAY
API String ID: 1409579217-3316187204
Opcode ID: 7ce1779621b5bdaf5485de3222eb1d81ff225035a6d4f69c03f487b2d3f2b113
Instruction ID: cb1a3cc462325bad5ec5ad112b9cd7a5d40b75c93c29aa6e017ad07e2646434c
Opcode Fuzzy Hash: 7ce1779621b5bdaf5485de3222eb1d81ff225035a6d4f69c03f487b2d3f2b113
Instruction Fuzzy Hash: 4F110E71600724ABEF119F64DCC0A9BBFA8EF09751B004127FC08AE103D7B5D900CBA9

Function 0044FC80 Relevance: 10.5, APIs: 7, Instructions: 42COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0044FC8D
GetWindowRect.USER32(?,?), ref: 0044FC9B
InflateRect.USER32(?,00000001,00000001), ref: 0044FCAA
GetParent.USER32(?), ref: 0044FCB1
ScreenToClient.USER32(00000000,?), ref: 0044FCC5
ScreenToClient.USER32(00000000,?), ref: 0044FCCD
ValidateRect.USER32(00000000,?), ref: 0044FCE1

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Rect$ClientScreenWindow$InflateLongParentValidate
String ID:
API String ID: 2275295265-0
Opcode ID: 7e1eda5d023dd568fd00bdf09ed67e9ef3acf6c86ae1b31e95ce6af231a49037
Instruction ID: b7c19843ba9a5fec512c4dd0c822a6f8c26b96dead2388d02158e9b13764862a
Opcode Fuzzy Hash: 7e1eda5d023dd568fd00bdf09ed67e9ef3acf6c86ae1b31e95ce6af231a49037
Instruction Fuzzy Hash: C3F06D72000301BFE3019B54DC88DBF37B8EB89722F004579F91992191E734D80A8767

Function 0045714B Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 00457157
GetSysColor.USER32(00000010), ref: 0045715E
GetSysColor.USER32(00000014), ref: 00457165
GetSysColor.USER32(00000012), ref: 0045716C
GetSysColor.USER32(00000006), ref: 00457173
GetSysColorBrush.USER32(0000000F), ref: 00457180
GetSysColorBrush.USER32(00000006), ref: 00457187

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: b82f98f422e048540b0d9802d75b0b7299a817efb6003bf83e6b88dbc82437f4
Instruction ID: 6768d0c464b0b3ac0ffd1b9e1131cc2d91e7d13007f42d0cd2dbd3c615ef5cc4
Opcode Fuzzy Hash: b82f98f422e048540b0d9802d75b0b7299a817efb6003bf83e6b88dbc82437f4
Instruction Fuzzy Hash: 92F0F8719407489BE720BB729D09B47BAE4FFC4B10F02092EE2858BA90E6B5E440DF44

Function 0045AFA6 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 25registrywindowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045AFB3
GetVersion.KERNEL32 ref: 0045AFBE
GetVersion.KERNEL32 ref: 0045AFC6
GetVersion.KERNEL32 ref: 0045AFCC
RegisterWindowMessageA.USER32(MSWHEEL_ROLLMSG), ref: 0045AFD9

Strings

MSWHEEL_ROLLMSG, xrefs: 0045AFD4

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Version$MessageRegisterWindow
String ID: MSWHEEL_ROLLMSG
API String ID: 303823969-2485103130
Opcode ID: 549c368be25b31dcdffd92cec92e9280346d0567c771499ea51e61cb96255844
Instruction ID: 4d12476597aaf63f5de4ac756bc4e5327fdfae0370c8a78838d76e68ec83f894
Opcode Fuzzy Hash: 549c368be25b31dcdffd92cec92e9280346d0567c771499ea51e61cb96255844
Instruction Fuzzy Hash: 11E080B780461656D7912764AC0076A26944B84373F214177DD0153352997C489B8B7F

Function 0044B678 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0046746C,00000001,00000000,?,00000100,00000000,00447FD2,00000001,00000020,00000100,?,00000000), ref: 0044B6B7
GetStringTypeA.KERNEL32(00000000,00000001,00467468,00000001,00000000,?,00000100,00000000,00447FD2,00000001,00000020,00000100,?,00000000), ref: 0044B6D1
GetStringTypeA.KERNEL32(00000000,?,00000100,00000020,00000001,?,00000100,00000000,00447FD2,00000001,00000020,00000100,?,00000000), ref: 0044B705
MultiByteToWideChar.KERNEL32(00447FD2,00000101,00000100,00000020,00000000,00000000,?,00000100,00000000,00447FD2,00000001,00000020,00000100,?,00000000), ref: 0044B73D
MultiByteToWideChar.KERNEL32(00447FD2,00000001,00000100,00000020,?,00000100,?,00000100,00000000,00447FD2,00000001,00000020,00000100,?), ref: 0044B793
GetStringTypeW.KERNEL32(?,?,00000000,00000001,?,00000100,?,00000100,00000000,00447FD2,00000001,00000020,00000100,?), ref: 0044B7A5

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 06fc04ef040910f8f79f839d041fd37d5d7f57e4f59d200660cb6a22a51d0b95
Instruction ID: a47e9cf34e0c02f317f252a143f5328f9bddcade5a9d48ccd31db0373c51acf2
Opcode Fuzzy Hash: 06fc04ef040910f8f79f839d041fd37d5d7f57e4f59d200660cb6a22a51d0b95
Instruction Fuzzy Hash: B0418C75600219AFEF119F94CC85EAF3F68EB09751F10442AF911E6250D338C9509BEA

Function 0045C3EC Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00484E6C,00484E2C,00000000,?,00484E6C,?,0045C654,00484E2C,00000000,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4), ref: 0045C3F7
EnterCriticalSection.KERNEL32(00484E88,00000010,?,00484E6C,?,0045C654,00484E2C,00000000,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4), ref: 0045C446
LeaveCriticalSection.KERNEL32(00484E88,00000000,?,00484E6C,?,0045C654,00484E2C,00000000,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4), ref: 0045C459
LocalAlloc.KERNEL32(00000000,00000004,?,00484E6C,?,0045C654,00484E2C,00000000,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4), ref: 0045C46F
LocalReAlloc.KERNEL32(?,00000004,00000002,?,00484E6C,?,0045C654,00484E2C,00000000,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4), ref: 0045C481
TlsSetValue.KERNEL32(00484E6C,00000000), ref: 0045C4BD

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: e88355d704f4e7011cfbe568c99c04ce8a9dacf05dd0fba6b01952fe5a691730
Instruction ID: 5e0bcb7284746374af975430f0e7b5d1c32eea6fcfd80269ae41fb1f90a347cc
Opcode Fuzzy Hash: e88355d704f4e7011cfbe568c99c04ce8a9dacf05dd0fba6b01952fe5a691730
Instruction Fuzzy Hash: CC319C71100B05EFD724DF25C895F66B7A8FB46356F00852AE81AC7652E738EC09CFA5

Function 00450FD0 Relevance: 9.1, APIs: 6, Instructions: 83windowCOMMON

Download Yara Rule

APIs

PatBlt.GDI32(?,?,?,?,?,00F00021), ref: 00450FF8
GetWindowTextLengthA.USER32(?), ref: 00451002
GetWindowTextA.USER32(?,00000000,00000000), ref: 0045102A
SetTextColor.GDI32(?,00000000), ref: 0045106B
DrawTextA.USER32(?,00000000,000000FF,?,?), ref: 00451083
SetTextColor.GDI32(?,?), ref: 00451095

