Play interactive tour

Edit tour

Analysis Report 6c9e4dd7_by_Libranalysis

Overview

General Information

Sample Name:	6c9e4dd7_by_Libranalysis (renamed file extension from none to exe)
Analysis ID:	398986
MD5:	6c9e4dd7daab40a2b40db3d13279ee2e
SHA1:	879eaa020afb3906709ffd8efe9dfcdd23399227
SHA256:	1dcddce0408092a22c015e183e463020a7231e1f5ca47e71acad4ddcfb0f2385
Infos:
Most interesting Screenshot:

Detection

NetWire

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NetWire

Yara detected NetWire RAT

C2 URLs / IPs found in malware configuration

Contains functionality to steal Chrome passwords or cookies

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has a writeable .text section

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains strange resources

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Startup

System is w10x64

6c9e4dd7_by_Libranalysis.exe (PID: 3752 cmdline: 'C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe' MD5: 6C9E4DD7DAAB40A2B40DB3D13279EE2E)

Host.exe (PID: 4036 cmdline: 'C:\Users\user\AppData\Roaming\Install\Host.exe' MD5: 6C9E4DD7DAAB40A2B40DB3D13279EE2E)

cleanup

Malware Configuration

Threatname: NetWire

{"C2 list": ["rootsec.publicvm.com:3361"], "Password": "123", "Host ID": "HostId-%Rand%", "Mutex": "-", "Install Path": "%AppData%\\Install\\Host.exe", "Startup Name": "-", "ActiveX Key": "-", "KeyLog Directory": "%AppData%\\Logs\\"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
6c9e4dd7_by_Libranalysis.exe	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Install\Host.exe	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.511119979.00000000007D0000.00000040.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000001.00000002.259724809.00000000008E0000.00000040.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000002.00000002.511293682.0000000000910000.00000040.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000001.00000002.259743780.0000000000910000.00000004.00000040.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000001.00000002.259762257.0000000002140000.00000040.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000001.00000002.259762257.0000000002140000.00000040.00000001.sdmp	netwire	detect netwire in memory	JPCERT/CC Incident Response Group	0x22580:$v1: HostId-%Rand%
Process Memory Space: Host.exe PID: 4036	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Process Memory Space: 6c9e4dd7_by_Libranalysis.exe PID: 3752	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Process Memory Space: 6c9e4dd7_by_Libranalysis.exe PID: 3752	netwire	detect netwire in memory	JPCERT/CC Incident Response Group	0x180492:$v1: HostId-%Rand% 0x1804ad:$v1: HostId-%Rand%
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.Host.exe.910000.3.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
2.2.Host.exe.7d025e.2.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
2.2.Host.exe.910000.3.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.raw.unpack	netwire	detect netwire in memory	JPCERT/CC Incident Response Group	0x22580:$v1: HostId-%Rand%
1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.unpack	netwire	detect netwire in memory	JPCERT/CC Incident Response Group	0x20f80:$v1: HostId-%Rand%
1.2.6c9e4dd7_by_Libranalysis.exe.8e025e.2.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Click to see the 3 entries

Sigma Overview

System Summary:

Sigma detected: NetWire

Show sources

Source: Registry Key set

Author: Joe Security: Data: Details: HostId-yaI6gm, EventID: 13, Image: C:\Users\user\AppData\Roaming\Install\Host.exe, ProcessId: 4036, TargetObject: HKEY_CURRENT_USER\Software\NetWire\HostId

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 2.2.Host.exe.7d025e.2.raw.unpack

Malware Configuration Extractor: NetWire {"C2 list": ["rootsec.publicvm.com:3361"], "Password": "123", "Host ID": "HostId-%Rand%", "Mutex": "-", "Install Path": "%AppData%\\Install\\Host.exe", "Startup Name": "-", "ActiveX Key": "-", "KeyLog Directory": "%AppData%\\Logs\\"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Virustotal: Detection: 19%			Perma Link
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	ReversingLabs: Detection: 19%

Multi AV Scanner detection for submitted file

Show sources

Source: 6c9e4dd7_by_Libranalysis.exe	Virustotal: Detection: 19%			Perma Link
Source: 6c9e4dd7_by_Libranalysis.exe	ReversingLabs: Detection: 19%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\Install\Host.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: 6c9e4dd7_by_Libranalysis.exe

Joe Sandbox ML: detected

Source: 2.2.Host.exe.910000.3.unpack	Avira: Label: TR/Spy.Gen
Source: 1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.unpack	Avira: Label: TR/Spy.Gen
Source: 1.2.6c9e4dd7_by_Libranalysis.exe.8e025e.2.unpack	Avira: Label: TR/Patched.Ren.Gen

Compliance:

Detected unpacking (creates a PE file in dynamic memory)

Show sources

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Unpacked PE file: 1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.unpack
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Unpacked PE file: 2.2.Host.exe.910000.3.unpack

Source: 6c9e4dd7_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 6c9e4dd7_by_Libranalysis.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: Journal.pdbL source: 6c9e4dd7_by_Libranalysis.exe
Source:	Binary string: Journal.pdb source: 6c9e4dd7_by_Libranalysis.exe

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_0048F1FF __EH_prolog3_GS,memset,lstrlenW,lstrlenW,lstrlenW,PathAddBackslashW,FindFirstFileW,memset,PathAddBackslashW,FindNextFileW,GetLastError,FindClose,GetLastError,		1_2_0048F1FF
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_0048EB15 memset,memset,lstrlenW,lstrlenW,lstrlenW,PathAddBackslashW,FindFirstFileW,FindNextFileW,GetLastError,FindClose,		1_2_0048EB15

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: rootsec.publicvm.com:3361

Source: unknown

DNS traffic detected: queries for: rootsec.publicvm.com

Source: Host.exe	String found in binary or memory: http://www.yandex.com
Source: 6c9e4dd7_by_Libranalysis.exe	String found in binary or memory: http://www.yandex.comsocks=
Source: Host.exe, 00000002.00000002.511293682.0000000000910000.00000040.00000001.sdmp	String found in binary or memory: http://www.yandex.comsocks=L

Source: Host.exe, 00000002.00000002.511322936.000000000093B000.00000040.00000001.sdmp

Binary or memory string: GetRawInputData

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000001.00000002.259762257.0000000002140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect netwire in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: 6c9e4dd7_by_Libranalysis.exe PID: 3752, type: MEMORY	Matched rule: detect netwire in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect netwire in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.unpack, type: UNPACKEDPE	Matched rule: detect netwire in memory Author: JPCERT/CC Incident Response Group

PE file has a writeable .text section

Show sources

Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Host.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00427690	1_2_00427690
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_004B069F	1_2_004B069F
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00435E97	1_2_00435E97
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_009134D3	2_2_009134D3
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_009308C0	2_2_009308C0
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00930420	2_2_00930420
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00913047	2_2_00913047
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0092D049	2_2_0092D049
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00925079	2_2_00925079
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00929463	2_2_00929463
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00924976	2_2_00924976
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00925ABF	2_2_00925ABF
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091AEC6	2_2_0091AEC6
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00912AFC	2_2_00912AFC
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00926619	2_2_00926619
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00912E68	2_2_00912E68
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091A728	2_2_0091A728
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0092FF50	2_2_0092FF50
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00930F40	2_2_00930F40

Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: String function: 009181AA appears 110 times
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: String function: 0092F724 appears 31 times
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: String function: 004AEBD4 appears 885 times
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: String function: 004BF800 appears 121 times
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: String function: 004BF7C8 appears 400 times

Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Host.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: 6c9e4dd7_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 6c9e4dd7_by_Libranalysis.exe
Source: 6c9e4dd7_by_Libranalysis.exe, 00000001.00000000.241605490.00000000004D8000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameJournal.exej% vs 6c9e4dd7_by_Libranalysis.exe
Source: 6c9e4dd7_by_Libranalysis.exe, 00000001.00000002.260301152.0000000002610000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs 6c9e4dd7_by_Libranalysis.exe
Source: 6c9e4dd7_by_Libranalysis.exe, 00000001.00000002.260301152.0000000002610000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs 6c9e4dd7_by_Libranalysis.exe
Source: 6c9e4dd7_by_Libranalysis.exe, 00000001.00000002.259800471.00000000021C0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs 6c9e4dd7_by_Libranalysis.exe
Source: 6c9e4dd7_by_Libranalysis.exe	Binary or memory string: OriginalFilenameJournal.exej% vs 6c9e4dd7_by_Libranalysis.exe

Source: 6c9e4dd7_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000001.00000002.259762257.0000000002140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: netwire author = JPCERT/CC Incident Response Group, description = detect netwire in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: 6c9e4dd7_by_Libranalysis.exe PID: 3752, type: MEMORY	Matched rule: netwire author = JPCERT/CC Incident Response Group, description = detect netwire in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.raw.unpack, type: UNPACKEDPE	Matched rule: netwire author = JPCERT/CC Incident Response Group, description = detect netwire in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.unpack, type: UNPACKEDPE	Matched rule: netwire author = JPCERT/CC Incident Response Group, description = detect netwire in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@6/1

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Code function: 1_2_004AE03F __EH_prolog3_GS,CoCreateInstance,memset,#6928,

1_2_004AE03F

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Code function: 1_2_0042ACE6 __EH_prolog3,memset,#1165,#1165,#1165,LockResource,#540,#4155,#861,#800,

1_2_0042ACE6

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

File created: C:\Users\user\AppData\Roaming\Install

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Install\Host.exe

Mutant created: \Sessions\1\BaseNamedObjects\-

Source: 6c9e4dd7_by_Libranalysis.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Install\Host.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 6c9e4dd7_by_Libranalysis.exe	Virustotal: Detection: 19%
Source: 6c9e4dd7_by_Libranalysis.exe	ReversingLabs: Detection: 19%

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

File read: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe 'C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe'
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process created: C:\Users\user\AppData\Roaming\Install\Host.exe 'C:\Users\user\AppData\Roaming\Install\Host.exe'
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process created: C:\Users\user\AppData\Roaming\Install\Host.exe 'C:\Users\user\AppData\Roaming\Install\Host.exe'	Jump to behavior

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: 6c9e4dd7_by_Libranalysis.exe

Static file information: File size 2019840 > 1048576

Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 6c9e4dd7_by_Libranalysis.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 6c9e4dd7_by_Libranalysis.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Journal.pdbL source: 6c9e4dd7_by_Libranalysis.exe
Source:	Binary string: Journal.pdb source: 6c9e4dd7_by_Libranalysis.exe

Data Obfuscation:

Detected unpacking (creates a PE file in dynamic memory)

Show sources

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Unpacked PE file: 1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.unpack
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Unpacked PE file: 2.2.Host.exe.910000.3.unpack

Source: Host.exe.1.dr	Static PE information: real checksum: 0x1f534c should be: 0x1f5426
Source: 6c9e4dd7_by_Libranalysis.exe	Static PE information: real checksum: 0x1f534c should be: 0x1f5426

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_004BF4F1 push ecx; ret	1_2_004BF504
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00919E61 push eax; mov dword ptr [esp], ebx	2_2_00919FDE
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091A4BC push esi; mov dword ptr [esp], 00933347h	2_2_0091A543
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091DCE9 push ecx; mov dword ptr [esp], 00933976h	2_2_0091DD9F
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091DCE9 push ebp; mov dword ptr [esp], 0093398Ah	2_2_0091DDD9
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091DCE9 push edx; mov dword ptr [esp], 00933997h	2_2_0091DDF7
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091DCE9 push edx; mov dword ptr [esp], esi	2_2_0091E394
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00932449 push edi; retf	2_2_0093244B
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00921D8C push edx; mov dword ptr [esp], edi	2_2_00922058
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00919953 push edi; mov dword ptr [esp], 00000091h	2_2_00919980
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00919953 push ebp; mov dword ptr [esp], 00000090h	2_2_0091998D
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_009246E1 push eax; mov dword ptr [esp], ebx	2_2_0092470B
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_00916E04 push ecx; mov dword ptr [esp], ebx	2_2_00916E69
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091262F push edx; mov dword ptr [esp], edi	2_2_009127C8
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091262F push edx; mov dword ptr [esp], edi	2_2_00912815
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091262F push edx; mov dword ptr [esp], edi	2_2_009129B2
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: 2_2_0091970C push eax; mov dword ptr [esp], 0093B4A0h	2_2_009197B9

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

File created: C:\Users\user\AppData\Roaming\Install\Host.exe

Jump to dropped file

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00440840 __EH_prolog3_GS,#1165,#1165,IsIconic,#1165,#1165,#1165,		1_2_00440840
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_004328A6 __EH_prolog3_GS,MonitorFromWindow,GetMonitorInfoW,SHAppBarMessage,SHAppBarMessage,SetRectEmpty,SHAppBarMessage,CopyRect,#3916,memset,IsIconic,#6191,IsZoomed,#6191,#6211,#4294,		1_2_004328A6

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Code function: 1_2_004B069F rdtsc

1_2_004B069F

Source: C:\Users\user\AppData\Roaming\Install\Host.exe TID: 644

Thread sleep time: -375000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00465374 GetKeyboardLayout followed by cmp: cmp cx, ax and CTI: jne 0046554Ch		1_2_00465374
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00465374 GetKeyboardLayout followed by cmp: cmp cx, ax and CTI: je 0046554Ch		1_2_00465374

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Code function: 1_2_00485EDE GetLocalTime followed by cmp: cmp ebx, 10h and CTI: jnc 00485FD2h

1_2_00485EDE

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_0048F1FF __EH_prolog3_GS,memset,lstrlenW,lstrlenW,lstrlenW,PathAddBackslashW,FindFirstFileW,memset,PathAddBackslashW,FindNextFileW,GetLastError,FindClose,GetLastError,		1_2_0048F1FF
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_0048EB15 memset,memset,lstrlenW,lstrlenW,lstrlenW,PathAddBackslashW,FindFirstFileW,FindNextFileW,GetLastError,FindClose,		1_2_0048EB15

Source: C:\Users\user\AppData\Roaming\Install\Host.exe

Thread delayed: delay time: 75000

Jump to behavior

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Code function: 1_2_004B069F rdtsc

1_2_004B069F

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_004B81C1 mov ebx, dword ptr fs:[00000030h]	1_2_004B81C1
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_004BDB47 mov eax, dword ptr fs:[00000030h]	1_2_004BDB47
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00440BC5 mov eax, dword ptr fs:[00000030h]	1_2_00440BC5
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00440BC5 mov eax, dword ptr fs:[00000030h]	1_2_00440BC5
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_004B069F mov eax, dword ptr fs:[00000030h]	1_2_004B069F
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_004B069F mov eax, dword ptr fs:[00000030h]	1_2_004B069F
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_004B069F mov eax, dword ptr fs:[00000030h]	1_2_004B069F
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_004B069F mov eax, dword ptr fs:[00000030h]	1_2_004B069F
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00435E97 mov eax, dword ptr fs:[00000030h]	1_2_00435E97
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00435E97 mov eax, dword ptr fs:[00000030h]	1_2_00435E97
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00435E97 mov eax, dword ptr fs:[00000030h]	1_2_00435E97
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: 1_2_00435E97 mov eax, dword ptr fs:[00000030h]	1_2_00435E97

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Code function: 1_2_0047DA73 #1165,GlobalLock,GlobalLock,GlobalLock,GetProcessHeap,HeapAlloc,memcpy,GlobalUnlock,GlobalUnlock,

1_2_0047DA73

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Code function: 1_2_004BED37 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_004BED37

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Process created: C:\Users\user\AppData\Roaming\Install\Host.exe 'C:\Users\user\AppData\Roaming\Install\Host.exe'

Jump to behavior

Source: Host.exe, 00000002.00000002.511406065.0000000000DC0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Host.exe, 00000002.00000002.511406065.0000000000DC0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Host.exe, 00000002.00000002.511406065.0000000000DC0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: Host.exe, 00000002.00000002.511406065.0000000000DC0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: Host.exe, 00000002.00000002.511406065.0000000000DC0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: __EH_prolog3_GS,#567,GetLocaleInfoW,_wtoi,#1165,CoCreateInstance,#30,SysAllocStringLen,#1165,#1165,SysStringLen,SysFreeString,#1008,#1008,#1008,#1008,		1_2_00466E2B
Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe	Code function: __EH_prolog3_GS,memcpy,GetLocalTime,GetLocaleInfoW,		1_2_00485EDE

Source: C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe

Code function: 1_2_004BF3D8 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

1_2_004BF3D8

Stealing of Sensitive Information:

Contains functionality to steal Chrome passwords or cookies

Show sources

Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: %s\Google\Chrome\User Data\Default\Login Data		2_2_0091F281
Source: C:\Users\user\AppData\Roaming\Install\Host.exe	Code function: %s\Chromium\User Data\Default\Login Data		2_2_0091F382

Remote Access Functionality:

Yara detected NetWire RAT

Show sources

Source: Yara match	File source: 6c9e4dd7_by_Libranalysis.exe, type: SAMPLE
Source: Yara match	File source: 00000002.00000002.511119979.00000000007D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.259724809.00000000008E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.511293682.0000000000910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.259743780.0000000000910000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.259762257.0000000002140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Host.exe PID: 4036, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6c9e4dd7_by_Libranalysis.exe PID: 3752, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Install\Host.exe, type: DROPPED
Source: Yara match	File source: 2.2.Host.exe.910000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Host.exe.7d025e.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Host.exe.910000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.6c9e4dd7_by_Libranalysis.exe.8e025e.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping1	System Time Discovery11	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion21	Input Capture11	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Credentials In Files1	Security Software Discovery13	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Virtualization/Sandbox Evasion21	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing11	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	File and Directory Discovery2	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Information Discovery22	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
6c9e4dd7_by_Libranalysis.exe	19%	Virustotal		Browse
6c9e4dd7_by_Libranalysis.exe	19%	ReversingLabs	Win32.Backdoor.NetWiredRc
6c9e4dd7_by_Libranalysis.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Install\Host.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Install\Host.exe	19%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Install\Host.exe	19%	ReversingLabs	Win32.Backdoor.NetWiredRc

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.2.Host.exe.910000.3.unpack	100%	Avira	TR/Spy.Gen	Download File
1.2.6c9e4dd7_by_Libranalysis.exe.2140000.3.unpack	100%	Avira	TR/Spy.Gen	Download File
1.2.6c9e4dd7_by_Libranalysis.exe.8e025e.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.2.Host.exe.7d025e.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.yandex.comsocks=	0%	Avira URL Cloud	safe
http://www.yandex.comsocks=L	0%	Avira URL Cloud	safe
rootsec.publicvm.com:3361	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rootsec.publicvm.com	172.111.153.139	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rootsec.publicvm.com:3361	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.yandex.com	Host.exe	false		high
http://www.yandex.comsocks=	6c9e4dd7_by_Libranalysis.exe	false	Avira URL Cloud: safe	low
http://www.yandex.comsocks=L	Host.exe, 00000002.00000002.511293682.0000000000910000.00000040.00000001.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.111.153.139	rootsec.publicvm.com	United States		9009	M247GB	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	398986
Start date:	28.04.2021
Start time:	09:01:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	6c9e4dd7_by_Libranalysis (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@6/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 38.6% (good quality ratio 18.6%) Quality average: 37.3% Quality standard deviation: 41.6%
HCA Information:	Successful, ratio: 53% Number of executed functions: 0 Number of non-executed functions: 498
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 93.184.220.29, 104.43.193.48, 20.82.210.154, 168.61.161.212, 23.57.80.111, 92.122.145.220, 13.64.90.137, 13.88.21.125, 8.248.133.254, 67.27.234.126, 8.248.141.254, 67.27.233.254, 8.253.95.121, 92.122.213.194, 92.122.213.247, 52.155.217.156, 20.54.26.129 Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus15.cloudapp.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:03:13	API Interceptor	5x Sleep call for process: Host.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
rootsec.publicvm.com	wsedrqaw.jar	Get hash	malicious	Browse	172.111.141.34
rootsec.publicvm.com	wsedrqaw.jar	Get hash	malicious	Browse	172.111.141.34

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
M247GB	hsCNXH5WfPktCMH.exe	Get hash	malicious	Browse	217.138.212.58
	24032130395451.pdf .exe	Get hash	malicious	Browse	217.138.219.123
	TPE-CHESTERFIELD, MI 48051 (DDP)#U99ff#U5f975008.exe	Get hash	malicious	Browse	188.72.124.143
	BsqYZjzDe2.exe	Get hash	malicious	Browse	38.132.99.156
	m1WOP5oC15Xaepo.exe	Get hash	malicious	Browse	217.138.212.58
	RgEfFMWH7mMuuke.exe	Get hash	malicious	Browse	217.138.212.58
	Freight Return Document Receipt-Shipment042122_pdf.exe	Get hash	malicious	Browse	195.206.105.10
	Bloomberg BNA Invoice Enclosed 09847679531.xls	Get hash	malicious	Browse	89.40.206.121
	7mB68AZqJs.exe	Get hash	malicious	Browse	217.138.219.123
	35742.exe	Get hash	malicious	Browse	45.141.152.18
	A0R0T8clkq.exe	Get hash	malicious	Browse	38.132.99.156
	Balancepayment-PDF.exe	Get hash	malicious	Browse	45.141.152.18
	a7cQje0wGxiZkwL.exe	Get hash	malicious	Browse	217.138.212.58
	548235.exe	Get hash	malicious	Browse	45.141.152.18
	ORDER-02188.exe	Get hash	malicious	Browse	46.243.217.11
	Confirmarea platii.pdf.exe	Get hash	malicious	Browse	45.141.152.18
	Confirmarea platii.pdf.exe	Get hash	malicious	Browse	45.141.152.18
	e-dekont.html.exe	Get hash	malicious	Browse	45.141.152.18
	Credit Advice -TT6635993652908.PDF.exe	Get hash	malicious	Browse	45.141.152.18
	elef.exe	Get hash	malicious	Browse	37.120.222.70

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Install\Host.exe Download File
Process:	C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2019840
Entropy (8bit):	6.594149057479949
Encrypted:	false
SSDEEP:	49152:nhtORUwc166NlRq7vLSUtwFODMQSOXzZ2WFeZkP9aiK+d/:nhtORUB166NHq7vLZ0mQoNzFeZkP9aiN
MD5:	6C9E4DD7DAAB40A2B40DB3D13279EE2E
SHA1:	879EAA020AFB3906709FFD8EFE9DFCDD23399227
SHA-256:	1DCDDCE0408092A22C015E183E463020A7231E1F5CA47E71ACAD4DDCFB0F2385
SHA-512:	6BEC4572366A42A9892EB7E1715B318996E3C57F8A11724910BDD07F794E5655F5EBAE9E06E695EE576100D9005EE16A394B1AEE889ADD6919BCD8183FDA303B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: C:\Users\user\AppData\Roaming\Install\Host.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 19%, Browse Antivirus: ReversingLabs, Detection: 19%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............n..n..n.6Z...n.6Z....n.6Z...n..o...n.6Z....n.6Z...n.6Z...n.6Z...n.Rich.n.........PE..L...M..R.....................f............... ....@.................................LS....@...... ..............................T.......H....................t..`...0...............................0...\............................................text...\........................... ....data....\... ...B..................@....idata..fH.......J...L..............@..@.rsrc...H...........................@..@.reloc...............@..............@..B........................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.594149057479949
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	6c9e4dd7_by_Libranalysis.exe
File size:	2019840
MD5:	6c9e4dd7daab40a2b40db3d13279ee2e
SHA1:	879eaa020afb3906709ffd8efe9dfcdd23399227
SHA256:	1dcddce0408092a22c015e183e463020a7231e1f5ca47e71acad4ddcfb0f2385
SHA512:	6bec4572366a42a9892eb7e1715b318996e3c57f8a11724910bdd07f794e5655f5ebae9e06e695ee576100d9005ee16a394b1aee889add6919bcd8183fda303b
SSDEEP:	49152:nhtORUwc166NlRq7vLSUtwFODMQSOXzZ2WFeZkP9aiK+d/:nhtORUB166NHq7vLZ0mQoNzFeZkP9aiN
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............n...n...n.6Z....n.6Z....n.6Z....n...o...n.6Z....n.6Z....n.6Z....n.6Z....n.Rich..n.........PE..L...M..R...................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4becec
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5215814D [Thu Aug 22 03:11:09 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	0b6ce52b13559fc7fd638da8d5c538c2

Entrypoint Preview

Instruction
call 00007FC3CCB8B90Ch
jmp 00007FC3CCB8B008h
int3
int3
int3
int3
int3
cmp ecx, dword ptr [004D2004h]
jne 00007FC3CCB8B225h
retn 0000h
jmp 00007FC3CCB8B280h
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword ptr [004D8FC4h]
test byte ptr [ebp+08h], 00000001h
je 00007FC3CCB8B229h
push esi
call 00007FC3CCB8A47Ch
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push 00000000h
call dword ptr [004D8260h]
push dword ptr [ebp+08h]
call dword ptr [004D8264h]
push C0000409h
call dword ptr [004D825Ch]
push eax
call dword ptr [004D8258h]
pop ebp
ret
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000324h
mov dword ptr [004D6198h], eax
mov dword ptr [004D6194h], ecx
mov dword ptr [004D6190h], edx
mov dword ptr [004D618Ch], ebx
mov dword ptr [004D6188h], esi
mov dword ptr [004D6184h], edi
mov word ptr [004D61B0h], ss
mov word ptr [004D61A4h], cs
mov word ptr [004D6180h], ds
mov word ptr [004D617Ch], es
mov word ptr [00000078h], fs