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Text$ColorWindow$DrawLength
String ID:
API String ID: 1177705772-0
Opcode ID: 9a0358f5430bf4f67fa1ba3122191cc4d3e643214d63ba01e2cba7aa5fddfd41
Instruction ID: f41c9ae1a9354a2db28ee752b7d8aa4d3cd2a0daf88fa0d3b7ceb4dc7ffc750a
Opcode Fuzzy Hash: 9a0358f5430bf4f67fa1ba3122191cc4d3e643214d63ba01e2cba7aa5fddfd41
Instruction Fuzzy Hash: 76218D76600209AFD710DF58DC88EBB77B8EB84722F188129FD15933A2C635ED44CB65

Function 004552BD Relevance: 9.1, APIs: 6, Instructions: 82windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004552C2
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 0045530F
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00455331
GetCapture.USER32 ref: 00455343
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00455352
WinHelpA.USER32(?,?,?,?), ref: 00455366

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: MessageSend$CaptureH_prologHelp
String ID:
API String ID: 432264411-0
Opcode ID: 959bbd9e9a9027a3a0ec82b286e714aa3c2846223432dbaa2c5b289426be75ea
Instruction ID: f20c1a9b3b5470a4893ecba354125f9055336a2690fea5e53fb2a168e56f4bc1
Opcode Fuzzy Hash: 959bbd9e9a9027a3a0ec82b286e714aa3c2846223432dbaa2c5b289426be75ea
Instruction Fuzzy Hash: 2421A171600709BFEB206F65CC8AF7A77A9EF04785F14817DBA01971E3CBB59C089A14

Function 0045866F Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004586A2
GetLastActivePopup.USER32(?), ref: 004586B1
IsWindowEnabled.USER32(?), ref: 004586C6
EnableWindow.USER32(?,00000000), ref: 004586D9
GetWindowLongA.USER32(?,000000F0), ref: 004586EB
GetParent.USER32(?), ref: 004586F9

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 5abb7185847ad048905f5470c1fbda88ac70f99abd59c37c3fbfbc3376f63fd1
Instruction ID: 98893062cd16cca5554cb7c8b222b3c13564cbcc449660ed99e6fd6592b18276
Opcode Fuzzy Hash: 5abb7185847ad048905f5470c1fbda88ac70f99abd59c37c3fbfbc3376f63fd1
Instruction Fuzzy Hash: 9911827260272297D7316A6A8C44B2BB2986F94B53F15012EED00F7347DF68DC0986AE

Function 0045820E Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0045821D
GetWindow.USER32(?,00000005), ref: 0045822E
GetDlgCtrlID.USER32(00000000), ref: 00458237
GetWindowLongA.USER32(00000000,000000F0), ref: 00458246
GetWindowRect.USER32(00000000,?), ref: 00458258
PtInRect.USER32(?,?,?), ref: 00458268

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 2eb3ff082a73497aeddea9306bf482c20ef1f7f0fbfe68b5006fd4256c791410
Instruction ID: c862fca544ec638608f6556b7bdfa1a15e91985fb7deb5b22b8b4d4b826d3903
Opcode Fuzzy Hash: 2eb3ff082a73497aeddea9306bf482c20ef1f7f0fbfe68b5006fd4256c791410
Instruction Fuzzy Hash: 4301A235100615ABDB115B65DC08EEF7B6CEF05302F404176FD12E21A6EF34C91ACB99

Function 00454D5E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 00454E17
GetWindowLongA.USER32(?,000000FC), ref: 00454E28
GetWindowLongA.USER32(?,000000FC), ref: 00454E38
SetWindowLongA.USER32(?,000000FC,?), ref: 00454E54

Strings

(, xrefs: 00454E02

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: 951032c57ce6b570b190293df62e8bb8520d5c1ecd4466d2cf8e18cbfa23c505
Instruction ID: 21c1947cc18818a01e093a68b613681f02dde7b98d34444b58d13f12800ef9ee
Opcode Fuzzy Hash: 951032c57ce6b570b190293df62e8bb8520d5c1ecd4466d2cf8e18cbfa23c505
Instruction Fuzzy Hash: 4531C3316007049FDB20AF65C885A5EB7F4FF8471AF11466EE9419B693CB38E84C8F98

Function 0044FAD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97stringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000010), ref: 0044FB01
lstrcmpA.KERNEL32(00467608,?), ref: 0044FB1A

Strings

$vF, xrefs: 0044FAFC
vF, xrefs: 0044FB28

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ClassNamelstrcmp
String ID: $vF$vF
API String ID: 3770760073-738459937
Opcode ID: b1e097e0f5cdf6367a95c5a31a65ee6a379d3992b588ff1f0e0773483fe0b06f
Instruction ID: 8100cabb1a35eb0160872ae59893a99333c8acfb13458d1b0b7273885cd1b27c
Opcode Fuzzy Hash: b1e097e0f5cdf6367a95c5a31a65ee6a379d3992b588ff1f0e0773483fe0b06f
Instruction Fuzzy Hash: D021E7B67142145FF710AB58EC45CBB335CEA85325F4409BBF915C2221F62AA51D82A6

Function 0045CC71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 0045CCA2

Part of subcall function 0045CD8E: lstrlenA.KERNEL32(00000104,00000000,?,0045CCD2), ref: 0045CDC5

lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0045CD43
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0045CD70

Strings

.INI, xrefs: 0045CD6A
.HLP, xrefs: 0045CD3D

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: FileModuleNamelstrcatlstrcpylstrlen
String ID: .HLP$.INI
API String ID: 2421895198-3011182340
Opcode ID: ec02cb1e9e616b0f0f0f2c6b02e269c5bd88a7e7fdd51a2c504925cee9a5bbef
Instruction ID: 7b523a5cf4c6f84a9be146c96d921cc908aa6168115fd5c69af64c1df258cdc6
Opcode Fuzzy Hash: ec02cb1e9e616b0f0f0f2c6b02e269c5bd88a7e7fdd51a2c504925cee9a5bbef
Instruction Fuzzy Hash: 663181B6404708AFDB21DF75D884BC6B7F8AB04305F1049BBE599D3152EB78A9888F54

Function 0045B477 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 0045B483
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 0045B532
LoadBitmapA.USER32(00000000,00007FE3), ref: 0045B54A

Strings

, xrefs: 0045B492
|SF, xrefs: 0045B503

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
String ID: $|SF
API String ID: 2596413745-2071042934
Opcode ID: 81be6982dc507e0235c9395d11210e398c159e5065f3d83f88612e8ef9b7ca03
Instruction ID: 8a707a000dd98248e43aeee05436efa862ba98229a4d92996eabc47a3b711e10
Opcode Fuzzy Hash: 81be6982dc507e0235c9395d11210e398c159e5065f3d83f88612e8ef9b7ca03
Instruction Fuzzy Hash: F2210A71E00319AFEB10CB78DC85BAE7BB8EB44715F0545B6E905EB2C3D7749A088B94

Function 00446848 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0044686E

Part of subcall function 00449B70: HeapCreate.KERNELBASE(00000000,00001000,00000000,004468A6,00000001), ref: 00449B81
Part of subcall function 00449B70: HeapDestroy.KERNEL32 ref: 00449B9F

GetCommandLineA.KERNEL32 ref: 004468CE
GetStartupInfoA.KERNEL32(?), ref: 004468F9
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0044691C

Part of subcall function 00446975: ExitProcess.KERNEL32 ref: 00446992

Strings

X'N, xrefs: 004468D4

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID: X'N
API String ID: 2057626494-3595532520
Opcode ID: 57b90c5321c01e1555b8e797171603c44826d9ab7960472cd091431f0f65c8ce
Instruction ID: 31e782ecb260f3c8a28d1ab5f1785e9cac55f411158fd523cb42c6ac5d24599c
Opcode Fuzzy Hash: 57b90c5321c01e1555b8e797171603c44826d9ab7960472cd091431f0f65c8ce
Instruction Fuzzy Hash: 642185B1940704AFFB04AFA5DC06A6E7BB8EB45705F10052FF5059B2A1DF788C40DB59

Function 00453300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 00453341
GetDlgItem.USER32(?,00000002), ref: 00453360
IsWindowEnabled.USER32(00000000), ref: 0045336B
SendMessageA.USER32(00000000,00000111,00000002,00000000), ref: 00453381

Strings

Edit, xrefs: 0045334B

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$EnabledItemLongMessageSend
String ID: Edit
API String ID: 3499652902-554135844
Opcode ID: d89d93a26a7f05e5220dcfbd61c7f866cd0a978dbd3ff35e9c24465512cfcadf
Instruction ID: 737ef2495f03e9a17fd55647b0e6f7d335fe3de496c40b6eef516f4fe40ac575
Opcode Fuzzy Hash: d89d93a26a7f05e5220dcfbd61c7f866cd0a978dbd3ff35e9c24465512cfcadf
Instruction Fuzzy Hash: A001C430200301AAEB202E258C09B6FEA94AB40797F60452FFC01E62F3CF6CDA59C55D

Function 0044EA71 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0044EA93
GetWindow.USER32(00000000,00000005), ref: 0044EAAF
GetWindow.USER32(00000000,00000002), ref: 0044EAC5
GetWindow.USER32(00000000,00000002), ref: 0044EAD0

Strings

iH, xrefs: 0044EA71

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window
String ID: iH
API String ID: 2353593579-671714768
Opcode ID: 9ea8b6c9fcd9a527d7b6f020c392c45934ec63dee5248b6ac29361610f1db3f3
Instruction ID: d16641cf0922139ce98d30a59fb1e5a87a174807cc6a51a1ae692f573ce6f487
Opcode Fuzzy Hash: 9ea8b6c9fcd9a527d7b6f020c392c45934ec63dee5248b6ac29361610f1db3f3
Instruction Fuzzy Hash: 41F0C8A734070532E221B16B2CC6F6FB79CABE1B51F54043BF600A6283FD99D815422D

Function 0044EB61 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0044EB95
GetWindowLongA.USER32(?,000000F0), ref: 0044EBA2
SetTextColor.GDI32(?,00000000), ref: 0044EBBF
SetBkColor.GDI32(?,00000000), ref: 0044EBCD

Strings

iH, xrefs: 0044EB61

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ColorWindow$LongText
String ID: iH
API String ID: 3945788684-671714768
Opcode ID: 784e3b3f7e82907916225a9c6afd95eed788538ed7268f3e1624d5d3300f78d0
Instruction ID: a2982971148418fa05cd0e76e475995fef10c7f182eee413fa034086a32c8f92
Opcode Fuzzy Hash: 784e3b3f7e82907916225a9c6afd95eed788538ed7268f3e1624d5d3300f78d0
Instruction Fuzzy Hash: B601DE362092908BEB60D725AC48D9F7754F792321B054C7BF542D2291D628E986876E

Function 004499B4 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00449A12
GetFileType.KERNEL32(?,?,00000000), ref: 00449ABD
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00449B20
GetFileType.KERNEL32(00000000,?,00000000), ref: 00449B2E
SetHandleCount.KERNEL32 ref: 00449B65

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 10f7a34f89d25c0276b527fbfa3fc386474ba43181868b7c8d9e31d87257ea86
Instruction ID: c93d299871968292d968e08d8d090304554857a9e6fa4dc361f4cc84b9032bbc
Opcode Fuzzy Hash: 10f7a34f89d25c0276b527fbfa3fc386474ba43181868b7c8d9e31d87257ea86
Instruction Fuzzy Hash: AC51F8715042818FEB10CF28D88876B77E0FB11328F29466ED596AB2D1D738DC05E759

Function 004551D6 Relevance: 7.6, APIs: 5, Instructions: 52stringregistryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004551DB
GetClassInfoA.USER32(?,?,?), ref: 004551F6
RegisterClassA.USER32(00000004), ref: 00455201
lstrcatA.KERNEL32(00000034,?,00000001), ref: 00455238
lstrcatA.KERNEL32(00000034,?), ref: 00455246

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Classlstrcat$H_prologInfoRegister
String ID:
API String ID: 106226465-0
Opcode ID: 1b400a5d402ebb0615891c03d7c62ac55957928c88af3c551a9f640050bdfb35
Instruction ID: 045e7567eb7a0e8624655e238e4eb87d7ae917a33e3e1d2d79e6ab7a173c4d3d
Opcode Fuzzy Hash: 1b400a5d402ebb0615891c03d7c62ac55957928c88af3c551a9f640050bdfb35
Instruction Fuzzy Hash: FF110C76900304BFD710AF64DC41A9E7BB8EF05715F0045ABFC05A7153C375D6099B59

Function 00448C43 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,004493B7,00000000,?,?,?,00446942,?,?,00000000,00000000), ref: 00448C45
TlsGetValue.KERNEL32(?,00000000,004493B7,00000000,?,?,?,00446942,?,?,00000000,00000000), ref: 00448C53
SetLastError.KERNEL32(00000000,?,00000000,004493B7,00000000,?,?,?,00446942,?,?,00000000,00000000), ref: 00448C9F

Part of subcall function 0044A916: HeapAlloc.KERNEL32(00000008,?,?,?,?,00448BFB,00000001,00000074,?,004468B8), ref: 0044A96B

TlsSetValue.KERNEL32(00000000,?,00000000,004493B7,00000000,?,?,?,00446942,?,?,00000000,00000000), ref: 00448C77
GetCurrentThreadId.KERNEL32 ref: 00448C88

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: c578e14be505be8b04a593cba1388d9f3855f724a3e76ce9984da2ee61447bfb
Instruction ID: c2cb04aa9fb85632d2e288068d8adf68535442758467a6373e1eddb41ff30d49
Opcode Fuzzy Hash: c578e14be505be8b04a593cba1388d9f3855f724a3e76ce9984da2ee61447bfb
Instruction Fuzzy Hash: 2BF09632902B11ABE7312F70EE4961E3A50AF057B2711057EF649A62D1DF68CC41866A

Function 0045C226 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(00000000,?,?,0045C733,00000000,00000001), ref: 0045C232
GlobalHandle.KERNEL32(004F2990), ref: 0045C25A
GlobalUnlock.KERNEL32(00000000), ref: 0045C263
GlobalFree.KERNEL32(00000000), ref: 0045C26A
DeleteCriticalSection.KERNEL32(00484E50,?,?,0045C733,00000000,00000001), ref: 0045C274

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Global$Free$CriticalDeleteHandleSectionUnlock
String ID:
API String ID: 2159622880-0
Opcode ID: cb6dd7b65f104f1a5de6956517ff886244e02a773499e6e7fad95545452a54db
Instruction ID: 36aad5cafefc9a3075fdbe8aaefcb4cfacf86059b2e92811cc635aa3f84ab009
Opcode Fuzzy Hash: cb6dd7b65f104f1a5de6956517ff886244e02a773499e6e7fad95545452a54db
Instruction Fuzzy Hash: 8BF0B4356007009FD6209B78EC88A2B76ACAF85713B15017AFC55D7352CB34DC0A86AA