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd90c0	0x154	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xdd000	0xda948	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1b7400	0xbf60
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1030	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x21730	0x5c	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd8000	0x10c0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xd1114	0xa0	.text
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd045c	0xd0600	False	0.458270845831	data	6.46349372703	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0xd2000	0x5c1c	0x4200	False	0.182469223485	data	2.92826603731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0xd8000	0x4866	0x4a00	False	0.378800675676	data	5.88102985703	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xdd000	0xda948	0xdaa00	False	0.48924497034	data	6.40558978802	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1b8000	0x112bc	0x11400	False	0.472712862319	data	5.43661036513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
MUI	0x1b7830	0x118	data	English	United States
TYPELIB	0x17a9f0	0x1350	data	English	United States
WMF	0x17bd40	0xb958	Windows Enhanced Metafile (EMF) image data version 0x10000	English	United States
WMF	0x187698	0xc020	Windows Enhanced Metafile (EMF) image data version 0x10000	English	United States
WMF	0x1936b8	0xc020	Windows Enhanced Metafile (EMF) image data version 0x10000	English	United States
WMF	0x19f6d8	0xc06c	Windows Enhanced Metafile (EMF) image data version 0x10000	English	United States
WMF	0x1ab748	0xc0e8	Windows Enhanced Metafile (EMF) image data version 0x10000	English	United States
RT_BITMAP	0x16b570	0xd88	data	English	United States
RT_BITMAP	0x169e88	0x16e8	data	English	United States
RT_BITMAP	0x16c2f8	0x428	data	English	United States
RT_BITMAP	0x16c720	0x44	data	English	United States
RT_BITMAP	0x16c768	0x44	data	English	United States
RT_BITMAP	0x172078	0x8a8	data	English	United States
RT_BITMAP	0x145348	0x4a68	dBase III DBT, version number 0, next free block index 40	English	United States
RT_BITMAP	0x14e818	0x1b2a	data	English	United States
RT_BITMAP	0x151e78	0xab2a	data	English	United States
RT_BITMAP	0x149db0	0x4a68	data	English	United States
RT_BITMAP	0x1674d8	0x14d4	data	English	United States
RT_BITMAP	0x1689b0	0x14d4	data	English	United States
RT_BITMAP	0x150348	0x1b2a	data	English	United States
RT_BITMAP	0x16c7b0	0x2fe	GLS_BINARY_LSB_FIRST	English	United States
RT_BITMAP	0x16cab0	0x316	GLS_BINARY_LSB_FIRST	English	United States
RT_BITMAP	0x16cdc8	0x92a	data	English	United States
RT_BITMAP	0x15c9a8	0xab2a	data	English	United States
RT_BITMAP	0x176850	0x3f2a	data	English	United States
RT_BITMAP	0x16d6f8	0x92a	data	English	United States
RT_BITMAP	0x16e028	0x92a	data	English	United States
RT_BITMAP	0x16fbb8	0x92a	data	English	United States
RT_BITMAP	0x1704e8	0x92a	data	English	United States
RT_BITMAP	0x170e18	0x92a	data	English	United States
RT_BITMAP	0x171748	0x92a	data	English	United States
RT_BITMAP	0x172920	0x3f2a	data	English	United States
RT_BITMAP	0x16e958	0x92a	data	English	United States
RT_BITMAP	0x16f288	0x92a	data	English	United States
RT_BITMAP	0x17a780	0x1ce	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xdec58	0x668	data	English	United States
RT_ICON	0xdf2c0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2011658216, next used block 8878286	English	United States
RT_ICON	0xdf5a8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xdf6d0	0xea8	data	English	United States
RT_ICON	0xe0578	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 14543346, next used block 15068915	English	United States
RT_ICON	0xe0e20	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xe1388	0x135a4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0xf4930	0x25a8	data	English	United States
RT_ICON	0xf6ed8	0x10a8	data	English	United States
RT_ICON	0xf7f80	0x468	data	English	United States
RT_ICON	0xf8480	0x668	data	English	United States
RT_ICON	0xf8ae8	0x2e8	data	English	United States
RT_ICON	0xf8dd0	0x128	data	English	United States
RT_ICON	0xf8ef8	0xea8	data	English	United States
RT_ICON	0xf9da0	0x8a8	data	English	United States
RT_ICON	0xfa648	0x568	data	English	United States
RT_ICON	0xfabb0	0x123ff	data	English	United States
RT_ICON	0x10cfb0	0x25a8	data	English	United States
RT_ICON	0x10f558	0x10a8	data	English	United States
RT_ICON	0x110600	0x468	data	English	United States
RT_ICON	0x110b00	0x668	data	English	United States
RT_ICON	0x111168	0x2e8	data	English	United States
RT_ICON	0x111450	0x1e8	data	English	United States
RT_ICON	0x111638	0x128	data	English	United States
RT_ICON	0x111760	0xea8	data	English	United States
RT_ICON	0x112608	0x8a8	data	English	United States
RT_ICON	0x112eb0	0x6c8	data	English	United States
RT_ICON	0x113578	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x113ae0	0x10c29	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x124710	0x25a8	data	English	United States
RT_ICON	0x126cb8	0x10a8	data	English	United States
RT_ICON	0x127d60	0x988	data	English	United States
RT_ICON	0x1286e8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x128c10	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4294967091, next used block 16251135	English	United States
RT_ICON	0x128ef8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x129048	0x668	data	English	United States
RT_ICON	0x1296b0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4294967295, next used block 15792376	English	United States
RT_ICON	0x129998	0x1e8	data	English	United States
RT_ICON	0x129b80	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x129ca8	0xea8	data	English	United States
RT_ICON	0x12ab50	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 15198688, next used block 15395298	English	United States
RT_ICON	0x12b3f8	0x6c8	data	English	United States
RT_ICON	0x12bac0	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x12c028	0x14a2a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x140a58	0x25a8	data	English	United States
RT_ICON	0x143000	0x10a8	data	English	United States
RT_ICON	0x1440a8	0x988	data	English	United States
RT_ICON	0x144a30	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x144f58	0x2e8	data	English	United States
RT_ICON	0x145240	0xe0	data	English	United States
RT_RCDATA	0xdec50	0x8	data	English	United States
RT_RCDATA	0xdec48	0x4	data	English	United States
RT_GROUP_ICON	0xf83e8	0x92	data	English	United States
RT_GROUP_ICON	0x110a68	0x92	data	English	United States
RT_GROUP_ICON	0x128b50	0xbc	data	English	United States
RT_GROUP_ICON	0x129020	0x22	data	English	United States
RT_GROUP_ICON	0x144e98	0xbc	data	English	United States
RT_GROUP_ICON	0x145320	0x22	data	English	United States
RT_VERSION	0xde8c0	0x384	data	English	United States
RT_MANIFEST	0xde3e0	0x4df	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States
None	0x17a950	0x18	data	English	United States
None	0x17a9a0	0x22	data	English	United States
None	0x17a968	0x34	data	English	United States
None	0x17a9c8	0xe	data	English	United States
None	0x17a9d8	0x16	data	English	United States

Imports

DLL	Import
ADVAPI32.dll	TraceMessage, RegCloseKey, TraceEvent, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegQueryValueExW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegisterTraceGuidsW, UnregisterTraceGuids, DuplicateEncryptionInfoFile, RegCreateKeyW, RegDeleteValueW, RegDeleteKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW
KERNEL32.dll	FreeLibrary, FindFirstFileExW, CompareFileTime, GetStringTypeExW, RaiseException, LocalAlloc, lstrlenW, GetUserDefaultUILanguage, LoadLibraryW, GetPrivateProfileSectionNamesW, WritePrivateProfileSectionW, GetPrivateProfileStringW, WritePrivateProfileStringW, WriteFile, CreateFileW, CreateDirectoryW, SetFileAttributesW, GetFileAttributesExW, GetLocalTime, HeapAlloc, GetProcessHeap, FormatMessageW, HeapFree, ExpandEnvironmentStringsW, GetLongPathNameW, GetTimeFormatW, GetDateFormatW, FileTimeToLocalFileTime, GetTempFileNameW, FileTimeToSystemTime, GetCalendarInfoW, GetDriveTypeW, GetFullPathNameW, GlobalReAlloc, Sleep, CloseHandle, WaitForSingleObject, CreateThread, CreateEventW, WaitForMultipleObjects, SetEvent, LocalFileTimeToFileTime, GetModuleFileNameW, LockResource, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetUserDefaultLCID, GetNumberFormatW, GetLocaleInfoW, lstrlenA, WideCharToMultiByte, MultiByteToWideChar, SizeofResource, MapViewOfFile, CreateFileMappingW, UnmapViewOfFile, lstrcmpW, SystemTimeToFileTime, GetSystemTime, GlobalFree, GetModuleHandleExW, GetComputerNameW, SetLastError, LoadResource, FindResourceW, GetTickCount, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleA, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, CopyFileW, SetCurrentDirectoryW, RegisterApplicationRestart, HeapSetInformation, GetCurrentThreadId, CompareStringW, GetLastError, MulDiv, lstrcmpiW, GlobalSize, GlobalUnlock, GlobalLock, GlobalAlloc, GetTempPathW, GetFileAttributesW, DeleteFileW, GetSystemDirectoryW, FindClose, FindNextFileW, FindFirstFileW, CreateProcessW, LocalFree, GetProcAddress, LoadLibraryExA
GDI32.dll	GetStockObject, CreateRectRgnIndirect, DeleteObject, SetBkMode, SetBkColor, SetTextColor, LineTo, MoveToEx, CreateSolidBrush, CreatePolygonRgn, CreateRectRgn, CreateRoundRectRgn, SelectObject, CreatePen, BitBlt, GetObjectW, DeleteEnhMetaFile, CopyEnhMetaFileW, GetObjectA, FillRgn, CombineRgn, RestoreDC, SaveDC, SetLayout, PatBlt, GetDIBits, SelectPalette, Polygon, SetDCPenColor, GetTextExtentPoint32W, MaskBlt, GetTextMetricsW, CreateFontIndirectW, GetCharWidthW, CreateFontW, Rectangle, OffsetWindowOrgEx, CreateCompatibleBitmap, CreateCompatibleDC, GetDeviceCaps, RealizePalette
USER32.dll	SetWindowPlacement, GetWindowPlacement, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, TrackPopupMenu, InsertMenuItemW, SetFocus, GetWindowRect, GetFocus, SetRectEmpty, EnableWindow, SendMessageW, LoadImageW, GetWindowInfo, SystemParametersInfoW, GetDlgItem, DestroyCursor, SetWindowPos, SendMessageTimeoutW, CreateWindowExW, GetSystemMetrics, MoveWindow, GetClientRect, GetDlgCtrlID, RegisterPowerSettingNotification, UnregisterPowerSettingNotification, UpdateWindow, GetDC, ReleaseDC, IsWindow, IsWindowVisible, OffsetRect, MonitorFromRect, GetMonitorInfoW, CopyRect, IntersectRect, MessageBeep, PostMessageW, IsWindowEnabled, GetActiveWindow, ClientToScreen, WindowFromPoint, LoadMenuW, GetSubMenu, SetForegroundWindow, GetMenuItemCount, GetMenuItemID, ModifyMenuW, CheckMenuItem, EnableMenuItem, RedrawWindow, MonitorFromWindow, IsRectEmpty, GetSysColor, GetDesktopWindow, IsZoomed, GetSystemMenu, RemoveMenu, InflateRect, SetRect, LoadStringW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, LockWindowUpdate, WaitForInputIdle, MessageBoxW, LoadIconW, InvalidateRect, TrackPopupMenuEx, MapWindowPoints, AppendMenuW, DestroyWindow, GetWindowLongW, GetClassInfoW, RegisterClassW, GetWindow, SetCapture, DrawFrameControl, ReleaseCapture, DefWindowProcW, UnionRect, IsChild, GetMessageTime, GetMessagePos, DrawFocusRect, SetWindowLongW, BeginPaint, EndPaint, LoadBitmapW, GetParent, FrameRect, ScreenToClient, GetDlgItemTextW, SetDlgItemTextW, GetKeyboardLayout, CharPrevW, CharNextW, LoadAcceleratorsW, EnumChildWindows, TranslateAcceleratorW, GetNextDlgTabItem, MapDialogRect, ShowWindow, CallWindowProcW, PeekMessageW, TranslateMessage, DispatchMessageW, PostQuitMessage, GetProcessDefaultLayout, SetCursorPos, SetCursor, GetCapture, GetCursorPos, GetKeyState, GetScrollPos, SetScrollPos, CheckDlgButton, IsDlgButtonChecked, DestroyIcon, CharLowerW, TrackMouseEvent, InsertMenuW, DrawMenuBar, SetMenuItemBitmaps, DeleteMenu, GetMenuStringW, DestroyMenu, GetForegroundWindow, FindWindowW, PtInRect, GetLastActivePopup, SetActiveWindow, GetMenuItemRect, EqualRect, CreatePopupMenu, SetMenuItemInfoW, DrawEdge, GetAsyncKeyState, GetCursor, GetWindowDC, GetSysColorBrush, GetDoubleClickTime, SetWindowRgn, FillRect, DrawIconEx, DrawTextW, KillTimer, SetTimer, LoadCursorW, IsIconic
MFC42u.dll
msvcp60.dll	?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB, ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z, ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z, ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z, ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z, ??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z, ??0_Lockit@std@@QAE@XZ, ??1_Lockit@std@@QAE@XZ, ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
msvcrt.dll	swscanf, calloc, wcsncmp, towlower, iswupper, _except_handler4_common, _controlfp, ?terminate@@YAXXZ, _onexit, __dllonexit, _unlock, _lock, ??1type_info@@UAE@XZ, _wcmdln, _initterm, __setusermatherr, __p__fmode, _cexit, _exit, exit, __set_app_type, __wgetmainargs, _amsg_exit, __p__commode, _XcptFilter, _callnewh, malloc, wcstoul, _ultow, _purecall, _ltow, qsort, _itow, wcsrchr, tolower, strstr, _wtol, wcschr, iswspace, memmove, _wcsnicmp, free, ceil, _wcsicmp, _wtoi, _vsnwprintf, _CIpow, __CxxFrameHandler3, __RTDynamicCast, _ftol2, _ftol2_sse, memcmp, memcpy, strchr, iswpunct, iswlower, towupper, memset
ATL.DLL
ntdll.dll	WinSqmIncrementDWORD, WinSqmIsOptedIn, EtwTraceMessage
COMCTL32.dll	CreatePropertySheetPageW, ImageList_AddMasked, ImageList_SetBkColor, ImageList_Draw, ImageList_Replace, ImageList_GetIconSize, ImageList_Destroy, ImageList_GetImageInfo, ImageList_GetImageCount, ImageList_Add, ImageList_Remove, ImageList_Create, ImageList_ReplaceIcon
SHELL32.dll	SHGetFileInfoW, SHAppBarMessage, SHBrowseForFolderW, SHGetMalloc, SHGetDesktopFolder, SHGetFolderLocation, SHCreateDirectoryExW, SHSetLocalizedName, SHPathPrepareForWriteW, SHGetFolderPathW, ShellAboutW, ShellExecuteExW, SHGetSettings, SHGetPathFromIDListW, SHGetSpecialFolderPathW, SHGetFolderPathAndSubDirW, SHFileOperationW, ShellExecuteW, SHAddToRecentDocs
SHLWAPI.dll	PathAddBackslashW, PathAppendW, StrRetToBufW, PathFindFileNameW, PathFindExtensionW, PathRemoveFileSpecW, PathIsDirectoryW, PathCompactPathExW, PathRemoveExtensionW, PathFileExistsW, PathStripPathW, PathGetDriveNumberW, SHDeleteValueW, PathCombineW, PathGetCharTypeW, PathRenameExtensionW, PathIsUNCServerW, PathFindSuffixArrayW, StrToIntW, PathIsNetworkPathW, StrChrW, PathStripToRootW, StrFormatByteSizeW, PathRemoveBackslashW, PathCommonPrefixW, PathAddExtensionW, StrToInt64ExW, PathCompactPathW, SHDeleteKeyW, PathUnquoteSpacesW
ole32.dll	PropVariantCopy, PropVariantClear, CreateStreamOnHGlobal, GetHGlobalFromStream, CoCreateInstance, StgCreateStorageEx, StgOpenStorageEx, CoGetClassObject, CoInitialize, CoUninitialize, CoTaskMemFree
OLEAUT32.dll	VariantClear, SystemTimeToVariantTime, VariantTimeToSystemTime, VarBstrFromBool, VarBstrFromI4, VarR8FromStr, SysAllocStringLen, SysStringLen, SysFreeString, SafeArrayCreate, SysAllocString, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayDestroy
UxTheme.dll	CloseThemeData, DrawThemeBackground, GetThemeSysColorBrush, IsThemeActive, GetThemeColor, GetThemeSysFont, OpenThemeData
gdiplus.dll	GdipCreateBitmapFromHBITMAP, GdipFree, GdipAlloc, GdipCloneImage, GdipDisposeImage, GdipSaveImageToStream, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdipGetImageEncodersSize, GdipGetImageEncoders, GdipCloneBitmapAreaI, GdipCreateImageAttributes, GdipDisposeImageAttributes, GdipSetImageAttributesColorMatrix, GdipCreateFromHDC, GdipDeleteGraphics, GdipDrawImageRectRectI, GdipGetImageWidth, GdipGetImageHeight, GdipCreateBitmapFromHICON, GdipGetImageGraphicsContext, GdipDrawImageRectI, GdipGetDC, GdipCreateFontFromDC, GdipCreateFontFromLogfontA, GdipDeleteFont, GdipCreateSolidFill, GdipDeleteBrush, GdipCreateStringFormat, GdipDeleteStringFormat, GdipReleaseDC, GdipSetStringFormatFlags, GdipSetStringFormatAlign, GdipSetStringFormatLineAlign, GdipSetStringFormatHotkeyPrefix, GdipDrawString, GdipCreateBitmapFromGraphics, GdipFillRectangleI

Version Infos

Description	Data
LegalCopyright	Microsoft Corporation. All rights reserved.
InternalName	Journal
FileVersion	6.3.9600.16384 (winblue_rtm.130821-1623)
CompanyName	Microsoft Corporation
ProductName	Microsoft Windows Operating System
ProductVersion	6.3.9600.16384
FileDescription	Windows Journal
OriginalFilename	Journal.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2021 09:02:53.386607885 CEST	49701	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:02:56.461025000 CEST	49701	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:03:02.473582029 CEST	49701	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:03:14.791035891 CEST	49714	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:03:17.787390947 CEST	49714	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:03:23.787832975 CEST	49714	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:03:36.010983944 CEST	49720	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:03:39.023607969 CEST	49720	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:03:45.023981094 CEST	49720	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:03:57.360526085 CEST	49728	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:04:00.368980885 CEST	49728	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:04:06.385082006 CEST	49728	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:04:18.615545988 CEST	49739	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:04:21.605103970 CEST	49739	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:04:27.605583906 CEST	49739	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:04:39.824364901 CEST	49742	3361	192.168.2.5	172.111.153.139
Apr 28, 2021 09:04:42.825614929 CEST	49742	3361	192.168.2.5	172.111.153.139

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2021 09:02:29.947181940 CEST	54302	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:30.007565022 CEST	53	54302	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:30.062077045 CEST	53784	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:30.119309902 CEST	53	53784	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:30.134825945 CEST	65307	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:30.183621883 CEST	53	65307	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:30.260752916 CEST	64344	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:30.309530973 CEST	53	64344	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:30.700342894 CEST	62060	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:30.750925064 CEST	53	62060	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:32.894314051 CEST	61805	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:32.947385073 CEST	53	61805	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:35.826467991 CEST	54795	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:35.875386000 CEST	53	54795	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:44.565186024 CEST	49557	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:44.614751101 CEST	53	49557	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:48.156949997 CEST	61733	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:48.217004061 CEST	53	61733	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:52.700613022 CEST	65447	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:52.865874052 CEST	53	65447	8.8.8.8	192.168.2.5
Apr 28, 2021 09:02:59.154758930 CEST	52441	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:02:59.220971107 CEST	53	52441	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:03.266535044 CEST	62176	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:03.319842100 CEST	53	62176	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:04.214476109 CEST	59596	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:04.263134003 CEST	53	59596	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:05.383236885 CEST	65296	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:05.437521935 CEST	53	65296	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:06.557728052 CEST	63183	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:06.606492043 CEST	53	63183	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:09.187330961 CEST	60151	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:09.236171961 CEST	53	60151	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:14.626178980 CEST	56969	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:14.789544106 CEST	53	56969	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:15.498949051 CEST	55161	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:15.556288004 CEST	53	55161	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:16.600384951 CEST	54757	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:16.652302980 CEST	53	54757	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:17.738449097 CEST	49992	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:17.788547039 CEST	53	49992	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:18.683553934 CEST	60075	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:18.737771034 CEST	53	60075	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:25.437581062 CEST	55016	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:25.488099098 CEST	53	55016	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:35.950160980 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:36.009922028 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:46.357635975 CEST	57128	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:46.406271935 CEST	53	57128	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:51.309922934 CEST	54791	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:51.374849081 CEST	53	54791	8.8.8.8	192.168.2.5
Apr 28, 2021 09:03:57.192759037 CEST	50463	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:03:57.357866049 CEST	53	50463	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:04.797666073 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:04.846271992 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:05.389190912 CEST	58530	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:05.451546907 CEST	53	58530	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:06.035868883 CEST	53813	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:06.092982054 CEST	53	53813	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:06.533291101 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:06.592958927 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:07.113035917 CEST	57344	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:07.164824009 CEST	53	57344	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:07.710644007 CEST	54450	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:07.773583889 CEST	53	54450	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:08.211595058 CEST	59261	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:08.276642084 CEST	53	59261	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:09.139182091 CEST	57151	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:09.201375008 CEST	53	57151	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:10.661036015 CEST	59413	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:10.711323023 CEST	53	59413	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:11.179897070 CEST	60516	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:11.238105059 CEST	53	60516	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:18.542140007 CEST	51649	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:18.590945005 CEST	53	51649	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:21.214562893 CEST	65086	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:21.266357899 CEST	53	65086	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:22.407704115 CEST	56432	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:22.472657919 CEST	53	56432	8.8.8.8	192.168.2.5
Apr 28, 2021 09:04:39.760154009 CEST	52929	53	192.168.2.5	8.8.8.8
Apr 28, 2021 09:04:39.822333097 CEST	53	52929	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 28, 2021 09:02:52.700613022 CEST	192.168.2.5	8.8.8.8	0x94e0	Standard query (0)	rootsec.publicvm.com	A (IP address)	IN (0x0001)
Apr 28, 2021 09:03:14.626178980 CEST	192.168.2.5	8.8.8.8	0x5bfc	Standard query (0)	rootsec.publicvm.com	A (IP address)	IN (0x0001)
Apr 28, 2021 09:03:35.950160980 CEST	192.168.2.5	8.8.8.8	0xa832	Standard query (0)	rootsec.publicvm.com	A (IP address)	IN (0x0001)
Apr 28, 2021 09:03:57.192759037 CEST	192.168.2.5	8.8.8.8	0xe19e	Standard query (0)	rootsec.publicvm.com	A (IP address)	IN (0x0001)
Apr 28, 2021 09:04:18.542140007 CEST	192.168.2.5	8.8.8.8	0xe2cd	Standard query (0)	rootsec.publicvm.com	A (IP address)	IN (0x0001)
Apr 28, 2021 09:04:39.760154009 CEST	192.168.2.5	8.8.8.8	0xd065	Standard query (0)	rootsec.publicvm.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Apr 28, 2021 09:02:52.865874052 CEST	8.8.8.8	192.168.2.5	0x94e0	No error (0)	rootsec.publicvm.com	172.111.153.139	A (IP address)	IN (0x0001)
Apr 28, 2021 09:03:14.789544106 CEST	8.8.8.8	192.168.2.5	0x5bfc	No error (0)	rootsec.publicvm.com	172.111.153.139	A (IP address)	IN (0x0001)
Apr 28, 2021 09:03:36.009922028 CEST	8.8.8.8	192.168.2.5	0xa832	No error (0)	rootsec.publicvm.com	172.111.153.139	A (IP address)	IN (0x0001)
Apr 28, 2021 09:03:57.357866049 CEST	8.8.8.8	192.168.2.5	0xe19e	No error (0)	rootsec.publicvm.com	172.111.153.139	A (IP address)	IN (0x0001)
Apr 28, 2021 09:04:18.590945005 CEST	8.8.8.8	192.168.2.5	0xe2cd	No error (0)	rootsec.publicvm.com	172.111.153.139	A (IP address)	IN (0x0001)
Apr 28, 2021 09:04:39.822333097 CEST	8.8.8.8	192.168.2.5	0xd065	No error (0)	rootsec.publicvm.com	172.111.153.139	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 6c9e4dd7_by_Libranalysis.exe PID: 3752 Parent PID: 5616

General

Start time:	09:02:36
Start date:	28/04/2021
Path:	C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\6c9e4dd7_by_Libranalysis.exe'
Imagebase:	0x400000
File size:	2019840 bytes
MD5 hash:	6C9E4DD7DAAB40A2B40DB3D13279EE2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000001.00000002.259724809.00000000008E0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000001.00000002.259743780.0000000000910000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000001.00000002.259762257.0000000002140000.00000040.00000001.sdmp, Author: Joe Security Rule: netwire, Description: detect netwire in memory, Source: 00000001.00000002.259762257.0000000002140000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: Host.exe PID: 4036 Parent PID: 3752

General

Start time:	09:02:44
Start date:	28/04/2021
Path:	C:\Users\user\AppData\Roaming\Install\Host.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\Install\Host.exe'
Imagebase:	0x400000
File size:	2019840 bytes
MD5 hash:	6C9E4DD7DAAB40A2B40DB3D13279EE2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000002.00000002.511119979.00000000007D0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000002.00000002.511293682.0000000000910000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: C:\Users\user\AppData\Roaming\Install\Host.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 19%, Virustotal, Browse Detection: 19%, ReversingLabs
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 6c9e4dd7_by_Libranalysis.exe PID: 3752 Parent PID: 5616 6c9e4dd7_by_Libranalysis.exeCOMMON

Executed Functions

Non-executed Functions

Function 00440BC5, Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 231registrymemorywindowCOMMON

Download Yara Rule

APIs

RegisterTraceGuidsW.ADVAPI32(Function_0003574B,004D63E8,?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440C91
HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,CNotebookApp::InitApplication,00000000,?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440CBC
WinSqmIsOptedIn.NTDLL ref: 00440D08
WinSqmIncrementDWORD.NTDLL(00000000,0000059E,00000001,?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440D1A
RegisterApplicationRestart.KERNEL32 ref: 00440D27
#6113.MFC42U(Microsoft,?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440D66
#1202.MFC42U(?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440D73
#1172.MFC42U(?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440DBF
#5683.MFC42U(?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440DC8

Part of subcall function 00450081: CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000114,NBMapFile,CPgIpc::IsInstanceOpen,00000000,?,?,?,?,?,004401A9,00000000), ref: 004500AA
Part of subcall function 00450081: GetLastError.KERNEL32(?,?,?,004401A9,00000000), ref: 004500B6

#562.MFC42U(00000000,?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440DFD
#1150.MFC42U ref: 00440E1A
#1165.MFC42U ref: 00440E24
#1143.MFC42U(00000068,0000000E,00000068), ref: 00440E5D
LoadIconW.USER32(00000000), ref: 00440E64
#1229.MFC42U(00004008), ref: 00440E79
#1229.MFC42U(00004008), ref: 00440EA8
#816.MFC42U ref: 00440EDE
#3917.MFC42U ref: 00440EF0

Strings

CNotebookApp::InitApplication, xrefs: 00440CA1
Microsoft, xrefs: 00440D5F
NotePane, xrefs: 00440E9F
8dM, xrefs: 00440C2B
JournalApp, xrefs: 00440E55
DisableJournal, xrefs: 00440CF2
cM, xrefs: 00440C1A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1229Register$#1143#1150#1165#1172#1202#3917#562#5683#6113#816ApplicationCreateErrorFileGuidsHeapIconIncrementInformationLastLoadMappingOptedRestartTrace
String ID: 8dM$CNotebookApp::InitApplication$DisableJournal$JournalApp$Microsoft$NotePane$cM
API String ID: 270527980-2840869522
Opcode ID: da3f41f7d868b6ce19d94c224590114358ec6ff47cb8965d8a430ee3789ec8a2
Instruction ID: 462004492b4578c37e92c712cca8eaeeaf8d48addaf5bcddafe1c97a17a91b50
Opcode Fuzzy Hash: da3f41f7d868b6ce19d94c224590114358ec6ff47cb8965d8a430ee3789ec8a2
Instruction Fuzzy Hash: 9291DCB16053409FE3159FA5DD48B2A7BE5EB88704F14883FFA44972A1DBB8D804CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 004328A6, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004328B0
MonitorFromWindow.USER32(?,00000001), ref: 004328E5
GetMonitorInfoW.USER32 ref: 004328F3
SHAppBarMessage.SHELL32(00000004,?), ref: 0043292F
SetRectEmpty.USER32(?), ref: 00432937
SHAppBarMessage.SHELL32(00000005,00000024), ref: 0043294B
CopyRect.USER32 ref: 00432983
#3916.MFC42U(?), ref: 00432990
memset.MSVCRT ref: 004329A0
IsIconic.USER32 ref: 004329AE
#6191.MFC42U(?), ref: 004329CF
IsZoomed.USER32(?), ref: 004329DC
#6191.MFC42U(?), ref: 004329FD
#6211.MFC42U(00000001), ref: 00432A09
#4294.MFC42U(?,?,?,?,00000001), ref: 00432A2F

Strings

$, xrefs: 00432925
(, xrefs: 004328CD
CMainFrame::SetFullScreenWindowPlacement, xrefs: 004328B9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #6191MessageMonitorRect$#3916#4294#6211CopyEmptyFromH_prolog3_IconicInfoWindowZoomedmemset
String ID: $$($CMainFrame::SetFullScreenWindowPlacement
API String ID: 3715462389-4208253373
Opcode ID: 8f20f4e70c094260a79c6e2efc1d6ad17ad9c06eeec47f8fce522760e324ed7b
Instruction ID: 6d8263bb11eb99d27bb820983eb7e2f18cd2e98e0fe740ce6ea0428dfa2f11f7
Opcode Fuzzy Hash: 8f20f4e70c094260a79c6e2efc1d6ad17ad9c06eeec47f8fce522760e324ed7b
Instruction Fuzzy Hash: 69513D72A00219ABDF10DFA4DD49BEE77B9BF08310F1401AAE505B7190DBB4AE49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00466E2B, Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 255commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00466E32

Part of subcall function 00466C99: #496.MFC42U(?,?,0E0227DC,?,0E0227DC), ref: 00466CAD

Part of subcall function 00467AAF: __EH_prolog3.LIBCMT ref: 00467AB6
Part of subcall function 00467AAF: #489.MFC42U(00000604,00000000,00000008,00466E65,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000), ref: 00467AC8
Part of subcall function 00467AAF: #567.MFC42U(?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000), ref: 00467AF1

Part of subcall function 00469EE7: __EH_prolog3.LIBCMT ref: 00469EEE
Part of subcall function 00469EE7: #489.MFC42U(0000006A,00000000,00000008,00466E75,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings), ref: 00469EFC
Part of subcall function 00469EE7: #567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 00469F4A
Part of subcall function 00469EE7: #567.MFC42U(?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000), ref: 00469F5E
Part of subcall function 00469EE7: #567.MFC42U(?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000), ref: 00469F72

Part of subcall function 0046B508: __EH_prolog3.LIBCMT ref: 0046B50F
Part of subcall function 0046B508: #489.MFC42U(00000607,00000000,00000008,00466E85,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?), ref: 0046B520
Part of subcall function 0046B508: #567.MFC42U(?,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920), ref: 0046B550
Part of subcall function 0046B508: #567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0046B564
Part of subcall function 0046B508: #567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0046B578
Part of subcall function 0046B508: #567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0046B58C
Part of subcall function 0046B508: #567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0046B5A0
Part of subcall function 0046B508: #538.MFC42U(004048E0,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920), ref: 0046B5CC
Part of subcall function 0046B508: #538.MFC42U(004048E0,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920), ref: 0046B5D9

#567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 00466E91
GetLocaleInfoW.KERNEL32(00000400,0000000D,?,00000003,CPageSettingsPropSheet::CPageSettingsPropSheet,00000000,?,?,?,?,?,?,00000074,00432E7A,0000EF59), ref: 00466F0F
_wtoi.MSVCRT ref: 00466F1D
#1165.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 00466F38
CoCreateInstance.OLE32(00404B0C,00000000,00000001,0040E058,00000000,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?), ref: 00466FD5
#30.ATL(?,00000000,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000), ref: 00466FE5
SysAllocStringLen.OLEAUT32(004048E0,00000104), ref: 00467025
#1165.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 00467034
#1165.MFC42U(?,0000004C,00000017,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings), ref: 00467063
SysStringLen.OLEAUT32(00000000), ref: 00467088
SysFreeString.OLEAUT32(00000000), ref: 004670A0
#1008.MFC42U(?,?,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000), ref: 004670E0
#1008.MFC42U(?,?,?,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings), ref: 0046710F
#1008.MFC42U(?,?,?,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings), ref: 0046713E

Strings

CPageSettingsPropSheet::CPageSettingsPropSheet, xrefs: 00466EC8
nF, xrefs: 00466E5A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$#1008#1165#489H_prolog3String$#538$#496AllocCreateFreeH_prolog3_InfoInstanceLocale_wtoi
String ID: nF$CPageSettingsPropSheet::CPageSettingsPropSheet
API String ID: 1057358762-319891450
Opcode ID: 8dc5f774b2b0d685dc1b23c2dc134f5228f69714d635335d4a9196b2c750942f
Instruction ID: 075b0497376a76188a6606a24becd9497fbc38a0e17cd964896c4733c0af8dae
Opcode Fuzzy Hash: 8dc5f774b2b0d685dc1b23c2dc134f5228f69714d635335d4a9196b2c750942f
Instruction Fuzzy Hash: 5EA19F70601205DBDB14DF65C884FAA7BB5BF44308F1480BEED499B286DB789905CBBA

Uniqueness

Uniqueness Score: -1.00%

Function 00465374, Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 347COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0046537B
memcpy.MSVCRT ref: 004653EF
#1165.MFC42U(CNBSettingsMgr::GetDefault,?,00000060,00465327,00000000,00000000,00000000,?,00000000), ref: 00465471

Strings

CNBSettingsMgr::GetDefault, xrefs: 00465389
CRecoLang::GetCount, xrefs: 004655A6
W, xrefs: 00465391

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3_memcpy
String ID: CNBSettingsMgr::GetDefault$CRecoLang::GetCount$W
API String ID: 1903149838-622534726
Opcode ID: d3c2cec58b71516656f240882263b9d9b088f8f12aaeb3dd9a93c9c1f6e64492
Instruction ID: 6a9254dacf00e7ca94d7edda8d0fdcbfde84c9fb7512ea8346cf8f32ac4833b5
Opcode Fuzzy Hash: d3c2cec58b71516656f240882263b9d9b088f8f12aaeb3dd9a93c9c1f6e64492
Instruction Fuzzy Hash: C2D1B471904A09DFDF24DFA5C984AAEB774EF04304F14402FE80AAB255EB38DD42CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0048F1FF, Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 274filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0048F209
memset.MSVCRT ref: 0048F252
lstrlenW.KERNEL32(*.jnt), ref: 0048F285
lstrlenW.KERNEL32(?), ref: 0048F294
PathAddBackslashW.SHLWAPI(?,?), ref: 0048F2CA
FindFirstFileW.KERNEL32(?,?), ref: 0048F2FD
memset.MSVCRT ref: 0048F3AE
PathAddBackslashW.SHLWAPI(?,?,?,?,*.jnt), ref: 0048F3CE
FindNextFileW.KERNEL32(?,00000010), ref: 0048F4DC
GetLastError.KERNEL32(?,00000010), ref: 0048F4E6
FindClose.KERNEL32(?,?,00000010), ref: 0048F573
GetLastError.KERNEL32(?,?,00000010), ref: 0048F57D

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

*.jnt, xrefs: 0048F280, 0048F2D0
CNBFolder::_LoadNewChildren, xrefs: 0048F226

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$BackslashErrorFileLastPathlstrlenmemset$CloseFirstH_prolog3_MessageNextTrace
String ID: *.jnt$CNBFolder::_LoadNewChildren
API String ID: 2926486753-3735464708
Opcode ID: e8670aca796c80a28e384d2d7d63241df89f5b74661732596cd69c73332399a3
Instruction ID: fd6f542b4b59fc0a648ad5f54b6826fe5eee0e0cc39e13b3730808a44c67d7b3
Opcode Fuzzy Hash: e8670aca796c80a28e384d2d7d63241df89f5b74661732596cd69c73332399a3
Instruction Fuzzy Hash: 12B15D70A002299FDB21BF24CC44BBE77B4BF44314F1885EAE449A7251DB389E85CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0048EB15, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 127filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0048EB5E
memset.MSVCRT ref: 0048EB7C
lstrlenW.KERNEL32(*.jnt,?,?,?,?,004D200C,00000000), ref: 0048EB9D
lstrlenW.KERNEL32(?,?,?,?,?,004D200C,00000000), ref: 0048EBAC
PathAddBackslashW.SHLWAPI(00000000,?,?,?,?,?,004D200C,00000000), ref: 0048EBD5
FindFirstFileW.KERNEL32(00000000,?,*.jnt,?,?,?,?,004D200C,00000000), ref: 0048EBFB
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,004D200C,00000000), ref: 0048EC47
GetLastError.KERNEL32(?,?,?,?,004D200C,00000000), ref: 0048EC51
FindClose.KERNEL32(00000000,?,?,?,?,004D200C,00000000), ref: 0048EC72

Strings

*.jnt, xrefs: 0048EB98, 0048EBDB
CNBFolder::_GenerateCheckSumFromFolder, xrefs: 0048EB3F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$Filelstrlenmemset$BackslashCloseErrorFirstLastNextPath
String ID: *.jnt$CNBFolder::_GenerateCheckSumFromFolder
API String ID: 1888283839-3008408915
Opcode ID: d59392b642394b9b3ef6ec64bac7018c0ba0bd92dde51e80c197aae925e46471
Instruction ID: 5378b88a22caf8dafc3b3d4dfdd17c507c97df76e3d6cbd820302a7bcb9f73ec
Opcode Fuzzy Hash: d59392b642394b9b3ef6ec64bac7018c0ba0bd92dde51e80c197aae925e46471
Instruction Fuzzy Hash: 254125B1E001189BDB20AB26CC89BEF7774EB94314F0005ABE60993251EF389E85CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042ACE6, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042ACED
memset.MSVCRT ref: 0042AD23
#1165.MFC42U(?,?,?,000000FF,?,00465982,?,CNBSettingsMgr::Get,0E0227DC), ref: 0042AD42

Part of subcall function 004B058C: FindResourceW.KERNEL32(?,0000009B,?,Helpers::FindResourceW,00000000,00000000,00000000), ref: 004B05B4
Part of subcall function 004B058C: GetLastError.KERNEL32 ref: 004B05C0

#1165.MFC42U(0000000A,?,?,00465982,?,CNBSettingsMgr::Get,0E0227DC), ref: 0042AD5B

Part of subcall function 004B0507: LoadResource.KERNEL32(?,0E0227DC,Helpers::LoadResource,00000000,00000000,00000000), ref: 004B052C
Part of subcall function 004B0507: GetLastError.KERNEL32 ref: 004B0538

LockResource.KERNEL32(00000000,?,?,00465982,?,CNBSettingsMgr::Get,0E0227DC), ref: 0042AD6E
#540.MFC42U(0000000A,?,?,00465982,?,CNBSettingsMgr::Get,0E0227DC), ref: 0042AD79
#4155.MFC42U(?,?,00465982,?,CNBSettingsMgr::Get,0E0227DC), ref: 0042AD98
#861.MFC42U(Arial,?,00465982,?,CNBSettingsMgr::Get,0E0227DC), ref: 0042ADAC
#800.MFC42U(00000000,?,00465982,?,CNBSettingsMgr::Get,0E0227DC), ref: 0042ADC7

Strings

CMainFrame::GetDefaultTextBoxCF, xrefs: 0042ACFD
Arial, xrefs: 0042ADA0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$#1165ErrorLast$#4155#540#800#861FindH_prolog3LoadLockmemset
String ID: Arial$CMainFrame::GetDefaultTextBoxCF
API String ID: 1261118833-3479389043
Opcode ID: 7e6da97bc3d9dbc177b2d737b6b84976a40c32fc66bdb09b91a9e75bc625a35c
Instruction ID: d9637a6b95f86af28ec97992224e82b4ccf3c1b8c4a1de4141ad5a1e0277da9a
Opcode Fuzzy Hash: 7e6da97bc3d9dbc177b2d737b6b84976a40c32fc66bdb09b91a9e75bc625a35c
Instruction Fuzzy Hash: D5319375A00315AFC720DF66DC44AAFBBB4FF44314F50842EE84997281DB78DA45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0047DA73, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 0047DAAB
GlobalLock.KERNEL32 ref: 0047DAB8
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047DB55
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047DB5C
memcpy.MSVCRT ref: 0047DBE5
GlobalUnlock.KERNEL32(?,?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047DBF6
GlobalUnlock.KERNEL32(?,?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047DC0E

Strings

CNotebookDocPrint::GetDVTargetDevice, xrefs: 0047DA89

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$HeapLockUnlock$AllocProcessmemcpy
String ID: CNotebookDocPrint::GetDVTargetDevice
API String ID: 3500571046-3661100551
Opcode ID: 61a93debadcce6af90142e3adba0f5dacf6575ab3d2bd8ef3a4b67ce84fbf7a2
Instruction ID: ab8fbe6628448b3bec0433691a7efb8ed27f5f0d2f2e0db1395cfb3b1423177a
Opcode Fuzzy Hash: 61a93debadcce6af90142e3adba0f5dacf6575ab3d2bd8ef3a4b67ce84fbf7a2
Instruction Fuzzy Hash: 6D514E75E0011ADFCB14DF98C8508EEB7B5FF48304B19819EE919A7321E735AE52CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00440840, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 114windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044084A
#1165.MFC42U(CNotebookApp::_DisplayNoteOnStartup,?,00000258,00441DE0,00000000,00000001,00000000,CNotebookApp::NewNote,?,00000010,0042D258,?), ref: 0044087F
IsIconic.USER32 ref: 0044088A
#1165.MFC42U ref: 00440894
#1165.MFC42U ref: 004408D8

Strings

CNotebookApp::_DisplayNoteOnStartup, xrefs: 00440860
CMainFrame::RequestNewNoteOnRestore, xrefs: 00440897

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3_Iconic
String ID: CMainFrame::RequestNewNoteOnRestore$CNotebookApp::_DisplayNoteOnStartup
API String ID: 1627661914-1321804768
Opcode ID: c66ba1f2ab9f8728ac8668ae62f0baaa157478258d32c6aef6afa6bbe55155b1
Instruction ID: 68a31db8685bb7ba0e305a6d9d29aaf6945cef3a93b6ed2461d4c136ff23f1b2
Opcode Fuzzy Hash: c66ba1f2ab9f8728ac8668ae62f0baaa157478258d32c6aef6afa6bbe55155b1
Instruction Fuzzy Hash: CF417971A412289FEB20EB61CD49FD977B4AF04704F0141EEE6096B2D1DB746E84CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004AE03F, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 189comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004AE049
CoCreateInstance.OLE32(0041E378,00000000,00000001,0041E388,?,CRecoLang::Init,?,00000194,00465573,?,00000000,00000000,CNBSettingsMgr::GetDefault,?,00000060,00465327), ref: 004AE080
memset.MSVCRT ref: 004AE135
#6928.MFC42U ref: 004AE26C

Strings

CRecoLang::Init, xrefs: 004AE059

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #6928CreateH_prolog3_Instancememset
String ID: CRecoLang::Init
API String ID: 3946738903-143657481
Opcode ID: 5bfd17bb6b39a4d9b1c7bb097fbf8a72bf02ff2bd7b6fd036079f022af442eea
Instruction ID: 4382b489c0d62450d89309ce1eb1898f5a5c3175df3992755550c78839676887
Opcode Fuzzy Hash: 5bfd17bb6b39a4d9b1c7bb097fbf8a72bf02ff2bd7b6fd036079f022af442eea
Instruction Fuzzy Hash: 2D719072900228DBDB21CF16CC44BDABBB5FF56704F1041EAE918AB291D7799E81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00485EDE, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79timeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00485EE5
memcpy.MSVCRT ref: 00485F16
GetLocalTime.KERNEL32(?,00000000,0E0227DC), ref: 00485F22
GetLocaleInfoW.KERNEL32(00000400,00000000,?,00000104), ref: 00485F80

Part of subcall function 00485242: __EH_prolog3.LIBCMT ref: 00485249
Part of subcall function 00485242: #1165.MFC42U(_LoadStringWrap,00000000,00000010,00485F62,00000104), ref: 0048526B
Part of subcall function 00485242: GetLastError.KERNEL32(?,00000000,00000000), ref: 00485285

Strings

CTOCView::_InitHistoryCategories, xrefs: 00485EF4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165ErrorH_prolog3H_prolog3_InfoLastLocalLocaleTimememcpy
String ID: CTOCView::_InitHistoryCategories
API String ID: 955344896-2124608414
Opcode ID: 38254cda67322de90fae3af3350c1ad416925efb83d544d7caf34f0d5a69af2b
Instruction ID: e7538dd6d4687889929febeb775f6de6d29ffb6df50d3e5388842d6ca47bd345
Opcode Fuzzy Hash: 38254cda67322de90fae3af3350c1ad416925efb83d544d7caf34f0d5a69af2b
Instruction Fuzzy Hash: 92319171900609AFDB11EFA4C881AEDB7F5AF44314F21082FE754A7280EB78A949CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004BF3D8, Relevance: 7.6, APIs: 5, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 004BF40E
GetCurrentProcessId.KERNEL32 ref: 004BF41D
GetCurrentThreadId.KERNEL32 ref: 004BF426
GetTickCount.KERNEL32 ref: 004BF42F
QueryPerformanceCounter.KERNEL32(?), ref: 004BF444

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 2d34a8ed1d8ac272e5f4168243be81a413e3c54df90be4f019806238f7a10e48
Instruction ID: 96caf2d612cc983f63c707873c255bb2c41867f809e808df6e62c660807e73b0
Opcode Fuzzy Hash: 2d34a8ed1d8ac272e5f4168243be81a413e3c54df90be4f019806238f7a10e48
Instruction Fuzzy Hash: 9F113D71D02208EBCB14DFB8DA485AEB7F4FF68315F5144BBE906D7210DA349A08CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004BDB47, Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 283stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 004BDC6D

Strings

VK, xrefs: 004BDE0D, 004BDE25, 004BDE13
ntdll.dll, xrefs: 004BDCA2
VK, xrefs: 004BDE28

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: strchr
String ID: VK$ VK$ntdll.dll
API String ID: 2830005266-225282929
Opcode ID: 62f1ba4530963bb5ff0c9bfa1eafb1e566821464db7f7f5ddacd74f8c99ca66d
Instruction ID: 9551c3309916583da7105fc7a28afcb2367bb2f7760ef95e01a20ea278735346
Opcode Fuzzy Hash: 62f1ba4530963bb5ff0c9bfa1eafb1e566821464db7f7f5ddacd74f8c99ca66d
Instruction Fuzzy Hash: 2CA18075E042159BCF14CF68C4806EABBB5EF55314F6481ABD845EB340F339AD82CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004BED37, Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,004BEE72,0040106C), ref: 004BED3E
UnhandledExceptionFilter.KERNEL32(004BEE72,?,004BEE72,0040106C), ref: 004BED47
GetCurrentProcess.KERNEL32(C0000409,?,004BEE72,0040106C), ref: 004BED52
TerminateProcess.KERNEL32(00000000,?,004BEE72,0040106C), ref: 004BED59

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 2e17b641dd0e7b1cacd2dba5e12b3ebde8274ba7a9fbfbdd3297f3ddd18e1e66
Instruction ID: f31fed9b69a677e530deeda5487b29f742799f0f0e5967ed2074f89f257fbce3
Opcode Fuzzy Hash: 2e17b641dd0e7b1cacd2dba5e12b3ebde8274ba7a9fbfbdd3297f3ddd18e1e66
Instruction Fuzzy Hash: 52D0123204A608BFC7002BE1EC0DE693F28EB84312F0444EAF30982030DF7144018B59

Uniqueness

Uniqueness Score: -1.00%

Function 004B81C1, Relevance: 1.3, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040,00000000), ref: 004B8220

Memory Dump Source

Source File: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2612a907bd166f041c8c042c12ae779f0fef6286e4f0420e19bb3b8ea1658cbd
Instruction ID: 22ace8ac02f42b1bfa4a10b2d902e5e02f222ddbc8d3b0f1dc82abbbf8215ef5
Opcode Fuzzy Hash: 2612a907bd166f041c8c042c12ae779f0fef6286e4f0420e19bb3b8ea1658cbd
Instruction Fuzzy Hash: 3801DB76500A045FEB349918D851BE773A9E749320F05055EED46A7741DA347D02C6F5

Uniqueness

Uniqueness Score: -1.00%

Function 00441DFD, Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 413stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00441E07
memset.MSVCRT ref: 00441E53
memset.MSVCRT ref: 00441E6D
#540.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00441E97
#540.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00441EA3
PathFindExtensionW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00441EDD
#540.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00441F17
#540.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00441F23
#2809.MFC42U(?,00009CCE,*.jpg;*.jpeg;*.gif;*.png;*.wmf;*.emf;*.bmp;*.tif;*.tiff,*.jpg;*.jpeg;*.gif;*.png;*.wmf;*.emf;*.bmp;*.tif;*.tiff,*.jpg;*.jpeg,*.jpg;*.jpeg,*.gif,*.gif,*.png,*.png,*.wmf;*.emf,*.wmf;*.emf,*.bmp,*.bmp,*.tif;*.tiff,*.tif;*.tiff), ref: 00441F9B
#2809.MFC42U(?,00009CC4,*.jtp,*.jtp,*.jnt,*.jnt,*.jnt;*.jtp,*.jnt;*.jtp), ref: 00441FDB
#4155.MFC42U(0000EFD6,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00442002
#4155.MFC42U(0000EFD7,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 0044200F
#2809.MFC42U(?,00009CC3,*.*,*.*,*.jnt;*.jtp,*.jnt;*.jtp,*.tif;*.tiff,*.tif;*.tiff), ref: 0044203B
#4155.MFC42U(0000DB9D,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00442060
#4155.MFC42U(0000DB9E,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 0044206D
#2809.MFC42U(?,00009CCB,*.mht;*.mhtml,*.mht;*.mhtml,*.tif;*.tiff,*.tif;*.tiff), ref: 0044208E
#4155.MFC42U(0000EFF4,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 004420B8
#4155.MFC42U(0000DB9F,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 004420C5
#2809.MFC42U(?,00009CCA,*.jpg;*.jpeg;*.gif;*.png;*.wmf;*.emf;*.bmp,*.jpg;*.jpeg;*.gif;*.png;*.wmf;*.emf;*.bmp,*.jpg;*.jpeg,*.jpg;*.jpeg,*.gif,*.gif,*.png,*.png,*.wmf;*.emf,*.wmf;*.emf,*.bmp,*.bmp), ref: 004420FD
#1165.MFC42U(.jnt), ref: 004421C2
PathIsDirectoryW.SHLWAPI(?), ref: 00442252
#800.MFC42U(00000000,?,00000000,00000059,?,?,.jnt,?,00000001,?,?,?), ref: 004422D8
memset.MSVCRT ref: 004422F0
PathRemoveFileSpecW.SHLWAPI(?,?), ref: 00442315
lstrlenW.KERNEL32(?,?), ref: 00442329
#800.MFC42U(00000000,00000059,?,?,.jnt,?,00000001,?,?,?), ref: 00442363
#800.MFC42U ref: 0044236F
#800.MFC42U ref: 0044237B
#800.MFC42U ref: 00442388

Strings

*.jpg;*.jpeg;*.gif;*.png;*.wmf;*.emf;*.bmp;*.tif;*.tiff, xrefs: 00441F88, 00441F8D, 00441F8E
.mht, xrefs: 00442074
*.png, xrefs: 00441F73, 00441F78, 00441F79, 004420D5, 004420DA, 004420DB
*.tif;*.tiff, xrefs: 00441F5C, 00441F63, 00441F64, 00442014, 0044201F, 00442020, 0044206F, 00442079, 0044207A
*.bmp, xrefs: 00441F65, 00441F6A, 00441F6B, 004420C7, 004420CC, 004420CD
*.jpg;*.jpeg, xrefs: 00441F81, 00441F86, 00441F87, 004420E3, 004420E8, 004420E9
*.gif, xrefs: 00441F7A, 00441F7F, 00441F80, 004420DC, 004420E1, 004420E2
*.*, xrefs: 00442026, 0044202D, 0044202E
*.wmf;*.emf, xrefs: 00441F6C, 00441F71, 00441F72, 004420CE, 004420D3, 004420D4
CNotebookApp::ShowFileDialog, xrefs: 00441E27
*.jpg;*.jpeg;*.gif;*.png;*.wmf;*.emf;*.bmp, xrefs: 004420EA, 004420EF, 004420F0
.jnt, xrefs: 0044211F, 00442175, 004421E8
*.jtp, xrefs: 00441FC8, 00441FCD, 00441FCE, 0044210D, 00442118, 00442119, 00442170, 0044217A, 0044217B
*.mht;*.mhtml, xrefs: 0044207B, 00442080, 00442081
*.jnt;*.jtp, xrefs: 00441FB2, 00441FBA, 00441FBB, 00442021, 0044202B, 0044202C, 00442166, 0044216E, 0044216F
*.jnt, xrefs: 00441FBC, 00441FC6, 00441FC7, 0044211A, 00442124, 00442125, 0044217C, 00442181, 00442182
.jtp, xrefs: 00441FC1, 0044213E, 00442148, 004421A5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #4155$#2809#800$#540$Pathmemset$#1165DirectoryExtensionFileFindH_prolog3_RemoveSpeclstrlen
String ID: *.*$*.bmp$*.gif$*.jnt$*.jnt;*.jtp$*.jpg;*.jpeg$*.jpg;*.jpeg;*.gif;*.png;*.wmf;*.emf;*.bmp$*.jpg;*.jpeg;*.gif;*.png;*.wmf;*.emf;*.bmp;*.tif;*.tiff$*.jtp$*.mht;*.mhtml$*.png$*.tif;*.tiff$*.wmf;*.emf$.jnt$.jtp$.mht$CNotebookApp::ShowFileDialog
API String ID: 1899920773-1919028606
Opcode ID: 882c5e90693d11d8694c6fab3ef234d5a858909cc04c30a8db2060a879eec4af
Instruction ID: fb313c875efc6cc4b7121dac77c4b2885975201ba830b52dbb85e83c69367b64
Opcode Fuzzy Hash: 882c5e90693d11d8694c6fab3ef234d5a858909cc04c30a8db2060a879eec4af
Instruction Fuzzy Hash: CDE13FB1900219AFEB20DB54CD55FAF7BB8EB08304F4041ABB909E7291DB745E85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0047D021, Relevance: 68.6, APIs: 38, Strings: 1, Instructions: 305stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0047D02B

Part of subcall function 0047E152: __EH_prolog3.LIBCMT ref: 0047E159
Part of subcall function 0047E152: #324.MFC42U(0000009A,00000000,00000010,0047D06D,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324), ref: 0047E16A
Part of subcall function 0047E152: #540.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E183
Part of subcall function 0047E152: #540.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E18C
Part of subcall function 0047E152: #540.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E195
Part of subcall function 0047E152: #861.MFC42U(004048E0,CPrintingNoteDlg::CPrintingNoteDlg,00000000,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000), ref: 0047E1BA
Part of subcall function 0047E152: #861.MFC42U(004048E0,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E1C4
Part of subcall function 0047E152: #861.MFC42U(004048E0,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E1CE

#3062.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D08D
#1165.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D0A6

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

lstrlenW.KERNEL32(?,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D0DF
#2606.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D154
#1165.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D15A
#1165.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D192
#1165.MFC42U(?,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D1D1
#538.MFC42U(0000F045,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D234
#538.MFC42U(0000F046,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D245
#538.MFC42U(0000F047,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D256
#538.MFC42U(0000F048,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D267
#355.MFC42U(00000000,?,?,00000006,?,00000000,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000), ref: 0047D28B
#2507.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D2A7
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D2CA
#641.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D2D6
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D2E6
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D2F2
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D2FE
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D30C
#3494.MFC42U(?,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D320
#858.MFC42U(00000000,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D32E
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D344
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D350
#641.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D35C
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D36C
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D378
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D384
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D392
#1165.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D3AE
#1165.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D3E3
#1165.MFC42U(?,?,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000), ref: 0047D3FE
#861.MFC42U(?,?,?,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000), ref: 0047D423
#3069.MFC42U(?,?,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000), ref: 0047D432
#858.MFC42U(00000000,?,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000), ref: 0047D443
#800.MFC42U(?,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D455
#2506.MFC42U(?,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D468

Part of subcall function 0047CE44: GlobalAlloc.KERNEL32(00000040,0E0227DC,?,?,0E0227DC,?,GetPrinterDevice,00000000,6DEDD6D0,80004005), ref: 0047CEA9

#1165.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D47E

Strings

CNotebookDocPrint::OnPrint, xrefs: 0047D047

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #800$#1165$#538#861$#540$#641#858$#2506#2507#2606#3062#3069#324#3494#355AllocGlobalH_prolog3H_prolog3_lstrlen
String ID: CNotebookDocPrint::OnPrint
API String ID: 1102600075-4123522087
Opcode ID: 9026a914d2c13352bd0ad759ad1b469e96c40d35cae79a2719f6284da432b021
Instruction ID: 11b3c77699cd78de54128a2a0c481640680764ec7cf85f19c0e7533e1bc64c7c
Opcode Fuzzy Hash: 9026a914d2c13352bd0ad759ad1b469e96c40d35cae79a2719f6284da432b021
Instruction Fuzzy Hash: A7D12A74911258DFDB15DF64CD98BA9BBB8BF18305F0480EED809A7291DB34AB44CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0042C0E6, Relevance: 65.1, APIs: 30, Strings: 7, Instructions: 356windowregistryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042C0ED
#1165.MFC42U(CMainFrame::LoadToolbars,?,00000060,0042B599,00000000,?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016), ref: 0042C123
#540.MFC42U(?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016,?,00000001,00000075,00000000,00000007), ref: 0042C164
#3792.MFC42U(?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016,?,00000001,00000075,00000000,00000007), ref: 0042C179
#2810.MFC42U(?,%s\,?,?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016,?,00000001), ref: 0042C19A
RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,00000000,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042C1B6
#540.MFC42U(?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013,?,?,?,?,00009CEB), ref: 0042C1E2
SendMessageW.USER32(?,00000423,00000000,00000000), ref: 0042C20E
SendMessageW.USER32(?,00000423,00000001,00000000), ref: 0042C21F
SendMessageW.USER32(?,00000423,00000002,00000000), ref: 0042C230
SendMessageW.USER32(?,00000423,00000003,00000000), ref: 0042C241
SendMessageW.USER32(?,0000040C,00000000,00000000), ref: 0042C25F