Function 0045936A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00455A54: GetDlgCtrlID.USER32 ref: 00455A65

GetParent.USER32(?), ref: 00459397
GetParent.USER32(?), ref: 004593BD
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 004594A3

Strings

pfF, xrefs: 004593C6

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Parent$CtrlMessageSend
String ID: pfF
API String ID: 478998718-128489926
Opcode ID: 56ff2378c3abcd52b7e8f5eb38c79e7ac89dd938b8f233161059c26f7d266ab1
Instruction ID: 2c5c266bbd89ce17b198446332db6f13211b3b13fe86ca1922dbd76eda0f9856
Opcode Fuzzy Hash: 56ff2378c3abcd52b7e8f5eb38c79e7ac89dd938b8f233161059c26f7d266ab1
Instruction Fuzzy Hash: 3531A230308205DFDB105F64D849E6E73A9AF59716F20446AFD56CB2D2CB399C0A8B99

Function 0045773E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 0045775A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 004577AD
GlobalUnlock.KERNEL32(?), ref: 00457844

Strings

System, xrefs: 00457744

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Global$ByteCharLockMultiUnlockWide
String ID: System
API String ID: 231414890-3470857405
Opcode ID: 0904d1f6f09a1139863621877f3405626eb5198cf4fd1309eec62aef69507732
Instruction ID: 17947315b98e569a80136a266303467a07a9156ddbb54b14e5cd40f7152ecbd6
Opcode Fuzzy Hash: 0904d1f6f09a1139863621877f3405626eb5198cf4fd1309eec62aef69507732
Instruction Fuzzy Hash: 2A412976804215EFDB10DFA4E8819AEBBB4FF04355F20C17AEC159B246D334AA4ACF58

Function 0044C51A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00486648), ref: 0044C540
InterlockedDecrement.KERNEL32(00486648), ref: 0044C555

Strings

HfH, xrefs: 0044C539

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: HfH
API String ID: 2172605799-3395813609
Opcode ID: dfae8396305e1f720c3396fb5c9e4bf70f563b17f3d8aa01f60969e488181996
Instruction ID: 8481decabe9385dd68b9315b0d21b0ecdb0ff5bb5e76252472fa535241b88341
Opcode Fuzzy Hash: dfae8396305e1f720c3396fb5c9e4bf70f563b17f3d8aa01f60969e488181996
Instruction Fuzzy Hash: BFF0C872503761ABF760AF65ACC194F6358EF81755F18083FF100D5151C778ED41966D

Function 0044B883 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00486648), ref: 0044B8A9
InterlockedDecrement.KERNEL32(00486648), ref: 0044B8BE

Strings

HfH, xrefs: 0044B8A2

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: HfH
API String ID: 2172605799-3395813609
Opcode ID: e94a8e04219682cb1a8aa36e9d8efb7c1c4cf8d368a1c645589b7ace32656d82
Instruction ID: b7433846ccfb6046c671f62af97ff66561373ace2af40a33bc2205eebbb9c7ab
Opcode Fuzzy Hash: e94a8e04219682cb1a8aa36e9d8efb7c1c4cf8d368a1c645589b7ace32656d82
Instruction Fuzzy Hash: C9F0A9721013019BF720BF6AEC8294B639CEF91316F20083FF100D5291CB68DD86A6AE

Function 0044CE53 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00486648), ref: 0044CE5F
InterlockedDecrement.KERNEL32(00486648), ref: 0044CE76

Part of subcall function 00449D61: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0044A94C,00000009,?,?,?,00448BFB,00000001,00000074,?,004468B8), ref: 00449D9E
Part of subcall function 00449D61: EnterCriticalSection.KERNEL32(?,?,?,0044A94C,00000009,?,?,?,00448BFB,00000001,00000074,?,004468B8), ref: 00449DB9

InterlockedDecrement.KERNEL32(00486648), ref: 0044CEA2

Strings

HfH, xrefs: 0044CE58

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Interlocked$CriticalDecrementSection$EnterIncrementInitialize
String ID: HfH
API String ID: 2038102319-3395813609
Opcode ID: d008e868df8238eb06fb1f96f7db9d1fd18462d9d24a9da823e135b0834c03a2
Instruction ID: d912916ba0858e41861d8b92124c2d262c6abad5cf5d5d6e972e20c73260c364
Opcode Fuzzy Hash: d008e868df8238eb06fb1f96f7db9d1fd18462d9d24a9da823e135b0834c03a2
Instruction Fuzzy Hash: 01F0BE32102209AEFB102F96EC8198F7758DF85329B24803FFA04591518B7A8E029A69

Function 00458199 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27stringCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 004581AA
GetClassNameA.USER32(00000000,?,0000000A), ref: 004581C5
lstrcmpiA.KERNEL32(?,combobox), ref: 004581D4

Strings

combobox, xrefs: 004581CE

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ClassLongNameWindowlstrcmpi
String ID: combobox
API String ID: 2054663530-2240613097
Opcode ID: b0b816f5a53bcb7331ff24a482828b79b87d2b19e87be3cc0b901a6a141aca87
Instruction ID: adf1c15f529c3279ce3f4ecf9fe0a5a20f6cb63b383380f27c2162b5e4d2c279
Opcode Fuzzy Hash: b0b816f5a53bcb7331ff24a482828b79b87d2b19e87be3cc0b901a6a141aca87
Instruction Fuzzy Hash: BCE06535654209BBCF116F60DC4AA5E3768A705343F108531FC16E5191DF34D549875A

Function 00448DB1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00446376), ref: 00448DB6
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00448DC6

Strings

IsProcessorFeaturePresent, xrefs: 00448DC0
KERNEL32, xrefs: 00448DB1

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 746c5ac73a99b88ffec6b0d368a65c737497fd777897e10702cc42876ae05332
Instruction ID: 9d5e2538847efef907d675037dd5aa8011663000a5980d645d0ba85e3d76f014
Opcode Fuzzy Hash: 746c5ac73a99b88ffec6b0d368a65c737497fd777897e10702cc42876ae05332
Instruction Fuzzy Hash: 34C08090B85701A6FB101B704C4DF1F35640B10B13F14007B7402D02C4FE5CC900502F

Function 0044CAFB Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000108,00000000,00000001,?,?), ref: 0044CBC2

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f710dbbbddebecf5e14c0372aeb00d2bc787fabcf263efde4c7ebb7c8effb1a1
Instruction ID: dafe0882485206c9d108d31603713a44860ce15c590c4c632c4fce39c5ee2dfb
Opcode Fuzzy Hash: f710dbbbddebecf5e14c0372aeb00d2bc787fabcf263efde4c7ebb7c8effb1a1
Instruction Fuzzy Hash: DA51D571901248EFEB51CF68C8C5A9E7BB4FF41340F2881ABE819DB251D734DA41CB59

Function 00450BA0 Relevance: 6.1, APIs: 4, Instructions: 131COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,00000000), ref: 00450BE6
CallWindowProcA.USER32(00000000), ref: 00450C11

Part of subcall function 0044E120: CallWindowProcA.USER32(00000000,?,?,?,?), ref: 0044E146
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E15E
Part of subcall function 0044E120: RemovePropA.USER32(?,00000000), ref: 0044E16A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Prop$CallProcRemoveWindow
String ID:
API String ID: 2276450057-0
Opcode ID: 3500b8d814c6a2c7979aa12b6edd02703451e01eb66768eb6e55b5ae53a59f96
Instruction ID: e1e0f6583abb9198a400ce09fbec8b1fc6f829ff40b8a650b12bc06beca60701
Opcode Fuzzy Hash: 3500b8d814c6a2c7979aa12b6edd02703451e01eb66768eb6e55b5ae53a59f96
Instruction Fuzzy Hash: 1731097AA0070457D6259A09FC859AF7398FB87327F44063BFD0593243D72DA94D826F