Part of subcall function 00465B59: __EH_prolog3.LIBCMT ref: 00465B60
Part of subcall function 00465B59: lstrlenW.KERNEL32(?,CNBSettingsMgr::Get,00000000,0000000C,00464A66,80070057,00000061,CNBSettingsMgr::GetAppRegistryKey,00000000,0000000C,0046516D), ref: 00465BA5

#2810.MFC42U(0000000B,%s\%s%s,?,Band,?,?,80004006,?,?,00000096,00000003,?,?,?,?,0000008A), ref: 0042C294
RegOpenKeyExW.ADVAPI32(?,0000000B,00000000,000F003F,00000000,?,?,?,?,?,?,?,00000003), ref: 0042C2B2
RegCloseKey.ADVAPI32(00000000,?,00403720,?,?,?,?,?,?,?,00000003,?,?,?,?,0000008A), ref: 0042C38D
RegCloseKey.ADVAPI32(00000000,?,80004006,?,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042C3AF
#800.MFC42U(?,80004006,?,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042C3C1
SendMessageW.USER32(?,00000423,00000000,00000000), ref: 0042C3F3
SendMessageW.USER32(?,00000423,00000001,00000000), ref: 0042C403
SendMessageW.USER32(?,00000423,00000002,00000000), ref: 0042C413
SendMessageW.USER32(?,00000423,00000003,00000000), ref: 0042C423
SendMessageW.USER32(?,00000410,00000070,00000000), ref: 0042C433
SendMessageW.USER32(?,00000427,00000000,00000000), ref: 0042C443
SendMessageW.USER32(?,00000410,00000075,00000000), ref: 0042C454
SendMessageW.USER32(?,00000427,00000000,00000001), ref: 0042C460
SendMessageW.USER32(?,00000410,00000071,00000000), ref: 0042C471
SendMessageW.USER32(?,00000427,00000000,00000002), ref: 0042C47D
SendMessageW.USER32(?,00000410,00000072,00000000), ref: 0042C48E
SendMessageW.USER32(?,00000427,00000000,00000003), ref: 0042C49A

Part of subcall function 00435542: RegQueryValueExW.ADVAPI32(?,004649F1,00000000,00000000,?,?,?,?,?,004649F1), ref: 00435566

#800.MFC42U(?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016,?,00000001,00000075,00000000,00000007,?), ref: 0042C521

Strings

CMainFrame::LoadToolbars, xrefs: 0042C100
Size, xrefs: 0042C2F8
Band, xrefs: 0042C283
Normal, xrefs: 0042C172, 0042C186, 0042C1B2
%s\, xrefs: 0042C191
%s\%s%s, xrefs: 0042C28E
Flags, xrefs: 0042C2DF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$#2810#540#800CloseOpen$#1165#3792H_prolog3H_prolog3_QueryValuelstrlen
String ID: %s\$%s\%s%s$Band$CMainFrame::LoadToolbars$Flags$Normal$Size
API String ID: 3950929911-761130005
Opcode ID: 727ce5f00ce4dde761ab411bed2ef3fc76fc05b98e41484e022826302035ec4b
Instruction ID: 862fe87d913854e82722f054881f6dde6891fbe0579c14f1ece8147ad016a727
Opcode Fuzzy Hash: 727ce5f00ce4dde761ab411bed2ef3fc76fc05b98e41484e022826302035ec4b
Instruction Fuzzy Hash: 68D1C571A41258BAEF11DFA1DC86FDE7B78EF44700F14403AF905BA1D1DAB85A04CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004426C6, Relevance: 61.6, APIs: 33, Strings: 2, Instructions: 308stringwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004426D0
#540.MFC42U(CNotebookApp::DisplayMessageBox,00000000,00000478,00445F8C,0000EF6C,00000003,?), ref: 00442701
#540.MFC42U ref: 0044270D
#540.MFC42U ref: 00442719

Part of subcall function 0043549E: #1172.MFC42U(00442724), ref: 0043549E

GetLastActivePopup.USER32(?), ref: 00442730
memset.MSVCRT ref: 00442753
memset.MSVCRT ref: 0044276D
memset.MSVCRT ref: 00442787
memset.MSVCRT ref: 004427A1
PathCompactPathExW.SHLWAPI(?,?,00000082,00000000), ref: 004427D4
lstrlenW.KERNEL32(00000000), ref: 004427EB
lstrlenW.KERNEL32(00000000), ref: 00442817
#4155.MFC42U(?), ref: 00442847
#4155.MFC42U(00000000), ref: 00442864
#4155.MFC42U(00000000), ref: 004428B0
lstrlenW.KERNEL32(00000000), ref: 004428D0
#861.MFC42U(00000000), ref: 004428FC
#4155.MFC42U(0000EF20), ref: 0044290F
#6868.MFC42U(00404B90,?), ref: 00442935
#6868.MFC42U(00404B88,00000000), ref: 0044294B
#6868.MFC42U(00404B80,00000000), ref: 00442961
#1165.MFC42U ref: 0044297B
#4155.MFC42U(0000EFD2), ref: 004429C9
#6868.MFC42U(00404B90,?), ref: 004429DE
FormatMessageW.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000), ref: 00442A02
#6868.MFC42U(00404B88,004048E0), ref: 00442A21
#6868.MFC42U(00404B88,00000000), ref: 00442A30
LocalFree.KERNEL32(00000000), ref: 00442A38

Part of subcall function 0042A24B: TraceMessage.ADVAPI32(?,?,0000002B,0041E420,0000000A,NULL,0000000A,00000000,?,00000000,?,0000000A,?,004AE8A8,00969CB0,0000EF51), ref: 0042A2B2

#4155.MFC42U(00000000), ref: 0044288A

Part of subcall function 0047C511: __EH_prolog3.LIBCMT ref: 0047C518
Part of subcall function 0047C511: #535.MFC42U(?,00000004,00442A5F), ref: 0047C525
Part of subcall function 0047C511: #2820.MFC42U(?,0000F000,?,?,?,00000004,00442A5F), ref: 0047C53A
Part of subcall function 0047C511: #800.MFC42U ref: 0047C54A

MessageBoxW.USER32(?,?,?,?), ref: 00442B17
#800.MFC42U ref: 00442B45
#800.MFC42U ref: 00442B51
#800.MFC42U ref: 00442B5D

Strings

CNotebookApp::DisplayMessageBox, xrefs: 004426E6
0x%.8x, xrefs: 004429A9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #4155#6868$#800memset$#540Messagelstrlen$Path$#1165#1172#2820#535#861ActiveCompactFormatFreeH_prolog3H_prolog3_catch_LastLocalPopupTrace
String ID: 0x%.8x$CNotebookApp::DisplayMessageBox
API String ID: 1081643009-2208776809
Opcode ID: 1c0055054c249441e9d9ce69d28e245a3627f5f371ab13fcdd88abc45cec6b54
Instruction ID: 277eb4037833c3a7c0d1c649619afe0594bc53dc4541a7ae21dcfc3d6723ab17
Opcode Fuzzy Hash: 1c0055054c249441e9d9ce69d28e245a3627f5f371ab13fcdd88abc45cec6b54
Instruction Fuzzy Hash: FBD171B0900218DFEF219F50CD88BEA7B74FF55308F1440EAE90966191EBB99E85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FEEA, Relevance: 46.0, APIs: 25, Strings: 1, Instructions: 497COMMON

Download Yara Rule

APIs

#1165.MFC42U(CMainFrame::OnUpdateToolbarItem,00000000,0E0227DC), ref: 0042FF2F

Part of subcall function 0042ED4F: __EH_prolog3.LIBCMT ref: 0042ED56
Part of subcall function 0042ED4F: #1165.MFC42U(CMainFrame::IsCommandEnabled,00000000,00000018,0042C71E,00000000), ref: 0042ED78

#1165.MFC42U ref: 00430001
#1165.MFC42U ref: 00430016
#1165.MFC42U ref: 0043003C
#1165.MFC42U ref: 00430112
#1165.MFC42U ref: 0043013C
#1165.MFC42U ref: 0043018E
#1165.MFC42U ref: 004301EA
#1165.MFC42U ref: 004302DB
#1165.MFC42U ref: 004302E8
#1165.MFC42U ref: 0043031C
#1165.MFC42U ref: 00430329
#1165.MFC42U ref: 0043034E
#1165.MFC42U ref: 0043035B
#1165.MFC42U ref: 00430386
#1165.MFC42U ref: 00430397
#1165.MFC42U ref: 004303B4
#1165.MFC42U ref: 004303E1
#1165.MFC42U ref: 004303F2
#1165.MFC42U ref: 00430414
#1165.MFC42U ref: 00430466
#1165.MFC42U ref: 004304EC
#1165.MFC42U(00000001,00000002), ref: 004305BB
#1165.MFC42U ref: 004305E2
#1165.MFC42U ref: 004305F3

Strings

CMainFrame::OnUpdateToolbarItem, xrefs: 0042FF21

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CMainFrame::OnUpdateToolbarItem
API String ID: 3111753120-2224311292
Opcode ID: 73577405e326374f5bbd54423c49b489be797b0f6adf98042e2d1ce5c1cd2d24
Instruction ID: bc293713ae1c4cb32477b8b8bba78229c17d4268689e4520df0248da2dad3ff0
Opcode Fuzzy Hash: 73577405e326374f5bbd54423c49b489be797b0f6adf98042e2d1ce5c1cd2d24
Instruction Fuzzy Hash: 3812C530201601DFD718DB25C9A8B6BFBE0BF48708F14566BE855872A2DB38EC45CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00434E48, Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 248windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00434E52
GetClientRect.USER32 ref: 00434EBD
SendMessageW.USER32(?,00000418,00000000,00000000), ref: 00434ECF
SendMessageW.USER32(?,0000041D,00000000,?), ref: 00434EF5
IntersectRect.USER32 ref: 00434F10
EqualRect.USER32 ref: 00434F24
CreatePopupMenu.USER32 ref: 00434F6B
#1637.MFC42U(00000000), ref: 00434F78
#3792.MFC42U ref: 00434F99
SendMessageW.USER32(?,00000417,?,?), ref: 00434FCE
#1165.MFC42U ref: 00435000
#1165.MFC42U(?,00000104,00000000), ref: 0043503D
#1165.MFC42U(?,00000104,00000000), ref: 0043505A
#1143.MFC42U(0000008D,00000004,0000008D,?,00000104,00000000), ref: 004350A8
LoadMenuW.USER32 ref: 004350AF
#1637.MFC42U(00000000), ref: 004350BC
GetSubMenu.USER32 ref: 004350CA
#2858.MFC42U(00000000), ref: 004350D1
AppendMenuW.USER32 ref: 004350E9
AppendMenuW.USER32 ref: 00435119
#1165.MFC42U ref: 0043513D
MapWindowPoints.USER32 ref: 00435173
TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000014), ref: 004351FB

Strings

p, xrefs: 0043502A
CMainFrame::ShowReBarChevronMenu, xrefs: 00434E6A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$#1165$MessageRectSend$#1637AppendPopup$#1143#2858#3792ClientCreateEqualH_prolog3_IntersectLoadPointsTrackWindow
String ID: CMainFrame::ShowReBarChevronMenu$p
API String ID: 3316261621-1528899429
Opcode ID: d230ca96eca4c0cdfb64f04a8150df4bf5e698ef8cec33b323b6b6eec9d6740e
Instruction ID: 79b1826ed8591d3d2eb5d892c6b197e09458419b98c84925588f548878058c0c
Opcode Fuzzy Hash: d230ca96eca4c0cdfb64f04a8150df4bf5e698ef8cec33b323b6b6eec9d6740e
Instruction Fuzzy Hash: 4AB14C31901619AFDF60DF60CC8DBEAB7B5FB08305F1040EAE509A6191CB78AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0044E6D4, Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 228windowCOMMON

Download Yara Rule

APIs

#1165.MFC42U ref: 0044E71F
#1165.MFC42U ref: 0044E73C
#1165.MFC42U(00000000,0000000A), ref: 0044E762
ClientToScreen.USER32(?,?), ref: 0044E7AA
#1165.MFC42U ref: 0044E7C1
#1165.MFC42U ref: 0044E7E4
#1165.MFC42U ref: 0044E803
#1165.MFC42U ref: 0044E822
#1165.MFC42U ref: 0044E836
#1165.MFC42U ref: 0044E842
#1165.MFC42U ref: 0044E84E
LoadMenuW.USER32 ref: 0044E863
GetSubMenu.USER32 ref: 0044E876
#540.MFC42U ref: 0044E892
#4155.MFC42U(00009CEA), ref: 0044E8A5
memset.MSVCRT ref: 0044E8B8
InsertMenuItemW.USER32(?,?,?,00000000), ref: 0044E8F2
InsertMenuItemW.USER32(?,00000001,00000001,00000030), ref: 0044E919
#800.MFC42U(?,?,?,?,?,?,?,?,?,?,00000000,00000001,?), ref: 0044E928
#1165.MFC42U ref: 0044E938
#1165.MFC42U ref: 0044E955
TrackPopupMenu.USER32(?,00000002,?,?,00000000,?,00000000), ref: 0044E976
DestroyMenu.USER32(00000000), ref: 0044E97D

Strings

0, xrefs: 0044E8D1
CNotebookView::OnShowOOUI, xrefs: 0044E706

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$Menu$InsertItem$#4155#540#800ClientDestroyLoadPopupScreenTrackmemset
String ID: 0$CNotebookView::OnShowOOUI
API String ID: 2486610489-2873219778
Opcode ID: 745f852d277c584670ac1ad98205c3a8cd88f0dfc9c1b61fe835a3361b18ed0a
Instruction ID: 778f131506e972e8cf56d482543f2cb63d662eb49657923ccbbc81c6712568a8
Opcode Fuzzy Hash: 745f852d277c584670ac1ad98205c3a8cd88f0dfc9c1b61fe835a3361b18ed0a
Instruction Fuzzy Hash: 5F914A70209341AFE710DF26C889F6AB7E4FF84724F04492EF585972A1DB78D905CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00432A4D, Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 200windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00432A57

Part of subcall function 0042BE8C: __EH_prolog3_GS.LIBCMT ref: 0042BE96
Part of subcall function 0042BE8C: #1165.MFC42U(CMainFrame::SaveToolbars,?,000000A4,00432A87,CMainFrame::SetFullScreen,?,00000248,0044D207,00000000), ref: 0042BECF
Part of subcall function 0042BE8C: #540.MFC42U ref: 0042BF2E
Part of subcall function 0042BE8C: #540.MFC42U ref: 0042BF3A
Part of subcall function 0042BE8C: #3792.MFC42U ref: 0042BF42
Part of subcall function 0042BE8C: #2810.MFC42U(?,%s\,FullScreen), ref: 0042BF66
Part of subcall function 0042BE8C: SendMessageW.USER32(?,0000040C,00000000,00000000), ref: 0042BF8F
Part of subcall function 0042BE8C: SendMessageW.USER32(?,0000041C,00000000,00000064), ref: 0042BFB8
Part of subcall function 0042BE8C: #2810.MFC42U(?,%s\%s%s,?,Band,00000000), ref: 0042BFF2

#1165.MFC42U(0000002C), ref: 00432ABF

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

#1165.MFC42U(0000002C), ref: 00432AE4
#4279.MFC42U(00C40000,00000000,00000000,00000002,00000001,0000002C), ref: 00432B63
GetSystemMenu.USER32(?,00000000), ref: 00432B6D
#2858.MFC42U(00000000), ref: 00432B74
RemoveMenu.USER32(?,0000F010,00000000), ref: 00432B97
RemoveMenu.USER32(00000000,0000F000,00000000), ref: 00432BA9
RemoveMenu.USER32(00000000,0000F030,00000000), ref: 00432BBB
InsertMenuW.USER32(00000000,00000000,00000C00,00000000,00000000), ref: 00432BD0
memset.MSVCRT ref: 00432BEC
#1165.MFC42U(00000000,0E0227DC), ref: 00432BF4
InsertMenuW.USER32(00000000,00000000,00000400,00009C96,?), ref: 00432C44
DrawMenuBar.USER32(?), ref: 00432C4D
#4279.MFC42U(00000000,00C40000,00000000), ref: 00432C78
GetSystemMenu.USER32(?,00000001), ref: 00432C85
#2858.MFC42U(00000000), ref: 00432C8C
#1165.MFC42U ref: 00432C92
#6211.MFC42U(?,0000002C,0000002C,00000018), ref: 00432CCB
#6191.MFC42U(0000002C,0000002C,0000002C,00000018), ref: 00432CDA

Part of subcall function 0042B620: __EH_prolog3.LIBCMT ref: 0042B627
Part of subcall function 0042B620: #3792.MFC42U(CMainFrame::GetWindowPlacement,00000000,00000008,00465486,?), ref: 0042B64F
Part of subcall function 0042B620: #1165.MFC42U ref: 0042B65C

Strings

CMainFrame::SetFullScreen, xrefs: 00432A67
FullScreen, xrefs: 00432C5A
Exit Full Screen, xrefs: 00432C19
,, xrefs: 00432A8F
Normal, xrefs: 00432CE0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$#1165$Remove$#2810#2858#3792#4279#540H_prolog3_InsertMessageSendSystem$#6191#6211DrawH_prolog3memcpymemset
String ID: ,$CMainFrame::SetFullScreen$Exit Full Screen$FullScreen$Normal
API String ID: 3669864964-2888387031
Opcode ID: e3b692988c4488d9dd1d42924fa9ad6eb1140f07c53573ad730be5a876e14974
Instruction ID: 316f230d4a414acc477b2ea85eb81261f7f73812acbc3fa789bbb501ac928cac
Opcode Fuzzy Hash: e3b692988c4488d9dd1d42924fa9ad6eb1140f07c53573ad730be5a876e14974
Instruction Fuzzy Hash: 7771B571641225AFDB20AF61DD49FAEB768EF08700F0040ABF509A71A1DFB89D40CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0044547B, Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 276COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00445485
#1165.MFC42U(CNotebookDoc::OpenCreateDocument,00000000,00000254,00432F2D,00000000,00000000,00000000,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000), ref: 00445507
LockWindowUpdate.USER32(?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00445515
#1165.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044551B
PathFindExtensionW.SHLWAPI(?,00000001,CPgIpc::OnOpenDocument,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044558C
#538.MFC42U(00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00445599
_wcsicmp.MSVCRT ref: 004455AA
#800.MFC42U(?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 004455C2
#1165.MFC42U(00000001,CPgIpc::OnOpenDocument,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 004455C8
#1165.MFC42U(00000000,?,?,?,00000000,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00445696
#6325.MFC42U(00000000,00000000,00000000,00000000,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 004456D9
#1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 004456DF
#1165.MFC42U(00000000,?,00000000,CNotebookDoc::_LoadDocumentMetadata,00000000,?,?,?,00000000,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920), ref: 004457CB
#1165.MFC42U(00000001,CPgIpc::OnOpenDocument,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 004457F7
LockWindowUpdate.USER32(00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 004457FB
#1165.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00445805
UpdateWindow.USER32(?), ref: 00445815
#1165.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044581B

Part of subcall function 00435657: memset.MSVCRT ref: 0043566C
Part of subcall function 00435657: TraceEvent.ADVAPI32(0E0227DC,00000000,?,00000002,?,00000000), ref: 004356A5

Strings

CMainFrame::SetDefaultPen, xrefs: 0044581F
CNotebookDoc::_LoadDocumentMetadata, xrefs: 00445705
.jtp, xrefs: 0044559F
CNotebookDoc::OpenCreateDocument, xrefs: 004454A3
CPgIpc::OnOpenDocument, xrefs: 00445534
,TD, xrefs: 00445774

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$UpdateWindow$Lock$#538#6325#800EventExtensionFindH_prolog3_PathTrace_wcsicmpmemset
String ID: ,TD$.jtp$CMainFrame::SetDefaultPen$CNotebookDoc::OpenCreateDocument$CNotebookDoc::_LoadDocumentMetadata$CPgIpc::OnOpenDocument
API String ID: 3636976450-548299490
Opcode ID: 93190c2bf0f5bd1a399e44b4749413c13b764d5fd192dc5b01d7fc95e088f849
Instruction ID: 3a09bf0660a7f8db3a3be3cb9e5d0d995553eba03946a6d4172b570ba45afb6b
Opcode Fuzzy Hash: 93190c2bf0f5bd1a399e44b4749413c13b764d5fd192dc5b01d7fc95e088f849
Instruction Fuzzy Hash: 8DB19F316016159FEB11EB25CD89BAEB7B4EF54314F1540EEE509AB292CF389E40CF18

Uniqueness

Uniqueness Score: -1.00%

Function 0042B081, Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 431COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042B088
#540.MFC42U(CMainFrame::CreateMenuAndCtrlBars,00000000,00000054,0042AA53), ref: 0042B0A5
#6611.MFC42U(?,00008400,56002800,0000E804), ref: 0042B0C5
#800.MFC42U(?,00008400,56002800,0000E804), ref: 0042B5A4

Part of subcall function 004577CC: __EH_prolog3.LIBCMT ref: 004577D3
Part of subcall function 004577CC: #6617.MFC42U(?,00008800,40002014,?,?,?,00000070), ref: 00457812

#4158.MFC42U(00000070,?,?,?,00000070), ref: 0042B10B

Part of subcall function 00457BE4: __EH_prolog3.LIBCMT ref: 00457BEB
Part of subcall function 00457BE4: #384.MFC42U(CNBToolbar::SetImageLists,00000000,0000001C,0042B130,00000088,?,0000008B,0000000B), ref: 00457C2D
Part of subcall function 00457BE4: #2088.MFC42U(00000018,00000018,00000021,00000000,00000000,CNBToolbar::SetImageLists,00000000,0000001C,0042B130,00000088,?,0000008B,0000000B), ref: 00457C56
Part of subcall function 00457BE4: ImageList_AddMasked.COMCTL32(00000001,00000000,00000000,?,?,0000008B,0000000B), ref: 00457C81
Part of subcall function 00457BE4: ImageList_SetBkColor.COMCTL32(00000001,000000FF,?,0000008B,0000000B), ref: 00457CA1
Part of subcall function 00457BE4: #2406.MFC42U(?,0000008B,0000000B), ref: 00457CE3
Part of subcall function 00457BE4: #384.MFC42U(00969CB0,0000EF51,?,0000008B,0000000B), ref: 00457D75
Part of subcall function 00457BE4: #2088.MFC42U(00000018,00000018,00000021,00000000,00000000,00969CB0,0000EF51,?,0000008B,0000000B), ref: 00457D9E
Part of subcall function 00457BE4: ImageList_AddMasked.COMCTL32(00000001,00000004,00000000,?,?,0000008B,0000000B), ref: 00457DC9

Part of subcall function 00457896: __EH_prolog3.LIBCMT ref: 0045789D

Part of subcall function 0045878B: __EH_prolog3_GS.LIBCMT ref: 00458795
Part of subcall function 0045878B: #567.MFC42U(CNBToolbar::SetReplacementCombo,00000000,00000254,0042B15F,?,?,?,?,0000008B,0000000B), ref: 004587F7
Part of subcall function 0045878B: #2072.MFC42U(40200242,?,?,0000800F,CNBToolbar::SetReplacementCombo,00000000,00000254,0042B15F,?,?,?,?,0000008B,0000000B), ref: 00458844
Part of subcall function 0045878B: memset.MSVCRT ref: 00458868
Part of subcall function 0045878B: #1165.MFC42U(00000000,00000254,0042B15F,?,?,?,?,0000008B,0000000B), ref: 00458876
Part of subcall function 0045878B: SendMessageW.USER32(?,00000030,00000000,00000000), ref: 004588B5

Part of subcall function 004577CC: SendMessageW.USER32(00000070,00000454,00000000,00000010), ref: 00457858
Part of subcall function 004577CC: #6142.MFC42U(?,?,?,00000070), ref: 00457878

#4158.MFC42U(00000075,?,?,?,00000075,?,?,?,?,?,?,?,?,0000008B,0000000B), ref: 0042B197

Part of subcall function 00457BE4: ImageList_SetBkColor.COMCTL32(00000001,000000FF,?,0000008B,0000000B), ref: 00457DDF
Part of subcall function 00457BE4: #2406.MFC42U(?,0000008B,0000000B), ref: 00457E21
Part of subcall function 00457BE4: #2400.MFC42U(?,0000008B,0000000B), ref: 00457E7C

Part of subcall function 00457896: SendMessageW.USER32(?,0000043F,00000000,00000020), ref: 00457B01
Part of subcall function 00457896: SendMessageW.USER32(?,00000440,?,00000020), ref: 00457B46
Part of subcall function 00457896: SendMessageW.USER32(?,00000455,00000000,00000000), ref: 00457B64
Part of subcall function 00457896: SendMessageW.USER32(?,00000454,00000000,00000000), ref: 00457B7D
Part of subcall function 00457896: #5867.MFC42U(?,CNBToolbar::InitNBToolBar,00000000,0000002C,0042B146,0000000D,004D2550,00000088), ref: 00457BA4

Part of subcall function 00458196: __EH_prolog3.LIBCMT ref: 0045819D

#4158.MFC42U(00000071,?,?,?,00000071,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0,00000005,00009C7C,004D2168,00000007,00009C7D), ref: 0042B353
#4158.MFC42U(00000072,?,?,?,00000072,0000008A,?,000000AA,00000013,?,?,?,?,00009CEB,00009CFF,004D2078), ref: 0042B3F4

Part of subcall function 00457896: SetRect.USER32 ref: 00457A5B
Part of subcall function 00457896: SendMessageW.USER32(?,00000421,00000000,00000000), ref: 00457BBA
Part of subcall function 00457896: #6211.MFC42U(00000005), ref: 00457BC4

#4155.MFC42U(0000EF2C,00000003,004D22C0,00000089,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B445
#6195.MFC42U(?,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B456
#4155.MFC42U(0000EF2D,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B460
#6195.MFC42U(?,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B46B
#4155.MFC42U(0000EF47,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B475
#6195.MFC42U(?,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B480
#4155.MFC42U(0000EF48,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B48A
#6195.MFC42U(?,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B495
#6561.MFC42U(?,00000000,00000000,00000280,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B4B4
#6561.MFC42U(?,00000000,00000000,00000280,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B4C8
#6561.MFC42U(?,00000000,00000000,00000280,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B4E0
#6561.MFC42U(?,00000000,00000000,00000280,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042B4F8
#3792.MFC42U(?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013,?,?,?,?,00009CEB), ref: 0042B502

Part of subcall function 00459824: SendMessageW.USER32(?,00000404,00009CFD,00000000), ref: 0045985A

Part of subcall function 00457379: __EH_prolog3_GS.LIBCMT ref: 00457383
Part of subcall function 00457379: SendMessageW.USER32(?,0000040B,?,00000064), ref: 00457433

#3792.MFC42U(?,00000000,00000070,00000000,0000000D,?,00000001,?,00000096,00000003,?,?,?,?,0000008A), ref: 0042B533

Part of subcall function 00434D4B: __EH_prolog3.LIBCMT ref: 00434D52
Part of subcall function 00434D4B: #5867.MFC42U(?,CMainFrame::SetReBarPosition,00000000,00000008,0042B590,?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016), ref: 00434D89

Part of subcall function 0042C0E6: __EH_prolog3_GS.LIBCMT ref: 0042C0ED
Part of subcall function 0042C0E6: #1165.MFC42U(CMainFrame::LoadToolbars,?,00000060,0042B599,00000000,?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016), ref: 0042C123
Part of subcall function 0042C0E6: #540.MFC42U(?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016,?,00000001,00000075,00000000,00000007), ref: 0042C164
Part of subcall function 0042C0E6: #3792.MFC42U(?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016,?,00000001,00000075,00000000,00000007), ref: 0042C179
Part of subcall function 0042C0E6: #2810.MFC42U(?,%s\,?,?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016,?,00000001), ref: 0042C19A
Part of subcall function 0042C0E6: RegOpenKeyExW.ADVAPI32(?,?,00000000,000F003F,00000000,?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013), ref: 0042C1B6
Part of subcall function 0042C0E6: #540.MFC42U(?,00000096,00000003,?,?,?,?,0000008A,?,000000AA,00000013,?,?,?,?,00009CEB), ref: 0042C1E2
Part of subcall function 0042C0E6: SendMessageW.USER32(?,00000423,00000000,00000000), ref: 0042C20E
Part of subcall function 0042C0E6: SendMessageW.USER32(?,00000423,00000001,00000000), ref: 0042C21F
Part of subcall function 0042C0E6: SendMessageW.USER32(?,00000423,00000002,00000000), ref: 0042C230

Strings

CMainFrame::CreateMenuAndCtrlBars, xrefs: 0042B091

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$H_prolog3$#4155#4158#6195#6561H_prolog3_ImageList_$#3792#540$#1165#2088#2406#384#5867ColorMasked$#2072#2400#2810#567#6142#6211#6611#6617#800OpenRectmemset
String ID: CMainFrame::CreateMenuAndCtrlBars
API String ID: 2771202502-4026487485
Opcode ID: 118d5e8dcd1ac9807df0e0d086269d1828c227590f5d3d2413e87f6da95b6f0c
Instruction ID: 4fa51c0ec0559049d644239853c936e01c2a06e39fba4b5487c1bc4346c9d658
Opcode Fuzzy Hash: 118d5e8dcd1ac9807df0e0d086269d1828c227590f5d3d2413e87f6da95b6f0c
Instruction Fuzzy Hash: EED17830B407156AEB14AB659C56FAF3BA5AB44704F44003EFD05AF2C2DF689A05C7E9

Uniqueness

Uniqueness Score: -1.00%

Function 004BCB73, Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 274fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004BCBB2
memset.MSVCRT ref: 004BCBC3
memset.MSVCRT ref: 004BCBD4
memset.MSVCRT ref: 004BCBE5
memset.MSVCRT ref: 004BCBF6
memset.MSVCRT ref: 004BCC07
ExpandEnvironmentStringsW.KERNEL32(?,?,00000208), ref: 004BCC29
GetLastError.KERNEL32(?,?,00000208), ref: 004BCC6A
CreateDirectoryW.KERNEL32(?,00000000,jnwdui.dll,004011BC,?,jnwdui.dll,?,jnwdui.dll,004011BC,?,jnwdui.dll,?,jnwdrv.dll,004011BC,?,jnwdrv.dll), ref: 004BCDAF
GetLastError.KERNEL32(?,?,00000208), ref: 004BCDD1
CopyFileW.KERNEL32(?,?,00000000,?,?,00000208), ref: 004BCE0D
CopyFileW.KERNEL32(?,?,00000000,?,?,00000208), ref: 004BCE22
GetLastError.KERNEL32(?,?,00000208), ref: 004BCE3A
GetLastError.KERNEL32 ref: 004BCEB6
DeleteFileW.KERNEL32(?), ref: 004BCEEA
DeleteFileW.KERNEL32(?), ref: 004BCEF3
DeleteFileW.KERNEL32(?), ref: 004BCEFC

Strings

jnwdrv.dll, xrefs: 004BCCA8, 004BCCE1, 004BCE66
AddPrinterDriverW, xrefs: 004BCB94
jnwdui.dll, xrefs: 004BCD07, 004BCD3B, 004BCD61, 004BCD95, 004BCE61
@dM, xrefs: 004BCE88

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$File$ErrorLast$Delete$Copy$CreateDirectoryEnvironmentExpandStrings
String ID: @dM$AddPrinterDriverW$jnwdrv.dll$jnwdui.dll
API String ID: 4138005800-1919875947
Opcode ID: 836d3cbc74fb0978e0576b50ccf39f6b579dec036be04236bd0534555b909b81
Instruction ID: ecefea1cec7a8599d15994f4ff928cb63d284ab18a3e0354eba2169775c5ba54
Opcode Fuzzy Hash: 836d3cbc74fb0978e0576b50ccf39f6b579dec036be04236bd0534555b909b81
Instruction Fuzzy Hash: 72A184B1A00218EBDB21DB55DC85FDB77ADAB44304F4040ABA909D7262DE78DE85CB78

Uniqueness

Uniqueness Score: -1.00%

Function 0042B931, Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0042B93B
#1165.MFC42U(CMainFrame::PreOnClose,?,0000027C,0042B824,CMainFrame::OnClose,00000000,0E0227DC), ref: 0042B976

Part of subcall function 0048407D: __EH_prolog3.LIBCMT ref: 00484084

#540.MFC42U(00000001), ref: 0042B9B9
memset.MSVCRT ref: 0042B9D9

Part of subcall function 004752F7: __EH_prolog3.LIBCMT ref: 004752FE
Part of subcall function 004752F7: SendMessageW.USER32(?,00000146,00000000,00000000), ref: 0047532E
Part of subcall function 004752F7: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00475349
Part of subcall function 004752F7: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00475365
Part of subcall function 004752F7: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00475381
Part of subcall function 004752F7: #3312.MFC42U(00000000,?), ref: 0047539C

#4124.MFC42U(?,00000103,?,?,?,?), ref: 0042BA34
#858.MFC42U(00000000), ref: 0042BA45
#800.MFC42U ref: 0042BA55
#5852.MFC42U(00000103,00000000), ref: 0042BA67
#1165.MFC42U(?,?,?,?,?), ref: 0042BA84
#1165.MFC42U(?,0000001B), ref: 0042BA9C
#1165.MFC42U(?,0000001C), ref: 0042BAB4
#1165.MFC42U(?,0000001D), ref: 0042BAE3
#800.MFC42U(?,?,?,?), ref: 0042BB0C
#1165.MFC42U(00000002,00000001), ref: 0042BBA3
#1165.MFC42U(-00000001,00000019), ref: 0042BBBF
#1165.MFC42U(?), ref: 0042BBD3
#1165.MFC42U(?,0000002C,00000018), ref: 0042BC05
#1165.MFC42U ref: 0042BC20
#1165.MFC42U(?,00000058), ref: 0042BC53
#1662.MFC42U ref: 0042BC58

Strings

CMainFrame::PreOnClose, xrefs: 0042B95D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$MessageSend$#800H_prolog3$#1662#3312#4124#540#5852#858H_prolog3_catch_memset
String ID: CMainFrame::PreOnClose
API String ID: 2670683017-673290826
Opcode ID: c7568c39deb29a4ae3febb219f1ad7d35d1f7ce8299efc90bd6b474ffce2d6b1
Instruction ID: 8106633fdb8ebb2458183fe0ce41d4f95de064705a78d70707ea307fbefb4a1e
Opcode Fuzzy Hash: c7568c39deb29a4ae3febb219f1ad7d35d1f7ce8299efc90bd6b474ffce2d6b1
Instruction Fuzzy Hash: AB81A230A016299BDB10FB65DD58FAEB7B4AF44304F0041DEA409A7292DF789E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0047B091, Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 223COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0047B0D6
memset.MSVCRT ref: 0047B0F4
GetTempPathW.KERNEL32(00000104,?,?,?,?,?,00000000), ref: 0047B13E
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 0047B15A
ExpandEnvironmentStringsW.KERNEL32(00411E48,?,00000104,?,?,?,?,00000000), ref: 0047B1E5
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 0047B201
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,?,?,?,?,00000000), ref: 0047B28A
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 0047B2AA
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000020,00000000,?,?,?,?,00000000), ref: 0047B333
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 0047B34F

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

Temp\, xrefs: 0047B2E7
G_IsFileFromTempFolder, xrefs: 0047B0AE
%SYSTEMROOT%\TEMP\, xrefs: 0047B1B2
%TMP%\, xrefs: 0047B192
%USERPROFILE%\TEMP\, xrefs: 0047B1A8
%TEMP%\, xrefs: 0047B19E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$Path$FolderSpecialmemset$EnvironmentExpandMessageStringsTempTrace
String ID: %SYSTEMROOT%\TEMP\$%TEMP%\$%TMP%\$%USERPROFILE%\TEMP\$G_IsFileFromTempFolder$Temp\
API String ID: 937757770-3279336762
Opcode ID: e6604c0d10eb5273d2944ca2f45b16d5296b1fc1551510c70b3edb084ef03b50
Instruction ID: 513b1dc57f36af364d862399284fe8b4b469fb524f423164461c4378e74a4f8c
Opcode Fuzzy Hash: e6604c0d10eb5273d2944ca2f45b16d5296b1fc1551510c70b3edb084ef03b50
Instruction Fuzzy Hash: 3B81E1716012189BDB618B558D88FEA3768EF14314F5081EBFA08D72A1DB78CD85CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 0047CE44, Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 169memorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0E0227DC,?,?,0E0227DC,?,GetPrinterDevice,00000000,6DEDD6D0,80004005), ref: 0047CEA9
GlobalFree.KERNEL32 ref: 0047CED6
GlobalAlloc.KERNEL32(00000042,?,?,?,0E0227DC,?,GetPrinterDevice,00000000,6DEDD6D0,80004005), ref: 0047CEF5
GlobalFree.KERNEL32 ref: 0047CF01
GlobalLock.KERNEL32 ref: 0047CF0D
memcpy.MSVCRT ref: 0047CF23
GlobalUnlock.KERNEL32(00000000,6DEDD6D0,80004005,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047CF2C
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047CF3B
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047CF44
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047CF4D
GlobalAlloc.KERNEL32(00000042,?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047CF67
GlobalFree.KERNEL32 ref: 0047CF7B
GlobalFree.KERNEL32 ref: 0047CF81

Strings

GetPrinterDevice, xrefs: 0047CE59

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloclstrlen$LockUnlockmemcpy
String ID: GetPrinterDevice
API String ID: 3801331771-1777916311
Opcode ID: 9b21fa2cda9a041a9a7e3982dc66eab8fae83c10c5c2f648f832eb1b2995e96c
Instruction ID: 3aad1b08f296f15ac268f5c6c898ad6ea7115c8919a1c79a66a4fa716e386ad8
Opcode Fuzzy Hash: 9b21fa2cda9a041a9a7e3982dc66eab8fae83c10c5c2f648f832eb1b2995e96c
Instruction Fuzzy Hash: 3B516671900115AFDB14DFA5DC85EBEBBB8FF44314B04846AF909E7211EB389915CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044DCE7, Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 253memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044DCF1
memset.MSVCRT ref: 0044DD1A
#1165.MFC42U ref: 0044DD34
#1165.MFC42U(?,00000067), ref: 0044DD4A
GlobalAlloc.KERNEL32(00000040,00000008,CPrintOptionsPage::CPrintOptionsPage,00000000,00000000,00000068), ref: 0044DD99
#1165.MFC42U ref: 0044DDCC

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

#1165.MFC42U ref: 0044DE0E
CreatePropertySheetPageW.COMCTL32(00000038), ref: 0044DE47
#1165.MFC42U ref: 0044DF82
#1165.MFC42U(?,00000067), ref: 0044DF99
#3069.MFC42U(00000080,?,00000068), ref: 0044DFCD
#800.MFC42U(00000000), ref: 0044DFE6

Part of subcall function 0042A3DE: __EH_prolog3.LIBCMT ref: 0042A3E5

GlobalFree.KERNEL32 ref: 0044E038

Strings

CNotebookView::DoPrintPrepare, xrefs: 0044DCFB
T, xrefs: 0044DDAC
f, xrefs: 0044DE33
2A, xrefs: 0044E00D, 0044DE23
8, xrefs: 0044DE04
CPrintOptionsPage::CPrintOptionsPage, xrefs: 0044DD7C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$GlobalH_prolog3$#3069#800AllocCreateFreePagePropertySheetmemset
String ID: 2A$8$CNotebookView::DoPrintPrepare$CPrintOptionsPage::CPrintOptionsPage$T$f
API String ID: 182783930-634447946
Opcode ID: aec6ed42528e59c7d231001fdc0657ac64dab15b235a3fda54ae41e27b6565a0
Instruction ID: 5d52b167670dda657fdc1a944ddafcb29da9d172e28342185577f20714c6fcd3
Opcode Fuzzy Hash: aec6ed42528e59c7d231001fdc0657ac64dab15b235a3fda54ae41e27b6565a0
Instruction Fuzzy Hash: 4AB15D74A00208DFDB14DFA5C884BADBBB1FF09304F10809EE559AB352DB799945CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00471A2C, Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00471A33
GetClientRect.USER32 ref: 00471A57
#4294.MFC42U(?,?,?,?,00000000), ref: 00471A91
#6211.MFC42U(00000005), ref: 00471A9B
#4294.MFC42U(?,?,?,?,00000000), ref: 00471AE0
#6211.MFC42U(00000005), ref: 00471AEA
#6211.MFC42U(00000000), ref: 00471B00
MapDialogRect.USER32(00000000,?), ref: 00471B33
ShowWindow.USER32(?,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00471C17
ShowWindow.USER32(?,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00471C28
ShowWindow.USER32(?,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00471C39
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00471C4A
ShowWindow.USER32(?,00000000), ref: 00471C67
ShowWindow.USER32(?,00000000), ref: 00471C79
ShowWindow.USER32(?,00000000), ref: 00471C8B
ShowWindow.USER32(00000000,00000000), ref: 00471C9D
InvalidateRect.USER32(?,00000000,00000001), ref: 00471CA7
RedrawWindow.USER32(?,00000000,00000000,00000081), ref: 00471CB7

Strings

CSrchView::_RecalcLayout, xrefs: 00471A3F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Show$#6211Rect$#4294$ClientDialogH_prolog3_InvalidateRedraw
String ID: CSrchView::_RecalcLayout
API String ID: 3792941-1958503700
Opcode ID: cd0e2c2f9dc0d317b68fa34701314b060f549e903399f4088a5e05c4cce1fec9
Instruction ID: e2002359c84c2a8aec40a3bf496bcf2d0e1ac5047973956e76083d210705941c
Opcode Fuzzy Hash: cd0e2c2f9dc0d317b68fa34701314b060f549e903399f4088a5e05c4cce1fec9
Instruction Fuzzy Hash: 1C914071A00209AFDB14DFA9DC85EEF7BB9EF44300F14416AF909EB255DB74A901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042DB69, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DBEA
#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DBF8
#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DC06
#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DC15
#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DC24
#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DC33
#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DC41
#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DC4B
#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DC8C
#1165.MFC42U(?,00009CAC,00009CAC,CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DCC5
#1165.MFC42U(0000EFAB,00000030,00000000), ref: 0042DCFA
#1165.MFC42U(CMainFrame::OnZoomChanged,00000000,0E0227DC), ref: 0042DD1D

Strings

CMainFrame::OnZoomChanged, xrefs: 0042DBA0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165
String ID: CMainFrame::OnZoomChanged
API String ID: 4073908220-649753973
Opcode ID: 6b17fc2408ba05a9288c1a94b156f80e8c66b3bb758a950881b5ad7f503fea66
Instruction ID: e040e7c958bf5d7630195d8c3002a76509458eaae4a7d7d6fa52e9ea5cd66f9e
Opcode Fuzzy Hash: 6b17fc2408ba05a9288c1a94b156f80e8c66b3bb758a950881b5ad7f503fea66
Instruction Fuzzy Hash: 52514D71B15621ABE2149B62ED4DFB73F54EB44750F94012BB2068B1E1DDA85801CABF

Uniqueness

Uniqueness Score: -1.00%

Function 00497D36, Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 284windowmemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00497D3D
DeleteMenu.USER32(00000000,00000000,00000000,CCopyTo::AddMenuItems,00000000,00000070,0049811D,00000000,00000002,0000C419,00009C85,?,CCopyTo::AddMeetingInfoMenuItems,00000000,00000010,0044AA76), ref: 00497D86
GetUserDefaultUILanguage.KERNEL32 ref: 00497DB2
SysStringLen.OLEAUT32(00000000), ref: 00497E83
SysAllocString.OLEAUT32(00000000), ref: 00497EAC
SysFreeString.OLEAUT32(00000000), ref: 00497ED6
SysFreeString.OLEAUT32(00000000), ref: 00497F0E
GetMenuItemCount.USER32 ref: 00497F46
memset.MSVCRT ref: 00497F58
InsertMenuItemW.USER32(00000000,?,00000000,00000030), ref: 00497FC7
GetLastError.KERNEL32 ref: 00497FD1
#1165.MFC42U ref: 00497FE6
EnableMenuItem.USER32 ref: 00498004
memset.MSVCRT ref: 0049802C
InsertMenuItemW.USER32(00000000,00000000,00000000,?), ref: 0049804E
DeleteMenu.USER32(00000000,00000000,00000000), ref: 00498059

Strings

CCopyTo::AddMenuItems, xrefs: 00497D56
0, xrefs: 00497F65

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$ItemString$DeleteFreeInsertmemset$#1165AllocCountDefaultEnableErrorH_prolog3LanguageLastUser
String ID: 0$CCopyTo::AddMenuItems
API String ID: 2122253421-1481449996
Opcode ID: 42cbe5bdf4a94b18d565579c1d53f1610f051e6a863fe0a5c04487f4d0ae681e
Instruction ID: 6ce63fbc06fba20acba858b9e5dd497762b9dcffb13341ac8de204a89940d6e9
Opcode Fuzzy Hash: 42cbe5bdf4a94b18d565579c1d53f1610f051e6a863fe0a5c04487f4d0ae681e
Instruction Fuzzy Hash: E6B16971E112199FDF14CFA5D848AAEBBB5FF48314F10812AE816F7251DB389901CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042BCAD, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042BCB7
#1165.MFC42U(CMainFrame::SetAppSize,00000000,0000008C,0042AC58,00000000), ref: 0042BCEA

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

#1165.MFC42U(?,0000002C,00000018), ref: 0042BD28
OffsetRect.USER32(?,00000014,00000014), ref: 0042BD81
OffsetRect.USER32(?,?,?), ref: 0042BDAE
MonitorFromRect.USER32(?,00000001), ref: 0042BDC0
GetMonitorInfoW.USER32 ref: 0042BDCE
CopyRect.USER32 ref: 0042BDE0
OffsetRect.USER32(?,?,00000000), ref: 0042BDF8
OffsetRect.USER32(?,00000000,?), ref: 0042BE0C
OffsetRect.USER32(?,?,00000000), ref: 0042BE20
OffsetRect.USER32(?,00000000,?), ref: 0042BE34
IntersectRect.USER32 ref: 0042BE42
#1165.MFC42U(?,0000002C,00000018), ref: 0042BE48
#6191.MFC42U(?), ref: 0042BE54
#1165.MFC42U ref: 0042BE5A

Strings

CMainFrame::SetAppSize, xrefs: 0042BCCA
(, xrefs: 0042BDB5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Offset$#1165$Monitor$#6191CopyFromH_prolog3_InfoIntersectmemcpy
String ID: ($CMainFrame::SetAppSize
API String ID: 2903001936-1816780455
Opcode ID: 20a8b93ce4f19c74109f156674bd3b57acd6ade6cca667c989092578afb7ad18
Instruction ID: 6e5d71eae18ec54d1a4805c4c023a23c2d62bd70a23a6ff8a94c8fb3f2d1996e
Opcode Fuzzy Hash: 20a8b93ce4f19c74109f156674bd3b57acd6ade6cca667c989092578afb7ad18
Instruction Fuzzy Hash: 27513871E10129AFDB10DBE4DD85FEEB7B9FB08304F50416AE205E7181DB78AE458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004414D5, Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 287COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004414DC
#1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044163F
#1165.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00441644
#1165.MFC42U(00002001,00000041,?,?,00000000,?,?,?,?,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000), ref: 0044178D
#1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 004417B3

Strings

CNotebookApp::OpenCreateNote, xrefs: 004414EA
@, xrefs: 0044166C
.jnt, xrefs: 00441589

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: .jnt$@$CNotebookApp::OpenCreateNote
API String ID: 3111753120-2734027596
Opcode ID: 7def31a9ff993fdbd7cc04ffa8e6a53a591689da03f1e106aed5d324eddbf653
Instruction ID: f80540a2955767af20847cb2b5dc9a4344777846a4c6a498bbfd8d833313affa
Opcode Fuzzy Hash: 7def31a9ff993fdbd7cc04ffa8e6a53a591689da03f1e106aed5d324eddbf653
Instruction Fuzzy Hash: FEB18F75A0021A9FDF04DF94C884EBFBBB5FF88310F15442AE915AB261DB74AD41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00457BE4, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00457BEB

Part of subcall function 004BDF43: malloc.MSVCRT ref: 004BDF5B

#2400.MFC42U(?,0000008B,0000000B), ref: 00457EBD
#384.MFC42U(CNBToolbar::SetImageLists,00000000,0000001C,0042B130,00000088,?,0000008B,0000000B), ref: 00457C2D

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

#2088.MFC42U(00000018,00000018,00000021,00000000,00000000,CNBToolbar::SetImageLists,00000000,0000001C,0042B130,00000088,?,0000008B,0000000B), ref: 00457C56
ImageList_AddMasked.COMCTL32(00000001,00000000,00000000,?,?,0000008B,0000000B), ref: 00457C81
ImageList_SetBkColor.COMCTL32(00000001,000000FF,?,0000008B,0000000B), ref: 00457CA1
#2406.MFC42U(?,0000008B,0000000B), ref: 00457CE3
#384.MFC42U(00969CB0,0000EF51,?,0000008B,0000000B), ref: 00457D75
#2088.MFC42U(00000018,00000018,00000021,00000000,00000000,00969CB0,0000EF51,?,0000008B,0000000B), ref: 00457D9E
ImageList_AddMasked.COMCTL32(00000001,00000004,00000000,?,?,0000008B,0000000B), ref: 00457DC9
ImageList_SetBkColor.COMCTL32(00000001,000000FF,?,0000008B,0000000B), ref: 00457DDF
#2406.MFC42U(?,0000008B,0000000B), ref: 00457E21
#2400.MFC42U(?,0000008B,0000000B), ref: 00457E7C

Strings

CNBToolbar::SetImageLists, xrefs: 00457BF4
|e@, xrefs: 00457F06, 00457C67, 00457CE0, 00457DAF, 00457E1E
|K, xrefs: 00457C09, 00457F09

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ImageList_$#2088#2400#2406#384ColorMasked$H_prolog3MessageTracemalloc
String ID: CNBToolbar::SetImageLists$|e@$|K
API String ID: 1081289884-4158196216
Opcode ID: e836d7062a92c232eed22e5583a52437e033f69f02e49f9adec97950e76104a0
Instruction ID: 3593c0ad4bad5662cf74e4d319a037c78739908d9a6cadcb378a78d1ffa9c303
Opcode Fuzzy Hash: e836d7062a92c232eed22e5583a52437e033f69f02e49f9adec97950e76104a0
Instruction Fuzzy Hash: BCA1A430604304DFDB169F64ED45FAA7BB1AF04305F2484BAED115A2E2CB79DD48DB29

Uniqueness

Uniqueness Score: -1.00%

Function 004459CB, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 233stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004459D5
memset.MSVCRT ref: 00445A46
lstrlenW.KERNEL32(?,?,00000001,?), ref: 00445A99
lstrlenW.KERNEL32(?,?,00000001,?), ref: 00445AD5
PathFindExtensionW.SHLWAPI(?,?,00000001,?), ref: 00445AEC
#538.MFC42U(00000000,?,00000001,?), ref: 00445AF9
_wcsicmp.MSVCRT ref: 00445B0E
#1165.MFC42U(00000001,?), ref: 00445B6B
#1165.MFC42U ref: 00445C10
#1165.MFC42U(?,00000000,?,00000000), ref: 00445C79
#1165.MFC42U(?), ref: 00445CB8
lstrlenW.KERNEL32(?,?,00000001,?), ref: 00445A68

Part of subcall function 00435657: memset.MSVCRT ref: 0043566C
Part of subcall function 00435657: TraceEvent.ADVAPI32(0E0227DC,00000000,?,00000002,?,00000000), ref: 004356A5

#800.MFC42U(?), ref: 00445D0D

Strings

.jtp, xrefs: 00445B03
CNotebookDoc::Save, xrefs: 004459F3
,TD, xrefs: 00445BB5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$lstrlen$memset$#538#800EventExtensionFindH_prolog3_PathTrace_wcsicmp
String ID: ,TD$.jtp$CNotebookDoc::Save
API String ID: 1316850358-2635555507
Opcode ID: 3b4d98e060c6e17f431ac7d8aff65061793e20172d37abac5c17203b3e0ee9c4
Instruction ID: 9d17870986dd1b5187dc322a5fb0e802e76073f17142f4860f1c826318b9731e
Opcode Fuzzy Hash: 3b4d98e060c6e17f431ac7d8aff65061793e20172d37abac5c17203b3e0ee9c4
Instruction Fuzzy Hash: 1E91AAB16006159BDF24EB61DC85BAE77B8AF44304F0440EEE509A7252DB38DE85CF6D

Uniqueness

Uniqueness Score: -1.00%

Function 0047A3D6, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 148stringnetworkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0047A3E0
#1165.MFC42U(G_GetMyNotesDirectoryName,?,00000218,0047A686,00000000,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A41F
memset.MSVCRT ref: 0047A467
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?,?,00000104,00000064), ref: 0047A47B
#1165.MFC42U(?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A48B
PathCombineW.SHLWAPI(?,?,?,?,00000104,?,?,00000104,00000064), ref: 0047A4B8
PathFileExistsW.SHLWAPI(?,?,?,00000104,?,?,00000104,00000064), ref: 0047A4C9
lstrlenW.KERNEL32(Notes,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A4D9
#1165.MFC42U(Notes,00000000,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A4FB
lstrlenW.KERNEL32(?,00000064,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A507
memset.MSVCRT ref: 0047A54E
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?,?,00000104,00000064), ref: 0047A562
PathCombineW.SHLWAPI(?,?,?,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?), ref: 0047A57D
PathIsNetworkPathW.SHLWAPI(?,?,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A58E

Strings

Notes, xrefs: 0047A4D3, 0047A4D8, 0047A4E0
G_GetMyNotesDirectoryName, xrefs: 0047A3F9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$#1165$CombineFolderlstrlenmemset$ExistsFileH_prolog3_Network
String ID: G_GetMyNotesDirectoryName$Notes
API String ID: 403752829-2549467414
Opcode ID: 9e82d9826fdcc044bb2bff8b8e0f5fc268e286c18df39648d0444f5c16f3f906
Instruction ID: d26a6bedcef1e9dc24da135d164b0bda5d2c13ed521ebd99acacd1c72f139847
Opcode Fuzzy Hash: 9e82d9826fdcc044bb2bff8b8e0f5fc268e286c18df39648d0444f5c16f3f906
Instruction Fuzzy Hash: 7751C475942229ABD7209B618C4CBDF7BB8AF54710F0040ABF909E7250DB349E46CFE9

Uniqueness

Uniqueness Score: -1.00%

Function 0047B6DD, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 150stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004D7968,G_SubstituteFolderPathWithDisplayName,00000000,?,00000000), ref: 0047B73F
lstrlenW.KERNEL32(004D7758,?,00000000), ref: 0047B74E
lstrlenW.KERNEL32(00481CB6,?,00000000), ref: 0047B759

Part of subcall function 0047AF33: memset.MSVCRT ref: 0047AF7E
Part of subcall function 0047AF33: memset.MSVCRT ref: 0047AF9C
Part of subcall function 0047AF33: lstrlenW.KERNEL32(00481CB6,?,?,?,00000008,00481CB6,751469A0), ref: 0047AFBB
Part of subcall function 0047AF33: lstrlenW.KERNEL32(?,?,?,?,00000008,00481CB6,751469A0), ref: 0047AFC9
Part of subcall function 0047AF33: StrChrW.SHLWAPI(?,0000007E,?,?,?,00000008,00481CB6,751469A0), ref: 0047AFE9
Part of subcall function 0047AF33: GetLongPathNameW.KERNEL32(?,?,00000104), ref: 0047B005
Part of subcall function 0047AF33: StrChrW.SHLWAPI(00481CB6,0000007E,?,?,?,00000008,00481CB6,751469A0), ref: 0047B020
Part of subcall function 0047AF33: GetLongPathNameW.KERNEL32(00481CB6,?,00000104), ref: 0047B037
Part of subcall function 0047AF33: CompareStringW.KERNEL32(0000007F,00000001,?,00000000,00481CB6,00000000,?,?,?,00000008,00481CB6,751469A0), ref: 0047B060