Function 004584F7 Relevance: 6.1, APIs: 4, Instructions: 87windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0045866F: GetParent.USER32(?), ref: 004586A2
Part of subcall function 0045866F: GetLastActivePopup.USER32(?), ref: 004586B1
Part of subcall function 0045866F: IsWindowEnabled.USER32(?), ref: 004586C6
Part of subcall function 0045866F: EnableWindow.USER32(?,00000000), ref: 004586D9

SendMessageA.USER32(?,00000376,00000000,00000000), ref: 0045852D
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000,00000000,?), ref: 0045859B
MessageBoxA.USER32(?,?,?,?), ref: 004585A9
EnableWindow.USER32(00000000,00000001), ref: 004585C5

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$EnableMessage$ActiveEnabledFileLastModuleNameParentPopupSend
String ID:
API String ID: 1958756768-0
Opcode ID: 9db504ace6b8c0ba2d245f74dd9de871bf8237cbea2887079c629b1e034f77ee
Instruction ID: a8a4fc3eaa43955be28a332d267dca651f096c5473f24f2903ba6b81da32258b
Opcode Fuzzy Hash: 9db504ace6b8c0ba2d245f74dd9de871bf8237cbea2887079c629b1e034f77ee
Instruction Fuzzy Hash: 7521847290021DBBDB209F94CC81AAEB7B9EB04742F14047EE915F7252EF749D488B55

Function 0044E9C0 Relevance: 6.1, APIs: 4, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetPropA.USER32(?,00000000), ref: 0044E9FD
SendMessageA.USER32(?,00001944,00000000,?), ref: 0044EA22
SendMessageA.USER32(?,00001943,00000000,?), ref: 0044EA37
RemovePropA.USER32(?,00000000), ref: 0044EA4D

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: MessagePropSend$Remove
String ID:
API String ID: 2793251306-0
Opcode ID: be75cc786e75667fdbc42011a7121e7277911163dd5f8303a7d4564c3ddd784f
Instruction ID: d1e6a14a0802acb91a6809bdc800c0cc3379bacf0ecc976b2ddf8af856f6cac0
Opcode Fuzzy Hash: be75cc786e75667fdbc42011a7121e7277911163dd5f8303a7d4564c3ddd784f
Instruction Fuzzy Hash: DB1177B56003116AF200AB15AC05FBF7358FB85765F004439FD5592281E27C990A8BBF

Function 0044E030 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(00000000,?,?,?), ref: 0044E04B
UnhookWindowsHookEx.USER32(00000000), ref: 0044E064
GetWindowLongA.USER32(?,000000F0), ref: 0044E07B
SendMessageA.USER32(00000001,000011F0,00000000,00000001), ref: 0044E0A5

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Hook$CallLongMessageNextSendUnhookWindowWindows
String ID:
API String ID: 4187046592-0
Opcode ID: 3302cdf68d1cd0736dcdeb9e4740fc1d62dbd917a8cf5f7e0b1b25d073cdfaa1
Instruction ID: ce796089d7245919357ac611034a1b4b1b9192b2176c11225935cdbb7b56c542
Opcode Fuzzy Hash: 3302cdf68d1cd0736dcdeb9e4740fc1d62dbd917a8cf5f7e0b1b25d073cdfaa1
Instruction Fuzzy Hash: A91107B5600700AFE314DF19E848E5B7BE9BB88351F50893DF959D32A0E774E844CB5A

Function 0044E510 Relevance: 6.1, APIs: 4, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0044E516
EnterCriticalSection.KERNEL32(004869C0), ref: 0044E523
UnhookWindowsHookEx.USER32(?), ref: 0044E566
LeaveCriticalSection.KERNEL32(004869C0), ref: 0044E5AB

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalSection$CurrentEnterHookLeaveThreadUnhookWindows
String ID:
API String ID: 1197249173-0
Opcode ID: 02fff41e51cb16e7047f087b089b71e0f3235e3f25a40252e412b15ccfd6bffc
Instruction ID: 7566153b7af60f9babedc6225006cf6a0c2c8fb152290c1b6cb9e62aebcde72e
Opcode Fuzzy Hash: 02fff41e51cb16e7047f087b089b71e0f3235e3f25a40252e412b15ccfd6bffc
Instruction Fuzzy Hash: 57118F721006049FE360AFA9ED4466F37A5FB01306F028C3BE50697951E736A854CF58

Function 00459203 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000005), ref: 00459221
LoadResource.KERNEL32(?,00000000,?,00459B9F,?,?,0045DA36,000000FF,?,0040544F,Options,00000000,00000000), ref: 0045922B
LockResource.KERNEL32(00000000,?,00459B9F,?,?,0045DA36,000000FF,?,0040544F,Options,00000000,00000000), ref: 00459232
GlobalFree.KERNEL32(?), ref: 00459266

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Resource$FindFreeGlobalLoadLock
String ID:
API String ID: 3898064442-0
Opcode ID: 138fa318ada80ed4d969c9857b35368f2981e21bd80c57c3c1685fa579b82c26
Instruction ID: 8259d1026734a5c98cec335c69c3e419057c79747e18e2273f24bc4e32fc83f2
Opcode Fuzzy Hash: 138fa318ada80ed4d969c9857b35368f2981e21bd80c57c3c1685fa579b82c26
Instruction Fuzzy Hash: 4D113C31200701FFDB109BA5D888A57BBE8AB08366F04846AFA5A86662D775EC58CB54

Function 00451E26 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WindowFromPoint.USER32(?,?), ref: 00451E3E
GetParent.USER32(00000000), ref: 00451E4B
ScreenToClient.USER32(00000000,?), ref: 00451E6C
IsWindowEnabled.USER32(00000000), ref: 00451E85

Part of subcall function 00458199: GetWindowLongA.USER32(00000000,000000F0), ref: 004581AA

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$ClientEnabledFromLongParentPointScreen
String ID:
API String ID: 2204725058-0
Opcode ID: 68be2cb5d201b1680685a3f932c1f2bf62d40358be3145194102c47f8e9a620e
Instruction ID: d811637cbedc71064c6a1053cdf43ec493c14be2e09e138e69b8d91d2768b4b9
Opcode Fuzzy Hash: 68be2cb5d201b1680685a3f932c1f2bf62d40358be3145194102c47f8e9a620e
Instruction Fuzzy Hash: D4018476600A04BB87125B69DC05E7FBAB9AF89B42B14407AFD05D7322DB34CD098759

Function 00455BEC Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00455BF7
GetTopWindow.USER32(00000000), ref: 00455C0A
GetTopWindow.USER32(?), ref: 00455C3A
GetWindow.USER32(00000000,00000002), ref: 00455C55

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 74859cb0b7930ab71f09b6365b5fbe7b93a2f03efe5b9124e6d1f3ae3f9edcc1
Instruction ID: 71054cff417c6b186497c2a16514dd6dacc0f7306127e340783df21b2c9176cf
Opcode Fuzzy Hash: 74859cb0b7930ab71f09b6365b5fbe7b93a2f03efe5b9124e6d1f3ae3f9edcc1
Instruction Fuzzy Hash: 5401A232101B19B7CF232FA18D14FBF3B989F51396F054026FD1095223D739C9199AAD

Function 00455C65 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00455C73
SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00455CA9
GetTopWindow.USER32(00000000), ref: 00455CB6
GetWindow.USER32(00000000,00000002), ref: 00455CD4