PathAddBackslashW.SHLWAPI(00000008,004D7758,00000104,?,00000000), ref: 0047B7DA
lstrlenW.KERNEL32(004D7968,?,00000000), ref: 0047B7E5
CharNextW.USER32(00000000,?,00000000), ref: 0047B7F7
lstrlenW.KERNEL32(00000008,?,00000000), ref: 0047B804
lstrlenW.KERNEL32(?,?,00000000), ref: 0047B80E
lstrlenW.KERNEL32(00000008,?,00000000), ref: 0047B823
memset.MSVCRT ref: 0047B848
PathCompactPathExW.SHLWAPI(?,?,00000103,00000000), ref: 0047B85F

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

G_SubstituteFolderPathWithDisplayName, xrefs: 0047B704
hyM, xrefs: 0047B710
hyM, xrefs: 0047B767
XwM, xrefs: 0047B71D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$Path$memset$LongName$BackslashCharCompactCompareMessageNextStringTrace
String ID: G_SubstituteFolderPathWithDisplayName$XwM$hyM$hyM
API String ID: 325215156-2699990211
Opcode ID: 68b665175bfeec78d5669229a99d44061a67661e7b46a9697aeec81b75db316e
Instruction ID: 142ec94ea5f5b91b68b068792ca2c1132aa25ea288238f321588d6936266c1a9
Opcode Fuzzy Hash: 68b665175bfeec78d5669229a99d44061a67661e7b46a9697aeec81b75db316e
Instruction Fuzzy Hash: B041F7316002199BDB259FA9CDC8FEB3769EF54304F0585BBE90897261DB78CD40CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00477E16, Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00477E1D
#567.MFC42U(00000020,004421F1,?,.jnt,?,00000001,?,?,?), ref: 00477E35
#567.MFC42U ref: 00477E49
#540.MFC42U ref: 00477E61
#540.MFC42U ref: 00477E6F
memset.MSVCRT ref: 00477EC0
#1165.MFC42U(CNBFileDialog::IsOpenType,00000000), ref: 00477F4D
#861.MFC42U(00000000), ref: 00477FA3
#2910.MFC42U(00000000), ref: 00477FAD
wcschr.MSVCRT ref: 00477FC6
GetActiveWindow.USER32 ref: 00477FEB
#861.MFC42U(00000000), ref: 0047800D

Strings

CNBFileDialog::CNBFileDialog, xrefs: 00477E96
$K, xrefs: 00477E37, 00477E4B
CNBFileDialog::IsOpenType, xrefs: 00477EDF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #540#567#861$#1165#2910ActiveH_prolog3_catchWindowmemsetwcschr
String ID: $K$CNBFileDialog::CNBFileDialog$CNBFileDialog::IsOpenType
API String ID: 5921968-1423019772
Opcode ID: b7aea51ad9401e39a9ae693cb4fbe4831c09ecdee6660e3d38b457c8b90064f8
Instruction ID: 84b1b850bc16df830526d0db57489e1256aa742219c47d41096cc50067015e20
Opcode Fuzzy Hash: b7aea51ad9401e39a9ae693cb4fbe4831c09ecdee6660e3d38b457c8b90064f8
Instruction Fuzzy Hash: AE518A71904215CBCB15DF25C9887EA7BA4EF08300F59807FEC09AB296DB789945CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0048744B, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 105registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00487452
#1165.MFC42U(CTOCView::_GetViewRegistryKey,00000000,00000044,004876FB,CTOCView::_LoadColumns,00000000,00000014,00485607), ref: 004874EA
RegCloseKey.ADVAPI32(?,Portrait), ref: 0048755B
RegCloseKey.ADVAPI32(0E0227DC,Portrait), ref: 00487565
RegCloseKey.ADVAPI32(00000000,Portrait), ref: 0048756C

Strings

MHistory, xrefs: 004874C2
Views, xrefs: 00487506
Details, xrefs: 004874D7, 00487536
Folders, xrefs: 004874D0
CTOCView::_GetViewRegistryKey, xrefs: 0048745B
Flags, xrefs: 004874BB
CHistory, xrefs: 004874C9
Portrait, xrefs: 004874DC
TOC, xrefs: 0048751E
Landscape, xrefs: 004874E5, 004874F0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$#1165H_prolog3
String ID: CHistory$CTOCView::_GetViewRegistryKey$Details$Flags$Folders$Landscape$MHistory$Portrait$TOC$Views
API String ID: 740446608-3824419012
Opcode ID: e4914c57d6c16cd9bf6d3e8c7fa406f382e4b07f2df6d20c6bc408fb3668a051
Instruction ID: baa1d17fd88cf3aaa251aaa9ba0c64b5efbd923ad8df1d3058b8d4867ecaa901
Opcode Fuzzy Hash: e4914c57d6c16cd9bf6d3e8c7fa406f382e4b07f2df6d20c6bc408fb3668a051
Instruction Fuzzy Hash: E731A671E04609ABCB14EFAAC8516EEBFB0AF88700F65847BD409B7351E738DD018B58

Uniqueness

Uniqueness Score: -1.00%

Function 004BD346, Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 179COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004BD36D
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(O:BAG:DUD:(D;;LCSWSDRCWDWO;;;NU)(D;OIIO;RPSDRCWDWO;;;NU)(A;OI;LCSWSDRCWDWO;;;BA)(A;CIIO;RC;;;CO)(A;OIIO;RPSDRCWDWO;;;CO)(A;OI;SWRC,00000001,004BDA2D,00000000), ref: 004BD3A0
GetLastError.KERNEL32 ref: 004BD3D0
GetLastError.KERNEL32 ref: 004BD472
GetLastError.KERNEL32 ref: 004BD4AA
GetLastError.KERNEL32 ref: 004BD4E8
GetLastError.KERNEL32 ref: 004BD528
LocalFree.KERNEL32(00000000), ref: 004BD564

Strings

O:BAG:DUD:(D;;LCSWSDRCWDWO;;;NU)(D;OIIO;RPSDRCWDWO;;;NU)(A;OI;LCSWSDRCWDWO;;;BA)(A;CIIO;RC;;;CO)(A;OIIO;RPSDRCWDWO;;;CO)(A;OI;SWRC, xrefs: 004BD398
JournalPrint, xrefs: 004BD38D, 004BD446
Journal Note Writer Port:, xrefs: 004BD37F
HfM, xrefs: 004BD41C
@dM, xrefs: 004BD386
AddPrinterW, xrefs: 004BD357

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$DescriptorSecurity$ConvertFreeLocalStringmemset
String ID: @dM$AddPrinterW$HfM$Journal Note Writer Port:$JournalPrint$O:BAG:DUD:(D;;LCSWSDRCWDWO;;;NU)(D;OIIO;RPSDRCWDWO;;;NU)(A;OI;LCSWSDRCWDWO;;;BA)(A;CIIO;RC;;;CO)(A;OIIO;RPSDRCWDWO;;;CO)(A;OI;SWRC
API String ID: 1084690188-2025299206
Opcode ID: 0467b8d2fb48da017e52edd26962ea9866176cb5b1b363a453bb7ac37924577c
Instruction ID: 82e391aa8dc4b55e40df0d52a47d6c8fb46143a86faf773b2723bc85c63ad57e
Opcode Fuzzy Hash: 0467b8d2fb48da017e52edd26962ea9866176cb5b1b363a453bb7ac37924577c
Instruction Fuzzy Hash: 7D517870A00209EBD722CF65DE45FEA7BB4AB44318F1440ABEA00D72A1E779D941DF79

Uniqueness

Uniqueness Score: -1.00%

Function 0045091E, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 169registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00450925
#1165.MFC42U(CItemPicker::CreateSampleWnd,?,00000054,00456AF2,00000000,004570B7,?,?,00000000,?,CImagePicker::CreateImagePicker,00000000,00000010,004584F3,00000000,?), ref: 00450956
GetWindowLongW.USER32(00000000,000000EC), ref: 00450967
OpenThemeData.UXTHEME(00000000,COMBOBOX,?,?,?,00000003,00000003,?,?,00000001), ref: 0045097B
GetClassInfoW.USER32 ref: 00450993
RegisterClassW.USER32 ref: 004509CF
GetWindow.USER32(?,00000003), ref: 004509D8
DestroyWindow.USER32(?,?,?,?,?,00000003,00000003,?,?,00000001), ref: 004509ED
MapWindowPoints.USER32 ref: 004509FE
InflateRect.USER32(?,00000000,00000000), ref: 00450AB0
CloseThemeData.UXTHEME(00000000,?,00000000,50010000,00000000,?,00000000,?,00000000,?,?,?,0000000B,?,?,?), ref: 00450B28

Part of subcall function 004B0349: SetWindowPos.USER32(?,00000000,?,?,?,00000000,?,Helpers::SetWindowPos,00000000,?,00000000,?), ref: 004B037D
Part of subcall function 004B0349: GetLastError.KERNEL32 ref: 004B0389

Part of subcall function 004AF88E: GetSystemMetrics.USER32 ref: 004AF8B3

Strings

COMBOBOX, xrefs: 0045096D
CItemPicker::CreateSampleWnd, xrefs: 0045093E
MSNB_IP_SWC, xrefs: 0045098B, 004509C8, 00450A44

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ClassDataTheme$#1165CloseDestroyErrorH_prolog3_InflateInfoLastLongMetricsOpenPointsRectRegisterSystem
String ID: CItemPicker::CreateSampleWnd$COMBOBOX$MSNB_IP_SWC
API String ID: 1340924807-1355381376
Opcode ID: c2c9ebf77e0c75c147166e1f379aa6cb339fa946f3d0e42dc41681f787977de6
Instruction ID: 13a84ad1c5b61ac3c12aaddcb3e2952791de603b21d9ca65a0f43db741e2e58d
Opcode Fuzzy Hash: c2c9ebf77e0c75c147166e1f379aa6cb339fa946f3d0e42dc41681f787977de6
Instruction Fuzzy Hash: FC612D75A01609AFDB04DFE5D985BEEBBB5BF18300F10412EF519A7281DB78A804CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00442CAC, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 143processstringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00442CB6
memset.MSVCRT ref: 00442CF8
memset.MSVCRT ref: 00442D16
GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 00442D2B

Part of subcall function 004359C6: _vsnwprintf.MSVCRT ref: 004359F8

memset.MSVCRT ref: 00442D75
lstrlenW.KERNEL32(?), ref: 00442DC2
CreateProcessW.KERNEL32 ref: 00442E53
WaitForInputIdle.USER32 ref: 00442E75

Part of subcall function 004AFE0C: CloseHandle.KERNEL32(?,Helpers::CloseHandle,00000000,-00000024), ref: 004AFE2D
Part of subcall function 004AFE0C: GetLastError.KERNEL32 ref: 004AFE39

Strings

CNBSettingsMgr::OnNewWindow, xrefs: 00442DF3
%s "%s", xrefs: 00442DD7
D, xrefs: 00442D80
CNotebookApp::CreateNewInstance, xrefs: 00442CCF
-n %d, xrefs: 00442DA5
"%s", xrefs: 00442D38

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$CloseCreateErrorFileH_prolog3_HandleIdleInputLastModuleNameProcessWait_vsnwprintflstrlen
String ID: -n %d$"%s"$%s "%s"$CNBSettingsMgr::OnNewWindow$CNotebookApp::CreateNewInstance$D
API String ID: 1482697975-1353849760
Opcode ID: 20d63605b578230234b33c92c7b0b96f007aca096d196900a2ae3f9826c55e25
Instruction ID: 03d7335fa65ced80cdf4221fb7607f67a5fc2e9128594078fbd8d01502e890f4
Opcode Fuzzy Hash: 20d63605b578230234b33c92c7b0b96f007aca096d196900a2ae3f9826c55e25
Instruction Fuzzy Hash: 675180B2D405289AEB20EB65CC45BDE73B8EF14704F5040AAF549A3141DE789A858FE9

Uniqueness

Uniqueness Score: -1.00%

Function 0048CE31, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0048CE38

Part of subcall function 0048DA34: __EH_prolog3.LIBCMT ref: 0048DA3B

#1165.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0048CEA4
#1165.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0048CEC1

Part of subcall function 0042985B: __EH_prolog3.LIBCMT ref: 00429862

#1165.MFC42U(?,00000000,?,00000004,0000000F,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0048CF60
#1165.MFC42U(00000000,0000000D,00000000,0000000C,00000000,00000006,?,00000004,0000000F,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0048CFE2
SysAllocStringLen.OLEAUT32(004048E0,00000104), ref: 0048D0B8
#1165.MFC42U(?,?,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0048D0CD
#1165.MFC42U(?,0000004C,00000017,?,?,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0048D0FC
SysStringLen.OLEAUT32(00000000), ref: 0048D11D
SysFreeString.OLEAUT32(00000000), ref: 0048D141
#1165.MFC42U(?,00401130,?,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0048D1B5

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

Strings

, xrefs: 0048CFBC
CNBNote::CreateDocInstance, xrefs: 0048CE52

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$String$H_prolog3$AllocFreeH_prolog3_memcpy
String ID: $CNBNote::CreateDocInstance
API String ID: 660213930-1043410321
Opcode ID: 3e134af804556c5d00f348629cdff8a027b9317cbb7ef1e2e99e7d3a09306c16
Instruction ID: 452c7605740395205c41563e45efe864739542ad10b7d0babedafa820bf5ea95
Opcode Fuzzy Hash: 3e134af804556c5d00f348629cdff8a027b9317cbb7ef1e2e99e7d3a09306c16
Instruction Fuzzy Hash: C8E12C70E01315DFEB14EFA5C898A9EBBB5AF48304F24446EE509EB291DB39D845CF18

Uniqueness

Uniqueness Score: -1.00%

Function 0046F89F, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 223windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0046F8A9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0046F8E8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0046FC06

Part of subcall function 0046EA45: #540.MFC42U(CSimpleFindDialog::_BrowseForPath,00000000,0E0227DC,?,00000000,00000000,?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000), ref: 0046EA8E
Part of subcall function 0046EA45: #4155.MFC42U(0000DAC6), ref: 0046EAB2
Part of subcall function 0046EA45: SHBrowseForFolderW.SHELL32(?), ref: 0046EAFF
Part of subcall function 0046EA45: #800.MFC42U ref: 0046EB1A

#1165.MFC42U(?,?), ref: 0046F94F

Part of subcall function 00443AFC: __EH_prolog3.LIBCMT ref: 00443B03
Part of subcall function 00443AFC: SHGetMalloc.SHELL32(00000000), ref: 00443B2B
Part of subcall function 00443AFC: memcpy.MSVCRT ref: 00443B82

#6697.MFC42U(?,?,?), ref: 0046FA30
#6894.MFC42U(00000001), ref: 0046FA57
#6776.MFC42U(?,?,?), ref: 0046FAC9
SysFreeString.OLEAUT32(?), ref: 0046FB0E
#3087.MFC42U(000003FB,?,?), ref: 0046FB8A
#5977.MFC42U ref: 0046FB92
SHGetMalloc.SHELL32(?), ref: 0046FBB2

Strings

', xrefs: 0046FAA0
CSimpleFindDialog::OnScopeChange, xrefs: 0046F8BF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MallocMessageSend$#1165#3087#4155#540#5977#6697#6776#6894#800BrowseFolderFreeH_prolog3H_prolog3_catch_Stringmemcpy
String ID: '$CSimpleFindDialog::OnScopeChange
API String ID: 3268556688-1313681856
Opcode ID: e5e4779fa8243fd4873f53a40acde64df952fc2dafdddbdda0d094db5f90f302
Instruction ID: 80aff6b1a0909d1d38853a34542293d0091ae72aed89820629129fca12e950a6
Opcode Fuzzy Hash: e5e4779fa8243fd4873f53a40acde64df952fc2dafdddbdda0d094db5f90f302
Instruction Fuzzy Hash: 0A91A1B0A012159BDB249F25DC94BA9B7B5BF44304F1040EFD64DA7251EB34AE89CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 0044512E, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 193stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00445138

Part of subcall function 004796DC: __EH_prolog3.LIBCMT ref: 004796E3
Part of subcall function 004796DC: #1165.MFC42U(W_SetWaitMode,00000000,0000000C,00445E7F), ref: 004796FD

PathFindFileNameW.SHLWAPI(00000000), ref: 004451A9
lstrlenW.KERNEL32(00000000), ref: 004451BE
memset.MSVCRT ref: 004451E3
memset.MSVCRT ref: 00445214
lstrlenW.KERNEL32(?,00000000), ref: 00445248
lstrlenW.KERNEL32(?), ref: 0044525B
PathAddBackslashW.SHLWAPI(?,?), ref: 00445294
#1165.MFC42U(?), ref: 004452B0

Part of subcall function 00490C2E: __EH_prolog3.LIBCMT ref: 00490C35
Part of subcall function 00490C2E: lstrcmpiW.KERNEL32(?,00000000), ref: 00490C7E

#1165.MFC42U ref: 00445389
#1165.MFC42U(00000000,00000000), ref: 004453A0

Strings

CNotebookDoc::CopyDocument, xrefs: 00445149
,TD, xrefs: 00445323

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$lstrlen$H_prolog3Pathmemset$BackslashFileFindH_prolog3_Namelstrcmpi
String ID: ,TD$CNotebookDoc::CopyDocument
API String ID: 13377284-3316978417
Opcode ID: 5498a854d9668791cfaa38151e5884027f070191d7474290bf60fc3d7c0f7045
Instruction ID: 3a18b73276303014b4649c98d137c0b2a84048db9bffeed375331566a1c705d8
Opcode Fuzzy Hash: 5498a854d9668791cfaa38151e5884027f070191d7474290bf60fc3d7c0f7045
Instruction Fuzzy Hash: 66815F71A005289BDF24DF64CD48B9EB7B5AF54305F0400EEE809E7252DB799E94CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00430945, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 138windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043094F
memset.MSVCRT ref: 0043098D
#540.MFC42U ref: 0043099B
#2809.MFC42U(?,0000802F,?,00000000,?,?,?,?,00000104,?,?), ref: 00430A0A
#800.MFC42U ref: 00430A1D
ModifyMenuW.USER32(00000001,?,00000000,?,?), ref: 00430A3B

Part of subcall function 0042FDD4: __EH_prolog3.LIBCMT ref: 0042FDDB
Part of subcall function 0042FDD4: #1165.MFC42U(CMainFrame::IsPenMode,00000000,0000000C,0042F9C2), ref: 0042FDF3

Part of subcall function 0042AE3C: __EH_prolog3.LIBCMT ref: 0042AE43
Part of subcall function 0042AE3C: #1165.MFC42U(CMainFrame::GetCurrentWritingPenIndex,00000000,0000000C,0042B2E0,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0,00000005,00009C7C), ref: 0042AE5B

#2809.MFC42U(?,0000802F,?,00000000,?,?,?,?,00000104,?,?), ref: 00430ABE
#800.MFC42U ref: 00430AD1
ModifyMenuW.USER32(00000001,?,00000000,?,?), ref: 00430AEB
CheckMenuItem.USER32(00000001,?,00000008), ref: 00430B13
EnableMenuItem.USER32 ref: 00430B2B
#800.MFC42U ref: 00430B3B

Part of subcall function 004313B7: __EH_prolog3.LIBCMT ref: 004313BE
Part of subcall function 004313B7: #1165.MFC42U(CMainFrame::GetWritingPen,?,0000000C,0042B2EA,?,00000000,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0), ref: 004313E7

Part of subcall function 00431F16: __EH_prolog3.LIBCMT ref: 00431F1D
Part of subcall function 00431F16: #1165.MFC42U(CMainFrame::GetPenString,00000000,00000008,00431BA0,00000000,?,00000040,?,00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 004320ED

Part of subcall function 00430B5B: __EH_prolog3.LIBCMT ref: 00430B62
Part of subcall function 00430B5B: #540.MFC42U(CMainFrame::GetColorString,00000000,0000001C,00430AA5,?,?,?,?,00000104,?,?), ref: 00430B8C
Part of subcall function 00430B5B: #2606.MFC42U ref: 00430B9E
Part of subcall function 00430B5B: #4155.MFC42U(00009CEC,00009CEC), ref: 00430BCC
Part of subcall function 00430B5B: #4155.MFC42U(00008030,00009CEC), ref: 00430BE8
Part of subcall function 00430B5B: #535.MFC42U(?,00009CEC), ref: 00430BF2
Part of subcall function 00430B5B: #800.MFC42U ref: 00430C06

Strings

CMainFrame::UpdatePenMenus, xrefs: 00430961

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165#800Menu$#2809#4155#540ItemModify$#2606#535CheckEnableH_prolog3_memset
String ID: CMainFrame::UpdatePenMenus
API String ID: 2758797221-462036536
Opcode ID: 3a12a2f1e4e8c8e73dd82f65e6de2d12dc183cbff96d51334657c01beb303986
Instruction ID: b00e7e21cda0c896e6604d773320cc96b96bdb8f19e48ae25bc12cd25810f999
Opcode Fuzzy Hash: 3a12a2f1e4e8c8e73dd82f65e6de2d12dc183cbff96d51334657c01beb303986
Instruction Fuzzy Hash: D0516E31901219ABDB21EBA1DD9DFDEB7B8AF18308F1040EAB509A2191DB789A44CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0047785B, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 108synchronizationthreadCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00477865
memset.MSVCRT ref: 00477896
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004778AB
PathRemoveFileSpecW.SHLWAPI(?), ref: 004778C0
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004778D8
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004778E4
CreateThread.KERNEL32 ref: 0047790E
GetLastError.KERNEL32 ref: 00477978
SetEvent.KERNEL32(?), ref: 00477989
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00477992
CloseHandle.KERNEL32(00000000), ref: 004779AD
CloseHandle.KERNEL32(00000000), ref: 004779BE

Strings

CNBPrinter::RepairPrinter, xrefs: 00477873

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateEvent$CloseFileHandle$ErrorH_prolog3_LastModuleNameObjectPathRemoveSingleSpecThreadWaitmemset
String ID: CNBPrinter::RepairPrinter
API String ID: 3767702036-1531594758
Opcode ID: 77018bf9ddd94b2ce8d537de208b8f88ce5e35f7fa59e52464b1ddadeea92232
Instruction ID: 149d651056c55a57d286920980a09d41e0b94934f417469a83fbb235915cb5c8
Opcode Fuzzy Hash: 77018bf9ddd94b2ce8d537de208b8f88ce5e35f7fa59e52464b1ddadeea92232
Instruction Fuzzy Hash: BE41FAB1901219ABDB219BA59D4CFEB7B74EF95700F4440EFE608921A1DB78CD41CF28

Uniqueness

Uniqueness Score: -1.00%

Function 004782B3, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004782BA
#540.MFC42U(CNBFileDialog::GetPathName,00000000,00000010,004422C0,?,00000000,00000059,?,?,.jnt,?,00000001,?,?,?), ref: 004782DF
IsWindow.USER32(?), ref: 00478304
#2910.MFC42U(00000104), ref: 00478315

Part of subcall function 00477A58: __EH_prolog3.LIBCMT ref: 00477A5F
Part of subcall function 00477A58: GetParent.USER32(?), ref: 00477A7F
Part of subcall function 00477A58: #2859.MFC42U(00000000), ref: 00477A86

SendMessageW.USER32(?,00000464,00000104,00000000), ref: 00478333
#2606.MFC42U ref: 0047833F
#5568.MFC42U(000000FF), ref: 00478349
#2910.MFC42U(00000104), ref: 0047835A
SendMessageW.USER32(?,00000465,00000104,00000000), ref: 00478377
#2606.MFC42U ref: 00478383
#861.MFC42U(?), ref: 0047838E
#5568.MFC42U(000000FF), ref: 004783A8

Strings

CNBFileDialog::GetPathName, xrefs: 004782CA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2606#2910#5568H_prolog3MessageSend$#2859#540#861ParentWindow
String ID: CNBFileDialog::GetPathName
API String ID: 2250059815-3637126708
Opcode ID: 67d6d22f1418af66395bd19710c66480615d06bd8a8e6e6d85f1e3ab43dd55d2
Instruction ID: 715fa790c84cd2d95bfe240dbe87ee2ed27fee47e76e269182bf0055fb5b32cd
Opcode Fuzzy Hash: 67d6d22f1418af66395bd19710c66480615d06bd8a8e6e6d85f1e3ab43dd55d2
Instruction Fuzzy Hash: AC21B0707422109BDB006F658C4DBBE3B65AF45B15F14826FF90AE72E0DF799801CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004481E2, Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 354COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004481E9

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

SetRectEmpty.USER32(?), ref: 0044825C
#1165.MFC42U(CNotebookDoc::GetSmartInsertPoint,00000000,00000078,0044812D,?,?,?,-0000EF6B,?,00000001), ref: 004482C3
SetRect.USER32 ref: 004482FB
#1165.MFC42U(?,00000001), ref: 00448301
#1165.MFC42U(?,00000001), ref: 00448279

Part of subcall function 00429B1B: __EH_prolog3.LIBCMT ref: 00429B22

#1165.MFC42U(?,00000001), ref: 00448262

Part of subcall function 0042A3DE: __EH_prolog3.LIBCMT ref: 0042A3E5

#1165.MFC42U(?,00000001), ref: 004483B2
IntersectRect.USER32 ref: 004483E0

Part of subcall function 00429C69: __EH_prolog3.LIBCMT ref: 00429C70

#1165.MFC42U(?,00000001), ref: 00448562
#1165.MFC42U(?,00000001), ref: 00448577

Part of subcall function 0042929C: __EH_prolog3.LIBCMT ref: 004292A3

Strings

CNotebookDoc::GetSmartInsertPoint, xrefs: 0044820D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$Rect$EmptyH_prolog3_Intersect
String ID: CNotebookDoc::GetSmartInsertPoint
API String ID: 2351288037-724961410
Opcode ID: b4cc380a7a5c03eb9bc8f9ec61e537963fc35eaf1006125f6c2431a9305c99e6
Instruction ID: 13c8724dfb8c7ece49621d7f1fbf919233c418ae5441df7753b7f4c74fcd30c4
Opcode Fuzzy Hash: b4cc380a7a5c03eb9bc8f9ec61e537963fc35eaf1006125f6c2431a9305c99e6
Instruction Fuzzy Hash: C5E1F774A01219DFDB14DFA8C998AAEBBF5BF48304F14806EE805EB255EB34AD05CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00481B48, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00481B52
memset.MSVCRT ref: 00481BE0
StrFormatByteSizeW.SHLWAPI(?,?,?,00000064), ref: 00481BFA
SysAllocString.OLEAUT32(?), ref: 00481C0B
PropVariantClear.OLE32(?,00000000,?,CMetaListObject::GetDisplayTextForProperty,?,?,?,?,?,?,?,?,?,000002FC,00480384,?), ref: 00481E31

Strings

CMetaListObject::GetDisplayTextForProperty, xrefs: 00481B70

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocByteClearFormatH_prolog3_PropSizeStringVariantmemset
String ID: CMetaListObject::GetDisplayTextForProperty
API String ID: 1387920204-532197947
Opcode ID: 0d076cba0a2850ce3550a2d2907252a564f0a95139b9987916d419f64101e597
Instruction ID: 3c41dc8d7ee551c8d6a9502c059524b70c3073529b17a9d17e27164d23bb0b00
Opcode Fuzzy Hash: 0d076cba0a2850ce3550a2d2907252a564f0a95139b9987916d419f64101e597
Instruction Fuzzy Hash: 6D71B4709402059BDB36AB55CC58BBE777CAB14304F1048ABFA04AA2B1D778D983CF1D

Uniqueness

Uniqueness Score: -1.00%

Function 004258AF, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

RedrawWindow.USER32(?,?,00000000,00000041,CSplitWnd::OnDrawSplitter,00000000,0E0227DC), ref: 00425911
#2559.MFC42U(?,?,?,CSplitWnd::OnDrawSplitter,00000000,0E0227DC), ref: 00425952
InflateRect.USER32(?,000000FF,000000FF), ref: 0042595D
#2559.MFC42U(?,?,?), ref: 00425975