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$MessageSend
String ID:
API String ID: 1496643700-0
Opcode ID: 83e7080c94eeaa78e0da3e2f000964efb2c51a30a372f56b5641a872a232ec2c
Instruction ID: ff574306b593f6f1813472f8f42b3db0e305bd24733fecdda7b19a66a3132ca9
Opcode Fuzzy Hash: 83e7080c94eeaa78e0da3e2f000964efb2c51a30a372f56b5641a872a232ec2c
Instruction Fuzzy Hash: 5B014C3200061ABBCF135F95DD04EEF3B29AF45352F144026FE0195122C73AC96AEBAA

Function 00453121 Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 00453149
GetFocus.USER32 ref: 0045315C
GetParent.USER32(?), ref: 0045316A
GetNextDlgTabItem.USER32(?,?,00000000), ref: 00453186

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Item$EnableFocusMenuNextParent
String ID:
API String ID: 988757621-0
Opcode ID: 55d879d9cccdcc970db3387cd405d36e294a6b4a454a24d4a224764bd3ba7893
Instruction ID: 95f0ae98580645c6dcd204a9222a7a5d939300ff6f7a762cb757841e5680666d
Opcode Fuzzy Hash: 55d879d9cccdcc970db3387cd405d36e294a6b4a454a24d4a224764bd3ba7893
Instruction Fuzzy Hash: 5311A571100B009BDB289F30DC59B27B7B5EF40357F10462EF956476A2C738E849CB59

Function 0044E750 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0044E756
EnterCriticalSection.KERNEL32(004869C0), ref: 0044E763
UnhookWindowsHookEx.USER32(?), ref: 0044E79A
LeaveCriticalSection.KERNEL32(004869C0), ref: 0044E7D9

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalSection$CurrentEnterHookLeaveThreadUnhookWindows
String ID:
API String ID: 1197249173-0
Opcode ID: 4ea7ca517efe5f1c239fee7f040888953e7afeace8f38304937a3ae160377b9c
Instruction ID: 17ed6b75d534075faf2bd657ece35fdb3ff81aa8c7563eccaa417138a8097c07
Opcode Fuzzy Hash: 4ea7ca517efe5f1c239fee7f040888953e7afeace8f38304937a3ae160377b9c
Instruction Fuzzy Hash: 0101C0321006088FD360AF6AED84B6A33A4F701312F028C3AF50697911E736A8148F58

Function 00456299 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,0000000C,?), ref: 004562D7
SetBkColor.GDI32(00000000,00000000), ref: 004562E3
GetSysColor.USER32(00000008), ref: 004562F3
SetTextColor.GDI32(00000000,?), ref: 004562FD

Part of subcall function 00458199: GetWindowLongA.USER32(00000000,000000F0), ref: 004581AA

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Color$LongObjectTextWindow
String ID:
API String ID: 2871169696-0
Opcode ID: 7a0bd4e41a6a6d83b061f305f1f32cfd1cea0eef52f6dc8650b360a4918c767d
Instruction ID: 4a4d7756b2a169ec345dadbe210ea9c204f115ad00d305e2c8f72d01e7a40e7c
Opcode Fuzzy Hash: 7a0bd4e41a6a6d83b061f305f1f32cfd1cea0eef52f6dc8650b360a4918c767d
Instruction Fuzzy Hash: D7014B30100309ABDF615F64DC49AAF3B65AB00762F954522FD02D61E3CB78D99CCB5A

Function 0044411B Relevance: 6.0, APIs: 4, Instructions: 37registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,80000000,00000000,00000001,?), ref: 0044413A
RegQueryValueA.ADVAPI32(?,00000000,?,00000104), ref: 00444167
lstrcpyA.KERNEL32(004443D7,?), ref: 00444178
RegCloseKey.ADVAPI32(?), ref: 00444182

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CloseOpenQueryValuelstrcpy
String ID:
API String ID: 534897748-0
Opcode ID: aac25e3ad50ad51bd91bdf64e720bfae32ada970b23fa056b136235924896c35
Instruction ID: 0be568a99d572359911d6cbdfdbd943521631dd326f2f2a70c68724549109f26
Opcode Fuzzy Hash: aac25e3ad50ad51bd91bdf64e720bfae32ada970b23fa056b136235924896c35
Instruction Fuzzy Hash: D001EC7990020CEBDB14DF90DC85FEEB778AB48711F0085A9AA0597281D6749A89DFA1

Function 00458283 Relevance: 6.0, APIs: 4, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00458C18,?), ref: 00458290
GetWindowTextA.USER32(00000000,?,00000100), ref: 004582AC
lstrcmpA.KERNEL32(?,00458C18), ref: 004582C0
SetWindowTextA.USER32(00000000,00458C18), ref: 004582D0

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: 9ffe68257827fb8fe416e4638dd97950f30d5a909f4ddbc3c3ea2dab918feda8
Instruction ID: fc5cb885d51bf257b262d6afab8d580395231c4d8915b7dbda408f981f2d6571
Opcode Fuzzy Hash: 9ffe68257827fb8fe416e4638dd97950f30d5a909f4ddbc3c3ea2dab918feda8
Instruction Fuzzy Hash: 2AF082B9500118BBCF226F60DC08ADE7F68FB18392F0080B1FC46E2161DB75C9598B99

Function 00447CE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00449D61: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0044A94C,00000009,?,?,?,00448BFB,00000001,00000074,?,004468B8), ref: 00449D9E
Part of subcall function 00449D61: EnterCriticalSection.KERNEL32(?,?,?,0044A94C,00000009,?,?,?,00448BFB,00000001,00000074,?,004468B8), ref: 00449DB9

GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,004468E8), ref: 00447D31

Part of subcall function 00449DC2: LeaveCriticalSection.KERNEL32(?,004478E3,00000009,?,00000009,00000000,?,004478A3,000000E0,00447890,?,00449D81,00000018,00000000,?), ref: 00449DCF

Strings

`"H, xrefs: 00447D25
p!H, xrefs: 00447D18

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: `"H$p!H
API String ID: 1866836854-3137644630
Opcode ID: 47ea538de3513f4e2864953190bcc365222c5e8dd4a2a5187cda664894383772
Instruction ID: 2ef6b1c74d0fa5fb8c03ee6c831c18cf36cc25a28ec31f3a4bc5797bdeb8cc81
Opcode Fuzzy Hash: 47ea538de3513f4e2864953190bcc365222c5e8dd4a2a5187cda664894383772
Instruction Fuzzy Hash: 454130B191C2409EFB51DB74D88437E7BE09F04719F3549AFE2898A292C77D4C86878D

Function 0044F240 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000000), ref: 0044F271

Strings

$jH, xrefs: 0044F361

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Color
String ID: $jH
API String ID: 2811717613-655392161
Opcode ID: 5497d61591c8d0864669fa11e9d44682eed6d9a1957b779e4e6b8bc9ccf318f2
Instruction ID: b2b72fe96b04069a1b453e5e17e9a52a5b298b85c6d7c49115aa3ff0e0814017
Opcode Fuzzy Hash: 5497d61591c8d0864669fa11e9d44682eed6d9a1957b779e4e6b8bc9ccf318f2
Instruction Fuzzy Hash: 3141B07A6083009BE714DF29E84066BB7E4FBC4314F84893EF98893250D379D84ECB56