Strings

CSplitWnd::OnDrawSplitter, xrefs: 004258F6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2559$InflateRectRedrawWindow
String ID: CSplitWnd::OnDrawSplitter
API String ID: 1771000094-3399461404
Opcode ID: 363e91c04de24c982b67f90770273a5ab575cb3daf7878771538c020b990a98e
Instruction ID: 2a1e8c1b10f2f496b887bdc53b552900887b686f47575732c49a220407df784b
Opcode Fuzzy Hash: 363e91c04de24c982b67f90770273a5ab575cb3daf7878771538c020b990a98e
Instruction Fuzzy Hash: 8841AAB1208356EFCB00CF15CC80D6A7BA9FB98374B100B2EF465872E0DA39E944CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00456B44, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00456B4B
#384.MFC42U(CImagePicker::SetUpPickerImageList,00000000,0000001C,00456B28,?,?,?,00000003,00000003,?,?,00000001), ref: 00456B8E
#2400.MFC42U(CImagePicker::SetUpPickerImageList,00000000,0000001C,00456B28,?,?,?,00000003,00000003,?,?,00000001), ref: 00456BA3
#2088.MFC42U(?,?,?,00000000,?,?,?,?,00000003,00000003,?,?,00000001), ref: 00456BC7
ImageList_AddMasked.COMCTL32(00000002,?,?,?,?,?,?,00000003,00000003,?,?,00000001), ref: 00456C1E
#2406.MFC42U(?,?,?,00000003,00000003,?,?,00000001), ref: 00456C2C
#2400.MFC42U(?,?,?,00000003,00000003,?,?,00000001), ref: 00456C67

Part of subcall function 004BDF43: malloc.MSVCRT ref: 004BDF5B

#2406.MFC42U(?,?,?,00000003,00000003,?,?,00000001), ref: 00456C3A
ImageList_SetBkColor.COMCTL32(00000000,000000FF,?,?,?,00000003,00000003,?,?,00000001), ref: 00456C95

Strings

|e@, xrefs: 00456C48, 00456C00, 00456C24
CImagePicker::SetUpPickerImageList, xrefs: 00456B5D
|K, xrefs: 00456BD8, 00456C4B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2400#2406ImageList_$#2088#384ColorH_prolog3Maskedmalloc
String ID: CImagePicker::SetUpPickerImageList$|e@$|K
API String ID: 3208528020-1548140282
Opcode ID: 39e27ba71db40abb80494a94fd8de65f6b8caca7ba435fc910870f0144bff92f
Instruction ID: eb384aec2e2c4a097027067a36b93d803c1ea61720517200ebd5fd8cc5adc21c
Opcode Fuzzy Hash: 39e27ba71db40abb80494a94fd8de65f6b8caca7ba435fc910870f0144bff92f
Instruction Fuzzy Hash: 08418030601205DFCB25DFA5C984AEEB7B0FF04305F95442EE897A3291DB38A948DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00490590, Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 350stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0049059A
memset.MSVCRT ref: 004905F7
memset.MSVCRT ref: 00490611
PathAddExtensionW.SHLWAPI(?,.jnt,00000000,00000104,?,?,?,?,00000458,00445B8E,?,?,?), ref: 0049066B
lstrlenW.KERNEL32(00000000,?,?,?,?,00000458,00445B8E,?,?,?), ref: 0049067E
lstrcmpiW.KERNEL32(?,00000000,?,?,?,?,00000458,00445B8E,?,?,?), ref: 00490694

Strings

CNBNotebook::SaveNoteDocument, xrefs: 004905BF
.jnt, xrefs: 0049065F, 00490884

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ExtensionH_prolog3_Pathlstrcmpilstrlen
String ID: .jnt$CNBNotebook::SaveNoteDocument
API String ID: 1552251372-1968650638
Opcode ID: 12e94bd2f0bdf7ea355197eaf99285862246997051e971aa9634b70b7ff1a798
Instruction ID: 9d38baa3e97cdd70ae1b29eacac09b7624a948fe49861afada93f02725cbf16a
Opcode Fuzzy Hash: 12e94bd2f0bdf7ea355197eaf99285862246997051e971aa9634b70b7ff1a798
Instruction Fuzzy Hash: 46D161B19012259FDF24DF54CD84B9EBBB4AF44714F4440EEEA09AB241DB74AE84CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004271AC, Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 349COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00427207
InflateRect.USER32(?,?,?), ref: 0042721E
BeginDeferWindowPos.USER32 ref: 004272C7
#3087.MFC42U(0000EA20), ref: 0042730C
#4279.MFC42U(00000018,00000000,00000000), ref: 00427339
InvalidateRect.USER32(?,00000000,00000001), ref: 0042734E
#3087.MFC42U(-0000EA00), ref: 004273C5
#3087.MFC42U(0000EA10), ref: 0042745C
#2634.MFC42U(00000000), ref: 00427359

Part of subcall function 00426FB6: __EH_prolog3_GS.LIBCMT ref: 00426FBD
Part of subcall function 00426FB6: #4279.MFC42U(00000001,00000001,00000000,_AfxDeferClientPos,00000000,00000030,00427525,?,?,?,?,00000000), ref: 00427016
Part of subcall function 00426FB6: InflateRect.USER32(?,00000001,00000001), ref: 00427052
Part of subcall function 00426FB6: #3133.MFC42U(_AfxDeferClientPos,00000000,00000030,00427525,?,?,?,?,00000000), ref: 00427065
Part of subcall function 00426FB6: #4078.MFC42U(00412ED8), ref: 00427079
Part of subcall function 00426FB6: InflateRect.USER32(?,?,?), ref: 00427092
Part of subcall function 00426FB6: GetWindowRect.USER32 ref: 0042709B
Part of subcall function 00426FB6: GetParent.USER32(?), ref: 004270A8
Part of subcall function 00426FB6: #2859.MFC42U(00000000), ref: 004270AF
Part of subcall function 00426FB6: EqualRect.USER32 ref: 004270C4
Part of subcall function 00426FB6: #1231.MFC42U(?,?,?), ref: 004270D8

EndDeferWindowPos.USER32(00000000), ref: 0042758B

Strings

CSplitWnd::RecalcLayout, xrefs: 004271EE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$#3087InflateWindow$#4279Defer$#1231#2634#2859#3133#4078BeginClientEqualH_prolog3_InvalidateParent
String ID: CSplitWnd::RecalcLayout
API String ID: 1551416492-909641181
Opcode ID: c4a8ca06f49c0aee02cb86bd17a566cc91362e06258cae2a1f501c391cea90fd
Instruction ID: a692bcbe5d78237a8007d9c6b5879f039e8c47dfaf1eaf2dd7524c8e6a45cffc
Opcode Fuzzy Hash: c4a8ca06f49c0aee02cb86bd17a566cc91362e06258cae2a1f501c391cea90fd
Instruction Fuzzy Hash: 27E157312087019FC714DF29D984A2BBBE5FF88708F144A2EF596877A0DB78E845CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00457896, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 263windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045789D
SetRect.USER32 ref: 00457A5B
SendMessageW.USER32(?,0000043F,00000000,00000020), ref: 00457B01
SendMessageW.USER32(?,00000440,?,00000020), ref: 00457B46
SendMessageW.USER32(?,00000455,00000000,00000000), ref: 00457B64
SendMessageW.USER32(?,00000454,00000000,00000000), ref: 00457B7D
#5867.MFC42U(?,CNBToolbar::InitNBToolBar,00000000,0000002C,0042B146,0000000D,004D2550,00000088), ref: 00457BA4
SendMessageW.USER32(?,00000421,00000000,00000000), ref: 00457BBA
#6211.MFC42U(00000005), ref: 00457BC4

Part of subcall function 004BDF43: malloc.MSVCRT ref: 004BDF5B

Strings

, xrefs: 00457ACA
CNBToolbar::InitNBToolBar, xrefs: 004578AA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$#5867#6211H_prolog3Rectmalloc
String ID: $CNBToolbar::InitNBToolBar
API String ID: 3315176192-3531264751
Opcode ID: ba87941734368019ad0ab310c5f5f712f483dfe81490d1fcabf505721167c399
Instruction ID: a2d5d8a035afc511f66692e48c1eeefe69eb1de7b7eca464e591a1ef7fa6acdd
Opcode Fuzzy Hash: ba87941734368019ad0ab310c5f5f712f483dfe81490d1fcabf505721167c399
Instruction Fuzzy Hash: 26B15970605214AFDB14CF59D884BAA3BA1FF49311F1881BAFD099F3A2CB349945CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00446A0B, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00446A12
#1165.MFC42U(CNotebookDoc::CreatePicture,00000000,00000054,0044894E,?,00000000), ref: 00446A44
#1662.MFC42U ref: 00446A49

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

Part of subcall function 004481E2: __EH_prolog3_GS.LIBCMT ref: 004481E9
Part of subcall function 004481E2: SetRectEmpty.USER32(?), ref: 0044825C
Part of subcall function 004481E2: #1165.MFC42U(?,00000001), ref: 00448262
Part of subcall function 004481E2: #1165.MFC42U(?,00000001), ref: 00448279

#1165.MFC42U(?,?,00000000), ref: 00446A8C

Part of subcall function 0042A3DE: __EH_prolog3.LIBCMT ref: 0042A3E5

SetRectEmpty.USER32(?), ref: 00446ADF
#1165.MFC42U ref: 00446AF0

Part of subcall function 00429B1B: __EH_prolog3.LIBCMT ref: 00429B22

#1165.MFC42U(?,?), ref: 00446B59

Part of subcall function 0042AF6F: __EH_prolog3.LIBCMT ref: 0042AF76
Part of subcall function 0042AF6F: #1165.MFC42U(CMainFrame::GetNotebookDPIRatio,00000000,0000001C,004293AF), ref: 0042AF98
Part of subcall function 0042AF6F: GetDC.USER32(?), ref: 0042AFC0
Part of subcall function 0042AF6F: #2854.MFC42U(00000000), ref: 0042AFC7
Part of subcall function 0042AF6F: GetDeviceCaps.GDI32(?,00000058), ref: 0042AFED
Part of subcall function 0042AF6F: ReleaseDC.USER32 ref: 0042B00B

#1165.MFC42U ref: 00446B93
#1165.MFC42U(?,?,?,?), ref: 00446C13
InvalidateRect.USER32(?,00000000,00000000,?,?,?,?), ref: 00446C2A

Strings

CNotebookDoc::CreatePicture, xrefs: 00446A30

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3Rect$EmptyH_prolog3_$#1662#2854CapsDeviceInvalidateRelease
String ID: CNotebookDoc::CreatePicture
API String ID: 1227628522-2942224107
Opcode ID: 83aa9871b0a478275b38df6d73bb789e9897bb7e56d3d57b28871ad5599d399a
Instruction ID: 70c4fe1b4871b76d10c1f1efa0134fb11028917909993bdcd3a838e2443d4da3
Opcode Fuzzy Hash: 83aa9871b0a478275b38df6d73bb789e9897bb7e56d3d57b28871ad5599d399a
Instruction Fuzzy Hash: 15916A71E01218DFDB05DFA4CA84AEDBBB4EF09310F26409AE845B7291D7359D11CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0044C0F4, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 179stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044C0FE
memset.MSVCRT ref: 0044C155
SysStringLen.OLEAUT32(00000000), ref: 0044C1BE
lstrcmpW.KERNEL32(00000000,004063B8), ref: 0044C1DD
lstrcmpW.KERNEL32(00000000,004063BC), ref: 0044C1F2
SysFreeString.OLEAUT32(00000000), ref: 0044C2DD
#1165.MFC42U ref: 0044C30E

Strings

CNotebookDoc::GenerateDefaultName, xrefs: 0044C126
"/\*<>?|:Notes, xrefs: 0044C272
F_InvalidChar, xrefs: 0044C25B
Note, xrefs: 0044C333

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Stringlstrcmp$#1165FreeH_prolog3_memset
String ID: "/\*<>?|:Notes$CNotebookDoc::GenerateDefaultName$F_InvalidChar$Note
API String ID: 2654150883-1330448167
Opcode ID: f06014bba7976e5b3a1480853f9b8cc615dfb7baa8dc92fa6e7c7d3378f2fa7b
Instruction ID: 3bc970823d96596d9e0d16d80a01b67d1938eeb2c865aa3553b414810103cc86
Opcode Fuzzy Hash: f06014bba7976e5b3a1480853f9b8cc615dfb7baa8dc92fa6e7c7d3378f2fa7b
Instruction Fuzzy Hash: 1D615471E021299BEB609FA5DC897DA73B4BF18304F1440EBE809E7251D7B89E85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00496332, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 175stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0049633C
memset.MSVCRT ref: 0049637F
memset.MSVCRT ref: 00496399
memset.MSVCRT ref: 004963B3
lstrlenW.KERNEL32(?,CachePath,?,00000104,?,00000105,?,?,00000000,00000208), ref: 00496456
PathFindFileNameW.SHLWAPI(?,?,?,?,00000000,00000208), ref: 00496489
GetFileAttributesW.KERNEL32(?,CachePath,?,?,?,00000000,00000208), ref: 00496579
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000,00000208), ref: 0049658A

Strings

CachePath, xrefs: 00496439, 00496556
CNBCacheMgr::SaveHierarchy, xrefs: 0049635A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Filememset$Attributes$FindH_prolog3_NamePathlstrlen
String ID: CNBCacheMgr::SaveHierarchy$CachePath
API String ID: 3075374082-1386617354
Opcode ID: a503d5f756b7298be423116adf3734b6788ca1dffa7f4be0095946087da057f6
Instruction ID: a1e4cefe82d4e3b0a4c9b6a44c6c3a0b3be2851581e3529aa01c42a633aa9e4c
Opcode Fuzzy Hash: a503d5f756b7298be423116adf3734b6788ca1dffa7f4be0095946087da057f6
Instruction Fuzzy Hash: 9F615071D0122CEBDF20DB61DD45BDEB7B8AF44714F0641EAA849A7201DE35AE84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0047C133, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0047C13D
lstrlenW.KERNEL32(.jnt,G_GenerateUniqueName,?,00000634,0044C378,?,00000000,0000EF95,00000001), ref: 0047C184
memset.MSVCRT ref: 0047C19F
memset.MSVCRT ref: 0047C1BD
lstrlenW.KERNEL32(?,?,?,?,?,?,?), ref: 0047C1D6
memset.MSVCRT ref: 0047C205
PathCombineW.SHLWAPI(?,?,?,?,00000103,?,?,?,?,?,?,?,?,?), ref: 0047C238
GetFileAttributesW.KERNEL32(?,.jnt,?,?,?,?,?,?,?,?,?,?), ref: 0047C313
PathFindFileNameW.SHLWAPI(?,?,?,?,?,?,?,?,?,?), ref: 0047C382

Strings

G_GenerateUniqueName, xrefs: 0047C16C
.jnt, xrefs: 0047C17F, 0047C2F7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$FilePathlstrlen$AttributesCombineFindH_prolog3_Name
String ID: .jnt$G_GenerateUniqueName
API String ID: 3543009071-771279321
Opcode ID: fd4b540eae2d21fad4a507e8323797744ceea584a01f855cdd87adf63b32016f
Instruction ID: b6078536fb0d6197f1425545d9d34f3d25bb1a04d46aed74011b627c331f48b7
Opcode Fuzzy Hash: fd4b540eae2d21fad4a507e8323797744ceea584a01f855cdd87adf63b32016f
Instruction Fuzzy Hash: 0C51A0B0A002189BDB24DF65CD84BDE7376AF58314F0080EFE909A7291DB799E95CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004423A4, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 153COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004423AE
memset.MSVCRT ref: 00442400
memset.MSVCRT ref: 0044241E
memset.MSVCRT ref: 0044243C
#1165.MFC42U ref: 00442481

Part of subcall function 00441B78: #1662.MFC42U ref: 00441BC9

PathFindFileNameW.SHLWAPI(?,00000001), ref: 004424C9
PathRemoveFileSpecW.SHLWAPI(?,?,00000000), ref: 004424F8
#1165.MFC42U(00000000,00000059,?,00000001), ref: 00442588
#1165.MFC42U(00000000,00000059,?,00000001), ref: 004425BF

Strings

Z, xrefs: 0044249A
CNotebookApp::PromptForNewName, xrefs: 004423D6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165memset$FilePath$#1662FindH_prolog3_NameRemoveSpec
String ID: CNotebookApp::PromptForNewName$Z
API String ID: 3890435562-1006899250
Opcode ID: 595e1417fcbbc65cced1c18c2d9af8daa23d8bc1c91940654798fe332013dc38
Instruction ID: fca5311201097cee0bedb6844292a07927fc2926033797ab3f62f70235d3a438
Opcode Fuzzy Hash: 595e1417fcbbc65cced1c18c2d9af8daa23d8bc1c91940654798fe332013dc38
Instruction Fuzzy Hash: 505163719402289BEB20DF60CD55BEA7375EF84314F4040EAF909A7251DB799F94CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0043341B, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 119windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00433425
memset.MSVCRT ref: 00433467
#1165.MFC42U(00000000,0000021C,004308C5), ref: 0043346F
LoadMenuW.USER32 ref: 0043347B
GetMenuStringW.USER32 ref: 0043349A
DestroyMenu.USER32(00000000), ref: 004334CC
InsertMenuW.USER32(?,000002BD,00000000,00009CC6,?), ref: 0043351B
DeleteMenu.USER32(?,000002BD,00000000), ref: 0043352C
EnableMenuItem.USER32 ref: 00433550
RemoveMenu.USER32(?,000002BD,00000000), ref: 0043355E

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

CMainFrame::ResetMRUMenu, xrefs: 00433442

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$#1165DeleteDestroyEnableH_prolog3_InsertItemLoadMessageRemoveStringTracememset
String ID: CMainFrame::ResetMRUMenu
API String ID: 1335863198-2924252418
Opcode ID: 74320e0a287b3aa6ecc7603732551693c4daea0a7adc7dc181de7bdeb6de1cbd
Instruction ID: c12c2f7c00b221413fb5e6ae55deff07adfa657cd323e03b47b12120ef1d60d4
Opcode Fuzzy Hash: 74320e0a287b3aa6ecc7603732551693c4daea0a7adc7dc181de7bdeb6de1cbd
Instruction Fuzzy Hash: B04128B0700214ABE7219F21DE49F6B3B60AF18709F14406BFA09972E1CB78CE41CF28

Uniqueness

Uniqueness Score: -1.00%

Function 0047C3A6, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0047C3AD
#540.MFC42U(G_AddIntegerSuffixToName,00000000,0000001C,0047C2CE,00000001,?,?,?,?,?,?,?,?,?,?), ref: 0047C3FA
#540.MFC42U(?,?,?,?,?,?,?,?,?), ref: 0047C403
#4155.MFC42U(00000000,?,?,?,?,?,?,?,?,?), ref: 0047C40F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 0047C419
#2810.MFC42U(?,00408CF8,?,?,?,?,?,?,?,?,?,?), ref: 0047C467
#6868.MFC42U(00412120,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0047C47F
#6868.MFC42U(00412128,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0047C48C
#800.MFC42U(?,00000104,?,?,?,?,?,?,?,?,?), ref: 0047C4AC
#800.MFC42U(?,?,?,?,?,?,?,?,?), ref: 0047C4B5

Strings

G_AddIntegerSuffixToName, xrefs: 0047C3BE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #540#6868#800$#2810#4155ErrorH_prolog3_catchLast
String ID: G_AddIntegerSuffixToName
API String ID: 3571478040-1293514853
Opcode ID: 4398890fd3081d33d250ca62c48f9a7b010d4ffea779d0f6f5238891be47d089
Instruction ID: 1b8d83bb856bba146dc1ef1025551ad76ba32e55b3b43ca32a4da2415b2a5d6b
Opcode Fuzzy Hash: 4398890fd3081d33d250ca62c48f9a7b010d4ffea779d0f6f5238891be47d089
Instruction Fuzzy Hash: 9831C170D0010AEBDB01DB90C955BFE7B74AF14318F24805FE905B7291DB789A46CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004A8919, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 78timeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004A8920
#861.MFC42U(?,CRecoverDlg::Init,?,00000030,004A860D,?,?,?,?,?,000000A2,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8957
FileTimeToSystemTime.KERNEL32(?,00000714,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8967
#861.MFC42U(?,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8988
SysFreeString.OLEAUT32(?), ref: 004A898D
GetLastError.KERNEL32(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8995
FileTimeToSystemTime.KERNEL32(?,00000714,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A89B2
#861.MFC42U(?,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A89D5
SysFreeString.OLEAUT32(?), ref: 004A89DA
GetLastError.KERNEL32(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A89F5

Strings

CRecoverDlg::Init, xrefs: 004A8933

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$#861$ErrorFileFreeLastStringSystem$H_prolog3_catch_
String ID: CRecoverDlg::Init
API String ID: 3274203168-2069738206
Opcode ID: 5b7f309ddf050b853582884ff18e8960184befc2b24c3f6afec8224cb0e4f203
Instruction ID: 6f7b24973ae012173cb4ff9bca21ef058cfd4e38e438201ff626e543353173b0
Opcode Fuzzy Hash: 5b7f309ddf050b853582884ff18e8960184befc2b24c3f6afec8224cb0e4f203
Instruction Fuzzy Hash: BD312C72D0111E9BCF01DFA5DC50AEEBBB8AF55304F05812AE805BB150DB349906CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0046B508, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046B50F
#489.MFC42U(00000607,00000000,00000008,00466E85,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?), ref: 0046B520
#567.MFC42U(?,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920), ref: 0046B550
#567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0046B564
#567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0046B578
#567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0046B58C
#567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0046B5A0
#538.MFC42U(004048E0,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920), ref: 0046B5CC
#538.MFC42U(004048E0,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920), ref: 0046B5D9

Strings

$K, xrefs: 0046B566, 0046B57A
CTitleSetupPage::CTitleSetupPage, xrefs: 0046B5DD

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$#538$#489H_prolog3
String ID: $K$CTitleSetupPage::CTitleSetupPage
API String ID: 117952244-972472048
Opcode ID: 80bd6035f87268343d4efa9c67e03684089a4da22393082de52792c372fdd7f2
Instruction ID: 24a38189d60e87d7c1795aa0e351357ddce8c1e3d72d1eb553bda293c090ca27
Opcode Fuzzy Hash: 80bd6035f87268343d4efa9c67e03684089a4da22393082de52792c372fdd7f2
Instruction Fuzzy Hash: 1A217C71900284DADB01DF55C8547DDBBA0AF55304F1484BEDD897F2C2CBB92B09CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00447E0A, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00447E11
#1165.MFC42U(CNotebookDoc::SelectAll,00000000,00000038,0042D562,00000000), ref: 00447E75
#1662.MFC42U ref: 00447E7E
#1165.MFC42U ref: 00447E88
#1165.MFC42U ref: 00447F41
SysFreeString.OLEAUT32(00000000), ref: 00447F86
#1165.MFC42U ref: 0044800D
UpdateWindow.USER32(?), ref: 00448020

Strings

CNotebookDoc::SelectAll, xrefs: 00447E21
W, xrefs: 00447EE1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#1662FreeH_prolog3StringUpdateWindow
String ID: CNotebookDoc::SelectAll$W
API String ID: 566486762-1096026083
Opcode ID: 5bf56c05ce42acbdd2bd0120692a55ddc187f4eb126dc07c592c6ea4a7a49e80
Instruction ID: 49749f098628a83d0e30d0497b118049b49a322fe42908c75b99448496ab6490
Opcode Fuzzy Hash: 5bf56c05ce42acbdd2bd0120692a55ddc187f4eb126dc07c592c6ea4a7a49e80
Instruction Fuzzy Hash: B8818170A01206DFEB00DF94C988FAEBBB4AF08315F15416EF905BB291DB789E05CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0047AC81, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 194timememoryCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?,G_FormatDateTime,00000000,00000000,00000000), ref: 0047ACDE
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0047AD36
FileTimeToSystemTime.KERNEL32(?,?), ref: 0047AD86
GetDateFormatW.KERNEL32(00000400,00000041,?,00000000,?,000000FF), ref: 0047ADE4
GetLastError.KERNEL32 ref: 0047ADF4
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,000000FF), ref: 0047AE5B
GetLastError.KERNEL32 ref: 0047AE65
SysAllocString.OLEAUT32(?), ref: 0047AEDA

Strings

G_FormatDateTime, xrefs: 0047ACAB
%s %s, xrefs: 0047AEBA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$File$ErrorFormatLastSystem$AllocDateLocalString
String ID: %s %s$G_FormatDateTime
API String ID: 2961029684-3002838139
Opcode ID: 6eb12dcd9870b1a680c64dd9c3e68f64057b73fe063168313f342de0d75bb645
Instruction ID: 9aeb1a724695c3d78e7d3de22d6e8cbe60bfcecef728c0c313ef61f5e274dcbc
Opcode Fuzzy Hash: 6eb12dcd9870b1a680c64dd9c3e68f64057b73fe063168313f342de0d75bb645
Instruction Fuzzy Hash: 1171C2716412199BDB21CB11CD04BEE77A8AF44304F10C0EBEA48DB251DB78CE96CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0047B447, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 192windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 004AED8E: GetDC.USER32(00000000), ref: 004AEDAF
Part of subcall function 004AED8E: GetLastError.KERNEL32 ref: 004AEDBB

SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 0047B4A9

Part of subcall function 004AEC85: SelectObject.GDI32(?,00000000), ref: 004AECAA
Part of subcall function 004AEC85: GetLastError.KERNEL32(?,?,005A0049), ref: 004AECB6

SendMessageW.USER32(00000000,00000403,00000000,00000000), ref: 0047B4C9
ImageList_GetIconSize.COMCTL32(00000000,?,?,?,?,00000000), ref: 0047B4DE
SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 0047B4EE
memset.MSVCRT ref: 0047B50A
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0047B552
SendMessageW.USER32(00000000,00000148,00000000,?), ref: 0047B56C
lstrlenW.KERNEL32(?,?,?,00000000), ref: 0047B577
SendMessageW.USER32(00000000,00000160,00000000,00000000), ref: 0047B611

Strings

G_AutoSizeComboBoxDropDown, xrefs: 0047B473

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$ErrorLast$IconImageList_ObjectSelectSizelstrlenmemset
String ID: G_AutoSizeComboBoxDropDown
API String ID: 3054562406-863935403
Opcode ID: e00c700924de8699c4ae34c45f531825d0b18c4aa57c053f6cc67f0ddb57e353
Instruction ID: cd42155db95d294bbcb6ee4caaef1a0e7a802c04723e6a1ca429eacc4db8c59f
Opcode Fuzzy Hash: e00c700924de8699c4ae34c45f531825d0b18c4aa57c053f6cc67f0ddb57e353
Instruction Fuzzy Hash: 61519171204301ABD714DF66CC85FAFB7E9EFD5704F00492EF64596280DB78D909C6AA

Uniqueness

Uniqueness Score: -1.00%

Function 0048611E, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 186memorywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00486128
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00486158

Part of subcall function 00485242: __EH_prolog3.LIBCMT ref: 00485249
Part of subcall function 00485242: #1165.MFC42U(_LoadStringWrap,00000000,00000010,00485F62,00000104), ref: 0048526B
Part of subcall function 00485242: GetLastError.KERNEL32(?,00000000,00000000), ref: 00485285

#6776.MFC42U(?,?,?,?,00000100), ref: 004861BD
#1165.MFC42U(?,?,?,00000100), ref: 004861FC
memset.MSVCRT ref: 00486239
SysAllocString.OLEAUT32(?), ref: 00486276
#6776.MFC42U(?), ref: 004862E1

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

#6776.MFC42U(?,?,?,00000100,00000100), ref: 00486395

Strings

CTOCView::_InitScopeBox, xrefs: 0048613E
', xrefs: 004862C4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #6776$#1165Message$AllocErrorH_prolog3H_prolog3_LastSendStringTracememset
String ID: '$CTOCView::_InitScopeBox
API String ID: 543593307-1724241728
Opcode ID: 892b268181de007382c363f8b392620e6ecc249f8b9664fad358d24701d8dc29
Instruction ID: 0b444f48c4a26c7c19f7b3e3889c7769435b8f5f63c9f7b34bcc95fdc627118e
Opcode Fuzzy Hash: 892b268181de007382c363f8b392620e6ecc249f8b9664fad358d24701d8dc29
Instruction Fuzzy Hash: 1F7191B0A002188BDB65DF65CC84BDE77B5AF44318F0045EEE60997292DB74EA85CF2C

Uniqueness

Uniqueness Score: -1.00%

Function 0042E4CD, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

#1165.MFC42U ref: 0042E52F

Part of subcall function 0042A482: __EH_prolog3.LIBCMT ref: 0042A489

#1165.MFC42U ref: 0042E544
#1165.MFC42U(?), ref: 0042E58F
#1165.MFC42U(00000000,00000000), ref: 0042E5BE
#1165.MFC42U(00000074), ref: 0042E5EB
#1165.MFC42U(00000000,00000000), ref: 0042E60C
#1165.MFC42U(?), ref: 0042E63B
#1165.MFC42U(00000000,00000000), ref: 0042E655