Function 00447F33 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00447F47

Strings

, xrefs: 00447F90
, xrefs: 00447F6C

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 1cf2bf554c8011b1e17e1831ec7bbcf9395ee30d9d1d15e5ae04f675cd80f2ce
Instruction ID: a23dbbd77fd61b4427a3d8ae072150f254234d3fdc0dba7f5a23efa459c9b82f
Opcode Fuzzy Hash: 1cf2bf554c8011b1e17e1831ec7bbcf9395ee30d9d1d15e5ae04f675cd80f2ce
Instruction Fuzzy Hash: D24147311042585EFF129724CD49BFF3FD9DB02704F1608EAE589C7293CA694988C7AA

Function 00443197 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00458F61: __EH_prolog.LIBCMT ref: 00458F66

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 004431D2
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 004431E4

Part of subcall function 00453EEE: lstrlenA.KERNEL32(?,?,?,0040218C,0048323C,-00000309,00000010,00000016,00401D80,00401DA0,-000002B9,00000004,00000014,Function_00001DF0,00453DF5,-00000269), ref: 00453EFF

Strings

leration, xrefs: 00443272

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::$H_prologlstrlen
String ID: leration
API String ID: 2021088600-845416379
Opcode ID: df5ff5b2b4e0b89d2f099b25a662a88aff3fd7f9df338edac7f19523d2598d0b
Instruction ID: ab4e1e42f26e6d53577dbd998897a5daa6e005dae180c36d3b08b3ee997ec27d
Opcode Fuzzy Hash: df5ff5b2b4e0b89d2f099b25a662a88aff3fd7f9df338edac7f19523d2598d0b
Instruction Fuzzy Hash: 0A315CB0A40249EBEB14DB98CC56BAEB771FF41708F14456DE6112B3C2CBB91604C799

Function 00449635 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Convert.exe,00000104,?,00000000,?,?,?,?,004468E8), ref: 00449658

Strings

C:\Users\user\Desktop\Convert.exe, xrefs: 0044964C, 00449656, 0044967B, 004496B1
X'N, xrefs: 0044965E

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: FileModuleName
String ID: C:\Users\user\Desktop\Convert.exe$X'N
API String ID: 514040917-1225163981
Opcode ID: cccded4e98959345a003e56c9c083b7dde57060ed6cc8f09d1e8f29990886825
Instruction ID: 7d257add516cd09f664d1a238d62f1144ae973b114c9b134ecb58b6bda9e4f56
Opcode Fuzzy Hash: cccded4e98959345a003e56c9c083b7dde57060ed6cc8f09d1e8f29990886825
Instruction Fuzzy Hash: 53115EB6900218BFE711EB95DC81CAF7BACEB05358B0204AFF50597211EA749E449BA9

Function 0045A66D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0045A672

Part of subcall function 0045C679: __EH_prolog.LIBCMT ref: 0045C67E

Part of subcall function 00456D14: GetWindowLongA.USER32(00000000,000000F0), ref: 00456D20

Part of subcall function 00457EBC: __EH_prolog.LIBCMT ref: 00457EC1
Part of subcall function 00457EBC: GetDC.USER32(?), ref: 00457EEA

Part of subcall function 00444770: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 00444784

Part of subcall function 00457B90: SelectObject.GDI32(?,00000000), ref: 00457BB2
Part of subcall function 00457B90: SelectObject.GDI32(?,00000000), ref: 00457BC8

GetTextMetricsA.GDI32(?,?), ref: 0045A6C4

Strings

`NH, xrefs: 0045A683

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: H_prolog$ObjectSelect$LongMessageMetricsSendTextWindow
String ID: `NH
API String ID: 2410843227-2708191515
Opcode ID: 1f597b3c1714061f587612e37637dd542d30a42a7441af5f7abd66e8f08f72cb
Instruction ID: 6fd32f38aa185da26feb20da513a290c53bd380ca3a1b480f205ea951e26fee9
Opcode Fuzzy Hash: 1f597b3c1714061f587612e37637dd542d30a42a7441af5f7abd66e8f08f72cb
Instruction Fuzzy Hash: 6511E933A005149BDB04A7A5DC81ADEB7B9EB84316F14453FF412E3293DF786D098758

Function 004592CE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004592E1

Strings

pfF, xrefs: 004592F0
@fF, xrefs: 00459303

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Parent
String ID: @fF$pfF
API String ID: 975332729-130061076
Opcode ID: 9ce0c56aba0225eebca70d9d781e00fdff3e6a68a7f8f42f320241f2f1d1f7d9
Instruction ID: d0f4dd8e877e853238a70565877cc88b238c8963feefbac8d7d17da4c9c98843
Opcode Fuzzy Hash: 9ce0c56aba0225eebca70d9d781e00fdff3e6a68a7f8f42f320241f2f1d1f7d9
Instruction Fuzzy Hash: B201D832604602DBDB248B59D884D2B73A8DFC9323725443FEC45977D6CA38EC09CB58

Function 00459F2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00459F31
GetObjectA.GDI32(00000000,00000018,?), ref: 00459F89

Strings

DmF, xrefs: 00459F78

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: H_prologObject
String ID: DmF
API String ID: 3423075018-3342732609
Opcode ID: c0ca89050b369644a38a83c574d61124dfed634ed9f680e9bf15ee68e45838a9
Instruction ID: 20348e6802007e86812f4e8494e644a74938644df081601828a5ff610165990a
Opcode Fuzzy Hash: c0ca89050b369644a38a83c574d61124dfed634ed9f680e9bf15ee68e45838a9
Instruction Fuzzy Hash: AE118CB1D00209DFDB10DFA4D546BEEBBB0EB08716F00845EE905A2282D7B85A48CB99

Function 00454341 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00456D14: GetWindowLongA.USER32(00000000,000000F0), ref: 00456D20

GetWindowRect.USER32(?,9EE), ref: 00454366
GetWindow.USER32(?,00000004), ref: 00454383

Part of subcall function 00456EA3: IsWindowEnabled.USER32(?), ref: 00456EAD

Strings

9EE, xrefs: 0045435F, 00454371, 00454362

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Window$EnabledLongRect
String ID: 9EE
API String ID: 3170195891-1598228818
Opcode ID: bec8a3f6d294940cd19a789a4048cdd166aaf2698ddbbf8e3aa935eccbefb5cb
Instruction ID: 95a0ac723b0fdb612912c4e180363d21aedf26402ea194c0cade108880a4b963
Opcode Fuzzy Hash: bec8a3f6d294940cd19a789a4048cdd166aaf2698ddbbf8e3aa935eccbefb5cb
Instruction Fuzzy Hash: 8A0171307002149BDF21AF61C915BAF77E5AF9030EF40445AED419B3A3DB38DC888A98

Function 0045A708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0045C679: __EH_prolog.LIBCMT ref: 0045C67E

SendMessageA.USER32(?,00000198,00000016,?), ref: 0045A732
InvalidateRect.USER32(?,?,00000000,?,?,?,00445051,00000016,?), ref: 0045A74E

Strings

`NH, xrefs: 0045A717

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: H_prologInvalidateMessageRectSend
String ID: `NH
API String ID: 222458238-2708191515
Opcode ID: 74d93525197368fbe666b3c827feef32069fa4be1f0fba11491c781bf2edd773
Instruction ID: e1be53b3195a22e54227850b2a17e946f329571c735514a26f0645833d53dd5b
Opcode Fuzzy Hash: 74d93525197368fbe666b3c827feef32069fa4be1f0fba11491c781bf2edd773
Instruction Fuzzy Hash: 75F05E36500319AFD710EF95DC45DEEB7B9FB84301F00453AE90192192DA70A919CB94

Function 0045C7F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00485018,?,?,?,0045164B,00000000,00000001), ref: 0045C816
DeleteCriticalSection.KERNEL32(00485030,?,?,?,0045164B,00000000,00000001), ref: 0045C828

Strings

0PH, xrefs: 0045C81D

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalDeleteSection
String ID: 0PH
API String ID: 166494926-429303924
Opcode ID: 734cd1f48ad902bef1377236a5d2ae1c959059f187229abeb41842255851d5a2
Instruction ID: 1c6eaba41cd9c1205f92842ddf1e431811c5a6e4572121cad594ed2ce94db9fe
Opcode Fuzzy Hash: 734cd1f48ad902bef1377236a5d2ae1c959059f187229abeb41842255851d5a2
Instruction Fuzzy Hash: A9E01A729107049FD7203B5DECC875E66B8EB9132BF25683BE94051262837E4C88DBD9

Function 0044F920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23stringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000010), ref: 0044F93E
lstrcmpA.KERNEL32(?,ComboBox,?,00000010), ref: 0044F94E

Strings

ComboBox, xrefs: 0044F948

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: ClassNamelstrcmp
String ID: ComboBox
API String ID: 3770760073-1152790111
Opcode ID: 32e2b560d3036ae37218e0666ec08a67b997f10deb92cd32c17fa390c41c5dde
Instruction ID: aad108a5c13fdbb8d374251ef1e111310be8c608e497c704e010c88afefd153b
Opcode Fuzzy Hash: 32e2b560d3036ae37218e0666ec08a67b997f10deb92cd32c17fa390c41c5dde
Instruction Fuzzy Hash: D3E0DFB16103026BEB14BB28CC49B2A32A4F700706F844DACF149C22A1F77BD548831B

Function 00454584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0045C5E4: TlsGetValue.KERNEL32(00484E6C,?,00000000,0045BF85,0045B3E3,0045BFA1,0045285D,004578F4,?,00000000,?,0045161C,00000000,00000000,00000000,00000000), ref: 0045C623

GetMessageTime.USER32 ref: 00454596
GetMessagePos.USER32 ref: 0045459F

Strings

,NH, xrefs: 0045458A

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: Message$TimeValue
String ID: ,NH
API String ID: 3832333830-3639332287
Opcode ID: 132c36ad26fafd264b327fcdd59cf038ca79a631843e9cdc625e677bddb90e61
Instruction ID: ef02e1a127f41357c4e2308cd101474db07e1f253c9caf6b5ab26e4c13208a59
Opcode Fuzzy Hash: 132c36ad26fafd264b327fcdd59cf038ca79a631843e9cdc625e677bddb90e61
Instruction Fuzzy Hash: 48D01774801B308FC720AFB5A5881AB7BE8EB44713340087FE986C7A12DB39E405CF89

Function 0045C4F2 Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0045C54F
LeaveCriticalSection.KERNEL32(?,?), ref: 0045C55F
LocalFree.KERNEL32(?), ref: 0045C568
TlsSetValue.KERNEL32(?,00000000), ref: 0045C57E

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 97464f0800e32f4addc31103b94fe96cea5ae0b998ccbbb92bed81ac5f6551b5
Instruction ID: 9f45e29cdf5384dc5223a5cd649a4a84178ae0e223aacdcb1813034ac009809f
Opcode Fuzzy Hash: 97464f0800e32f4addc31103b94fe96cea5ae0b998ccbbb92bed81ac5f6551b5
Instruction Fuzzy Hash: 90219A32200724EFC7248F94D884B6A77A4FF45712F50846EF9029B2A2DB75FC49CB55

Function 0045C83E Relevance: 5.0, APIs: 4, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00485018,?,00000000,?,?,0045C69A,00000010,?,00000000,?,?,?,0045BF9B,0045BFE8,0045B3E3,0045BFA1), ref: 0045C879
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,0045C69A,00000010,?,00000000,?,?,?,0045BF9B,0045BFE8,0045B3E3,0045BFA1), ref: 0045C88B
LeaveCriticalSection.KERNEL32(00485018,?,00000000,?,?,0045C69A,00000010,?,00000000,?,?,?,0045BF9B,0045BFE8,0045B3E3,0045BFA1), ref: 0045C894
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,0045C69A,00000010,?,00000000,?,?,?,0045BF9B,0045BFE8,0045B3E3,0045BFA1,0045285D), ref: 0045C8A6

Part of subcall function 0045C7AB: GetVersion.KERNEL32(?,0045C84E,?,0045C69A,00000010,?,00000000,?,?,?,0045BF9B,0045BFE8,0045B3E3,0045BFA1,0045285D,004578F4), ref: 0045C7BE

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: 82d8909e6e37444d8dfbb15c22fe58dafd969bddfd6c5660865929499fe4e119
Instruction ID: 9e463c43c45708ed4bf3e52174e50b6dab29c542ec9a95fdc5e2302c6ce34ca1
Opcode Fuzzy Hash: 82d8909e6e37444d8dfbb15c22fe58dafd969bddfd6c5660865929499fe4e119
Instruction Fuzzy Hash: 04F0447140070ADFC710AF94ECC4A5AB36CFB55317B40083FE60552022D735B858CBA9

Function 00449D38 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,00448BE2,?,004468B8), ref: 00449D45
InitializeCriticalSection.KERNEL32(?,00448BE2,?,004468B8), ref: 00449D4D
InitializeCriticalSection.KERNEL32(?,00448BE2,?,004468B8), ref: 00449D55
InitializeCriticalSection.KERNEL32(?,00448BE2,?,004468B8), ref: 00449D5D

Memory Dump Source

Source File: 00000000.00000002.2500661664.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2500608179.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500784189.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500835825.000000000046C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500898000.0000000000481000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2500949260.0000000000488000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Convert.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 83f02653c4530bd4f504e3cacb83d55f4c36d964e2eeccf4222e36c17539273a
Instruction ID: ede4b82885997495e84dd53f1c457f97974f8fb30d58a21cc7fb583a4370909e
Opcode Fuzzy Hash: 83f02653c4530bd4f504e3cacb83d55f4c36d964e2eeccf4222e36c17539273a
Instruction Fuzzy Hash: 3FC00232811434DBCE163B55FF0584E3FA5EB042613090676A1045103486A21C10DFD8

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Convert.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Convert.exePID: 5920, Parent PID: 4056

General

Chronological Activities

Disassembly

Analysis Process: Convert.exePID: 5920, Parent PID: 4056COMMON

Execution Graph

Graph

Executed Functions

Function 0045377E Relevance: 13.6, APIs: 9, Instructions: 113COMMON

Control-flow Graph

Windows Analysis Report
Convert.exe

Function 0045377E Relevance: 13.6, APIs: 9, Instructions: 113
COMMON

Function 0045490E Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 170
stringCOMMON

Function 0045C27D Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99
memoryCOMMONLIBRARYCODE

Function 0045349A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 172
COMMON

Function 00454733 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99
COMMON

Function 00401FA5 Relevance: 12.1, APIs: 8, Instructions: 136
COMMON

Function 004566D9 Relevance: 10.6, APIs: 7, Instructions: 122
windowCOMMON

Function 0045B592 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
registryCOMMON

Function 0045878C Relevance: 9.1, APIs: 6, Instructions: 59
registryCOMMON

Function 0045718F Relevance: 9.0, APIs: 6, Instructions: 35
COMMON

Function 0045B6D8 Relevance: 7.6, APIs: 5, Instructions: 89
registryCOMMON

Function 0045286D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27
threadCOMMON

Function 0045C8D9 Relevance: 6.1, APIs: 4, Instructions: 63
COMMON