Part of subcall function 0042ADE7: __EH_prolog3.LIBCMT ref: 0042ADEE
Part of subcall function 0042ADE7: #1165.MFC42U(CMainFrame::GetCurrentPenType,00000000,0000000C,00430CA9), ref: 0042AE06

Part of subcall function 0042AE3C: __EH_prolog3.LIBCMT ref: 0042AE43
Part of subcall function 0042AE3C: #1165.MFC42U(CMainFrame::GetCurrentWritingPenIndex,00000000,0000000C,0042B2E0,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0,00000005,00009C7C), ref: 0042AE5B

Part of subcall function 004313B7: __EH_prolog3.LIBCMT ref: 004313BE
Part of subcall function 004313B7: #1165.MFC42U(CMainFrame::GetWritingPen,?,0000000C,0042B2EA,?,00000000,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0), ref: 004313E7

Part of subcall function 004316D7: __EH_prolog3.LIBCMT ref: 004316DE
Part of subcall function 004316D7: #1165.MFC42U(CMainFrame::SetWritingPensSettings,00000000,00000028,0042E6A3,?,00000001,00000000,?,00000000), ref: 00431750
Part of subcall function 004316D7: #1165.MFC42U(CMainFrame::SetWritingPen,?,CMainFrame::SetWritingPensSettings,00000000,00000028,0042E6A3,?,00000001,00000000,?,00000000), ref: 0043178C

Strings

t, xrefs: 0042E587
CMainFrame::OnToolbarColor, xrefs: 0042E513

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CMainFrame::OnToolbarColor$t
API String ID: 3111753120-1229394287
Opcode ID: e7b27b8cc758afd03a930183b066957980587270b936ca220bbf279c320edd70
Instruction ID: 9799df40bc8fc4c77d74edf490322e48def2b84c1dff7e428b982520fa07fe2b
Opcode Fuzzy Hash: e7b27b8cc758afd03a930183b066957980587270b936ca220bbf279c320edd70
Instruction Fuzzy Hash: F75169702043109FD314EF26D985F6BB7E8AB98318F84452EF959C7291DB78E804CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004960D5, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 153stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004960DF
memset.MSVCRT ref: 00496124
memset.MSVCRT ref: 00496142
memset.MSVCRT ref: 00496160
lstrlenW.KERNEL32(?,CachePath,?,00000104,?,00000105,?,?,00000000,00000208), ref: 00496201
PathCombineW.SHLWAPI(?,?,?,?,?,00000000,00000208), ref: 0049623B
StgOpenStorageEx.OLE32(?,00000010,00000005,00000000,00000000,00000000,004010D0,?,CNBCacheMgr::_OpenRootStorage,00000000), ref: 0049629C

Strings

CachePath, xrefs: 004961E4
CNBCacheMgr::_OpenRootStorage, xrefs: 0049626A
CNBCacheMgr::LoadHierarchy, xrefs: 00496100

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$CombineH_prolog3_OpenPathStoragelstrlen
String ID: CNBCacheMgr::LoadHierarchy$CNBCacheMgr::_OpenRootStorage$CachePath
API String ID: 4059391087-2386104377
Opcode ID: a741f3879a2b5ff4ee10c148add1d5867b47d73d50d79c246ac04861a7700d28
Instruction ID: f4d5cfe4b3d383a287efb2bdca86aad7cb43788c66658280a947e5c06c9d45bd
Opcode Fuzzy Hash: a741f3879a2b5ff4ee10c148add1d5867b47d73d50d79c246ac04861a7700d28
Instruction Fuzzy Hash: 81515D71D0122C9BDF20EB51CC45BEEB7B8BF14714F0641EAA948A7241DA799E84CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0047BBEC, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 140registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0047BC81
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00020019,?,?,-0000005D,00000001), ref: 0047BCC7
SHGetFolderPathAndSubDirW.SHELL32(00000000,0000802B,00000000,00000000,?,?,?,-0000005D,00000001), ref: 0047BD53

Part of subcall function 004779D8: RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0047BD0C,?,00000000,?,?,?,0047BD0C,?,?,?), ref: 004779F8

ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,-0000005D,00000001), ref: 0047BD1B
GetLastError.KERNEL32(?,-0000005D,00000001), ref: 0047BD25
RegCloseKey.ADVAPI32(?,?,-0000005D,00000001), ref: 0047BDA0

Strings

Microsoft Shared\Stationery, xrefs: 0047BC68
G_GetStationeryPath, xrefs: 0047BC15
Software\Microsoft\Shared Tools\Stationery, xrefs: 0047BC47
Stationery Folder, xrefs: 0047BC56

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseEnvironmentErrorExpandFolderLastOpenPathQueryStringsValuememset
String ID: G_GetStationeryPath$Microsoft Shared\Stationery$Software\Microsoft\Shared Tools\Stationery$Stationery Folder
API String ID: 1917165145-2932512137
Opcode ID: 49c0379ee7b5625095d4bb7028953187d41c51d2e4d855eb91e56ba03c540bed
Instruction ID: 0b829f20e4259483103d949cf97fa0a923c9a3ad5c06f413b83ea34088689fae
Opcode Fuzzy Hash: 49c0379ee7b5625095d4bb7028953187d41c51d2e4d855eb91e56ba03c540bed
Instruction Fuzzy Hash: CD514C72D012289BEB719B549D48FEE77B8EB04714F0141EBE909E7250DB749E848B98

Uniqueness

Uniqueness Score: -1.00%

Function 004965D3, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 125filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004965DD
memset.MSVCRT ref: 0049661D
memset.MSVCRT ref: 00496637
memset.MSVCRT ref: 00496651
lstrlenW.KERNEL32(?,CachePath,?,00000104,?,00000105), ref: 004966E1
PathCombineW.SHLWAPI(?,?,?), ref: 0049671D
DeleteFileW.KERNEL32(?), ref: 00496742
GetLastError.KERNEL32 ref: 0049674C

Strings

CachePath, xrefs: 004966C4, 0049677A
CNBCacheMgr::DeleteCache, xrefs: 004965ED

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$CombineDeleteErrorFileH_prolog3_LastPathlstrlen
String ID: CNBCacheMgr::DeleteCache$CachePath
API String ID: 2513254146-2832481568
Opcode ID: 51e57f2f6c81625ddc3fcfe043fe203fb8277e219160d1f912628a91863da63a
Instruction ID: f3e7e36c6e1a7b75c500332713b30690b977697097e00ccd6e738664058bcf22
Opcode Fuzzy Hash: 51e57f2f6c81625ddc3fcfe043fe203fb8277e219160d1f912628a91863da63a
Instruction Fuzzy Hash: 2F417175D012389BDB20EB918C45BDE77B8AF44704F0641FBA84DA3201DE399E84CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 004914A7, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 124stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004914B1
memset.MSVCRT ref: 004914F0
#1165.MFC42U ref: 00491504
lstrlenW.KERNEL32(?,?,?,00000063), ref: 00491570
PathFileExistsW.SHLWAPI(?), ref: 00491585
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 0049159C
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004915F9
SHSetLocalizedName.SHELL32(?,?,00009CD1), ref: 00491616
#1165.MFC42U(?,?,00000063), ref: 00491649

Strings

CNBNotebook::_CreateAddMyNotesFolder, xrefs: 004914C1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165FileName$CreateDirectoryExistsH_prolog3_LocalizedModulePathlstrlenmemset
String ID: CNBNotebook::_CreateAddMyNotesFolder
API String ID: 627955166-3328245262
Opcode ID: 7a2ecd4ff0b886e625470aa52c5ac9ac608b0ee00768e5e09cb6b186df896a50
Instruction ID: dd7466b0d865ff3a83a180e085d8cb12174963a2d337cbc0e4a881e03cb0d570
Opcode Fuzzy Hash: 7a2ecd4ff0b886e625470aa52c5ac9ac608b0ee00768e5e09cb6b186df896a50
Instruction Fuzzy Hash: 934165B1E0111AABDB209B61CD94BAA7BB8AF44304F4441BBE605D7251DB38DF45CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 00470643, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0047064A

Part of subcall function 0047079B: __EH_prolog3_GS.LIBCMT ref: 004707A2
Part of subcall function 0047079B: #4050.MFC42U(00000408,CAdvancedFindDialog::_UpdateCustomDateControls,00000000,00000024,0047069E,CAdvancedFindDialog::UpdateControls,00000000,0000002C,00473DFB,CSrchView::UpdateControls), ref: 004707FD
Part of subcall function 0047079B: #3087.MFC42U(000003F6), ref: 00470814
Part of subcall function 0047079B: #2634.MFC42U(00000000), ref: 0047081D

#3087.MFC42U(0000040B,CAdvancedFindDialog::UpdateControls,00000000,0000002C,00473DFB,CSrchView::UpdateControls), ref: 004706B7
#2634.MFC42U(00000000), ref: 004706C0
#1165.MFC42U ref: 004706E1
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00470724
#2634.MFC42U(?), ref: 00470735
#2634.MFC42U(?), ref: 0047074A
#2634.MFC42U(00000000), ref: 00470766
#2634.MFC42U(00000000), ref: 00470782

Strings

CAdvancedFindDialog::UpdateControls, xrefs: 00470653

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2634$#3087H_prolog3_$#1165#4050MessageSend
String ID: CAdvancedFindDialog::UpdateControls
API String ID: 2164259896-1327423714
Opcode ID: 223b96623bafa39eb8b521714abe310f2dea131f1075cdae6831442dfbbb1d4e
Instruction ID: 6aa643033ed5fc3ed27b53c5cf0525e87880e2968f95525067bbea6fc00ba37e
Opcode Fuzzy Hash: 223b96623bafa39eb8b521714abe310f2dea131f1075cdae6831442dfbbb1d4e
Instruction Fuzzy Hash: A531C671A12601EBD718AF71DD99BFEB774BF48304F00413AE91AA6291DF786801CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004A0B08, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004A0B0F
#540.MFC42U(CCorrectionUI::ShowError,00000000,00000020,004A228F,80004206), ref: 004A0B75
#3871.MFC42U(00000000), ref: 004A0B85
#540.MFC42U ref: 004A0B8E
#4155.MFC42U(00000000), ref: 004A0B9F
#4219.MFC42U(00000000,00000000,00002000), ref: 004A0BB2
#800.MFC42U ref: 004A0BC5
#800.MFC42U ref: 004A0BCE
#2637.MFC42U(?), ref: 004A0BF9

Strings

CCorrectionUI::ShowError, xrefs: 004A0B1B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #540#800$#2637#3871#4155#4219H_prolog3_catch
String ID: CCorrectionUI::ShowError
API String ID: 326403108-1980946868
Opcode ID: 2b3820a9683cb589579b0e17a3da2aa1b55a703f0104b771ccfa29b2c12d43ee
Instruction ID: 585a5afed5cd1b52a5c8b235c26bb051e91de2b5fe49114ff247e7e2da593db1
Opcode Fuzzy Hash: 2b3820a9683cb589579b0e17a3da2aa1b55a703f0104b771ccfa29b2c12d43ee
Instruction Fuzzy Hash: 14219F71A0120AEFDB01DBD4D999BFDBB70AB25308F10406FE91277191CB7C2A46D76A

Uniqueness

Uniqueness Score: -1.00%

Function 00430C24, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00430C2B
#1165.MFC42U(CMainFrame::OnHighlighter,00000000,0000000C,0042C830,?), ref: 00430C4B
#1165.MFC42U ref: 00430C63
#1662.MFC42U ref: 00430C68
#1165.MFC42U(00000000), ref: 00430C83
UpdateWindow.USER32(?), ref: 00430C96

Part of subcall function 00435600: __EH_prolog3_catch.LIBCMT ref: 00435607
Part of subcall function 00435600: #268.MFC42U(00000010,0042BC79), ref: 0043560F
Part of subcall function 00435600: #1165.MFC42U ref: 0043561D
Part of subcall function 00435600: #2644.MFC42U ref: 00435626
Part of subcall function 00435600: #1560.MFC42U ref: 00435630

#1165.MFC42U ref: 00430C72

Part of subcall function 0044E0AC: __EH_prolog3.LIBCMT ref: 0044E0B3
Part of subcall function 0044E0AC: #1165.MFC42U(CNBDocViewCtrl::SetActionState,?,CNotebookView::SetActionState,00000000,00000018,0044D595,00000000,?,00000000), ref: 0044E131

#1165.MFC42U ref: 00430CAE
#1165.MFC42U(00000000,00000001), ref: 00430CD4

Part of subcall function 0044782F: __EH_prolog3.LIBCMT ref: 00447836

Strings

CMainFrame::OnHighlighter, xrefs: 00430C38

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$#1560#1662#2644#268H_prolog3_catchUpdateWindow
String ID: CMainFrame::OnHighlighter
API String ID: 2606574178-2620411024
Opcode ID: d2f622073aeb2af5d6a6962ee0cb2cc62fa469666f554be7345fe8b627a6792f
Instruction ID: af1b76b8f1d3afa7db94bd636d230257685d239544eeb9a3039a7736a85d8659
Opcode Fuzzy Hash: d2f622073aeb2af5d6a6962ee0cb2cc62fa469666f554be7345fe8b627a6792f
Instruction Fuzzy Hash: 2D1145306011149FD704FB66DD9AEAE7BE5AF48304F5540AFE405972A2CE789C01CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00430CF9, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00430D00
#1165.MFC42U(CMainFrame::OnPen,00000000,0000000C,0042C822,00000005), ref: 00430D20
#1165.MFC42U ref: 00430D38
#1662.MFC42U ref: 00430D3D
#1165.MFC42U(00000000), ref: 00430D58
UpdateWindow.USER32(?), ref: 00430D6B

Part of subcall function 00435600: __EH_prolog3_catch.LIBCMT ref: 00435607
Part of subcall function 00435600: #268.MFC42U(00000010,0042BC79), ref: 0043560F
Part of subcall function 00435600: #1165.MFC42U ref: 0043561D
Part of subcall function 00435600: #2644.MFC42U ref: 00435626
Part of subcall function 00435600: #1560.MFC42U ref: 00435630

#1165.MFC42U ref: 00430D47

Part of subcall function 0044E0AC: __EH_prolog3.LIBCMT ref: 0044E0B3
Part of subcall function 0044E0AC: #1165.MFC42U(CNBDocViewCtrl::SetActionState,?,CNotebookView::SetActionState,00000000,00000018,0044D595,00000000,?,00000000), ref: 0044E131

#1165.MFC42U ref: 00430D82
#1165.MFC42U(00000000), ref: 00430DA7

Part of subcall function 0044782F: __EH_prolog3.LIBCMT ref: 00447836

Strings

CMainFrame::OnPen, xrefs: 00430D0D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$#1560#1662#2644#268H_prolog3_catchUpdateWindow
String ID: CMainFrame::OnPen
API String ID: 2606574178-3386536400
Opcode ID: 93d7e7b68847bd7301383d2ffc6dfa1298a04f93c30e47d282b582e79f167849
Instruction ID: 14a9315992f898a7180a15c9da950d09625efc6c0f3580a35f2811aebaef04d9
Opcode Fuzzy Hash: 93d7e7b68847bd7301383d2ffc6dfa1298a04f93c30e47d282b582e79f167849
Instruction Fuzzy Hash: 4A114F34601114DFD704FBA6DD9AE6E7BE5AF48304F4540FFE409872A2DE68AC01CE6A

Uniqueness

Uniqueness Score: -1.00%

Function 0046B62E, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046B635
#800.MFC42U(CTitleSetupPage::~CTitleSetupPage,00000000,0000000C,00467239,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0046B695
#800.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0046B6A1
#609.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0046B6B3
#609.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0046B6BF
#616.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0046B6D1
#616.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0046B6DD
#790.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0046B6E9
#768.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0046B700

Strings

CTitleSetupPage::~CTitleSetupPage, xrefs: 0046B64B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #609#616#800$#768#790H_prolog3
String ID: CTitleSetupPage::~CTitleSetupPage
API String ID: 1806273774-2264154541
Opcode ID: 1844a3abf1083191eb817949e48c85fa23d355baffcd274ba16c358a0db4a0af
Instruction ID: b8ef8cdc8d8ba82c1944ea88b19fec4e0c8089be45df63bce1d7499a12ea3af7
Opcode Fuzzy Hash: 1844a3abf1083191eb817949e48c85fa23d355baffcd274ba16c358a0db4a0af
Instruction Fuzzy Hash: D5216030A0164AEFD708DBB4C855BECFB70BF15304F1441AE991AA72D2DB742B04CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004A847A, Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004A8484

Part of subcall function 00495315: memset.MSVCRT ref: 00495337

Part of subcall function 004954D9: __EH_prolog3_GS.LIBCMT ref: 004954E3

#1165.MFC42U(?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8520

Part of subcall function 004A79D0: __EH_prolog3.LIBCMT ref: 004A79D7

#2506.MFC42U(?,?,?,?,?,000000A2,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8613
#1165.MFC42U(?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8690
#1165.MFC42U ref: 004A8695

Strings

CNotebookApp::ResumeOpenNote, xrefs: 004A8499
,TD, xrefs: 004A84E4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3_$#2506H_prolog3memset
String ID: ,TD$CNotebookApp::ResumeOpenNote
API String ID: 3839202002-653441290
Opcode ID: 22280460d97ccd32756a2e38ad54f5b832447106bdfc9acd2938de35a3b652fb
Instruction ID: 944896f088bcdc4a5c5bc4999c7ecf0da1d0897bf2126d0c8090d61b64995792
Opcode Fuzzy Hash: 22280460d97ccd32756a2e38ad54f5b832447106bdfc9acd2938de35a3b652fb
Instruction Fuzzy Hash: 7E910370A016599FEB24DB61CC91BAA7775FF60309F1400EEE509A3291DF78AE84CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00491013, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 164stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0049101D
lstrlenW.KERNEL32(00000000), ref: 004910C7
lstrlenW.KERNEL32(00000000,00000000), ref: 004910FE
#1165.MFC42U ref: 00491108
lstrlenW.KERNEL32(00000000), ref: 00491167

Strings

CNBNotebook::UpdateMRU, xrefs: 00491036

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$#1165H_prolog3_
String ID: CNBNotebook::UpdateMRU
API String ID: 1160999210-694446622
Opcode ID: dd437026e2e6e0299a6426a7502662f6d9301cad16ef7d2b13cc6a46149f1095
Instruction ID: 3409d4863cc31d25e3017dda02332721f4b8fbe8faae8de35012bbfc88ddea50
Opcode Fuzzy Hash: dd437026e2e6e0299a6426a7502662f6d9301cad16ef7d2b13cc6a46149f1095
Instruction Fuzzy Hash: 78515F71901126ABDF20EF95D84DBAE7BB4AF08714F1040EAE805E7265DB38DE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00441828, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00441832
memset.MSVCRT ref: 00441884
PathFindFileNameW.SHLWAPI(00000000), ref: 004418CB
CopyFileW.KERNEL32(00000000), ref: 00441953
GetLastError.KERNEL32 ref: 0044195D
#1165.MFC42U(00969CB0,0000EF51,00000000), ref: 004419AE
#1165.MFC42U(?,00000001,00000000,?), ref: 004419DC
#1165.MFC42U ref: 004419E7

Strings

CNotebookApp::OpenCopyOfNote, xrefs: 0044185B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$File$CopyErrorFindH_prolog3_LastNamePathmemset
String ID: CNotebookApp::OpenCopyOfNote
API String ID: 111984474-680261764
Opcode ID: eb66fb13ce160b8888e05eb7845bf4d9f8327326ddc858e7852fd534e6a91113
Instruction ID: 9fe3b1daef1eb2ad3c58ef8f72d9524102b2b22b230be4ce39550426f5316296
Opcode Fuzzy Hash: eb66fb13ce160b8888e05eb7845bf4d9f8327326ddc858e7852fd534e6a91113
Instruction Fuzzy Hash: A2514471911125ABDB21DB94DD48F9EB7B4AF08710F1501DAE908BB261DB74DE80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00433815, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043381F
IsWindow.USER32(00000000), ref: 0043385E
GetClientRect.USER32 ref: 004338BC
FindWindowW.USER32(Tablet_Tip_Main_Window,00000000), ref: 00433987

Part of subcall function 00435457: ClientToScreen.USER32(?,?), ref: 00435467
Part of subcall function 00435457: ClientToScreen.USER32(?,?), ref: 00435474
Part of subcall function 00435457: #3133.MFC42U(?,?,00426DB3,?), ref: 0043547C

#3915.MFC42U(?,?,?,?,?), ref: 00433943

Part of subcall function 004AF88E: GetSystemMetrics.USER32 ref: 004AF8B3

Strings

,, xrefs: 00433887
CViewMgr::GetClientRect, xrefs: 0043389F
CMainFrame::GetMaxClientSize, xrefs: 00433830
Tablet_Tip_Main_Window, xrefs: 00433982

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Client$ScreenWindow$#3133#3915FindH_prolog3_MetricsRectSystem
String ID: ,$CMainFrame::GetMaxClientSize$CViewMgr::GetClientRect$Tablet_Tip_Main_Window
API String ID: 2840648106-749164000
Opcode ID: 7f97126697738a27728f7d183361ac7eac7f103a5d629a26013e72f1d9a59a08
Instruction ID: 47cc10d34d65329a3019beecd17f7230754343d3fe8aa082edd6c69d1fecf131
Opcode Fuzzy Hash: 7f97126697738a27728f7d183361ac7eac7f103a5d629a26013e72f1d9a59a08
Instruction Fuzzy Hash: 44514FB1900219DFDF14DFA9C985BADB7F4BF08704F10406AE505EB245DB78AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00478175, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111windowstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,CNBFileDialog::DoModal,00000000,00000001,00000059,?,?,?,?), ref: 00478195
memset.MSVCRT ref: 004781AC
GetFocus.USER32 ref: 004781B4
IsWindowEnabled.USER32(?), ref: 004781C7
GetLastError.KERNEL32 ref: 00478207
GetLastError.KERNEL32 ref: 00478247

Part of subcall function 004B0246: EnableWindow.USER32(?,00000001), ref: 004B026B
Part of subcall function 004B0246: GetLastError.KERNEL32 ref: 004B0273

IsWindow.USER32(00000000), ref: 00478285
SetFocus.USER32(00000000), ref: 00478290

Strings

CNBFileDialog::DoModal, xrefs: 00478185

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastWindow$Focus$EnableEnabledlstrlenmemset
String ID: CNBFileDialog::DoModal
API String ID: 4262135110-3610658814
Opcode ID: a9abb5d8c19ba8bc1c932a7217083c8e3596c4b1c66209c4360f30c400fe7e10
Instruction ID: 6a60b06914bd738b41439805012d695f0ae4991bd950a64cbf8a1f8f2486a75a
Opcode Fuzzy Hash: a9abb5d8c19ba8bc1c932a7217083c8e3596c4b1c66209c4360f30c400fe7e10
Instruction Fuzzy Hash: 8931D570641610EFD7259B66EE4CBAA77A8FB44705B1481AFF909D6262CF38DC01C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0047CBF8, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 93memoryfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0047CBFF
GetProcessHeap.KERNEL32(00000000,?,CNotebookDocPrint::~CNotebookDocPrint,00000000,0000005C,0047D6E5), ref: 0047CC2F
HeapFree.KERNEL32(00000000), ref: 0047CC36
DeleteFileW.KERNEL32(00000000), ref: 0047CCA7
CoTaskMemFree.OLE32(00000000), ref: 0047CCB0
#800.MFC42U(CNotebookDocPrint::~CNotebookDocPrint,00000000,0000005C,0047D6E5), ref: 0047CCD6
#763.MFC42U ref: 0047CCE2

Strings

CNotebookDocPrint::~CNotebookDocPrint, xrefs: 0047CC15
CPrintNotify::~CPrintNotify, xrefs: 0047CCE9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$#763#800DeleteFileH_prolog3_ProcessTask
String ID: CNotebookDocPrint::~CNotebookDocPrint$CPrintNotify::~CPrintNotify
API String ID: 2335791101-379870492
Opcode ID: 1c013aa88edc8e1f7536d49ccdd095dddeb05dfd56cac0593a35373490864951
Instruction ID: 8a7b673fcb4be34faaa8ce86ecc0633a22fca9c4f67c4d1386dcb7d524e6f0d3
Opcode Fuzzy Hash: 1c013aa88edc8e1f7536d49ccdd095dddeb05dfd56cac0593a35373490864951
Instruction Fuzzy Hash: 4D317C70900748EFDB15DFE5C888AAEBBB4FF44304F1484AEE55A9B260CB399D45CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0047C5A2, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 83comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00412460,00000000,00000017,00412470,00000000,ShowHelpTopic,00000000,0E0227DC,6DEDD6D0,00000016,00000001,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0047C5FD
#540.MFC42U ref: 0047C612
#2810.MFC42U(?,mshelp://Windows/?id=%s), ref: 0047C62E
#1594.MFC42U ref: 0047C63B
SysFreeString.OLEAUT32(00000000), ref: 0047C651
#800.MFC42U ref: 0047C669
#1165.MFC42U ref: 0047C673

Strings

ShowHelpTopic, xrefs: 0047C5D9
mshelp://Windows/?id=%s, xrefs: 0047C628

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#1594#2810#540#800CreateFreeInstanceString
String ID: ShowHelpTopic$mshelp://Windows/?id=%s
API String ID: 4250290469-1734843024
Opcode ID: 0bc7b3f451ac5accfa6af2e50c41d77618b7f81adb7dba1683b8fd12a9ea2ed2
Instruction ID: 491bf9089a7cadbcc74c06c586fea390fcaaef0aee26d8eddd6635a779ee0ab7
Opcode Fuzzy Hash: 0bc7b3f451ac5accfa6af2e50c41d77618b7f81adb7dba1683b8fd12a9ea2ed2
Instruction Fuzzy Hash: F821B471104305AFC304DF64DC89E9BBBE8FB95754F00462EF445D32A1DB749844CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0047803A, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00478041
#540.MFC42U(CNBFileDialog::~CNBFileDialog,00000000,00000014,00442359,00000000,00000059,?,?,.jnt,?,00000001,?,?,?), ref: 00478079
#5597.MFC42U(00000000), ref: 00478096
#800.MFC42U(00000000), ref: 004780AD
#800.MFC42U(00000000,?,CNBFileDialog::~CNBFileDialog,00000000,00000014,00442359,00000000,00000059,?,?,.jnt,?,00000001,?,?,?), ref: 004780EE
#800.MFC42U(?,CNBFileDialog::~CNBFileDialog,00000000,00000014,00442359,00000000,00000059,?,?,.jnt,?,00000001,?,?,?), ref: 004780FA
#616.MFC42U(?,CNBFileDialog::~CNBFileDialog,00000000,00000014,00442359,00000000,00000059,?,?,.jnt,?,00000001,?,?,?), ref: 0047810C
#616.MFC42U(?,CNBFileDialog::~CNBFileDialog,00000000,00000014,00442359,00000000,00000059,?,?,.jnt,?,00000001,?,?,?), ref: 00478118

Strings

CNBFileDialog::~CNBFileDialog, xrefs: 00478051

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #800$#616$#540#5597H_prolog3
String ID: CNBFileDialog::~CNBFileDialog
API String ID: 2307040386-2664462953
Opcode ID: dfa3d6336d9eebf60e58110406ba86e4dcc5d2b914f1040654956badfd1e455b
Instruction ID: b4a94cdb9017059e5d7d1d224152cca8837fd4ed6a68ea3d43f7b3c3c1e50993
Opcode Fuzzy Hash: dfa3d6336d9eebf60e58110406ba86e4dcc5d2b914f1040654956badfd1e455b
Instruction Fuzzy Hash: B621D030601545ABCB04EBA4CC49BEDBBB0AF14304F14415ED119A72D1DF786A08CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042C541, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0042C54B
#540.MFC42U(CMainFrame::OnDocTitleChange,00000000,000002CC,00444F91,?,00000104,?,?,?,?,?,?), ref: 0042C56E
#1165.MFC42U(?,?,?,?,?,?), ref: 0042C57A
#4155.MFC42U(0000EF20,?,?,?,?,?,?), ref: 0042C5BA
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 0042C5DF
#6868.MFC42U(004048FC,?,?,?,?,?,?,?), ref: 0042C5FE
#6195.MFC42U(?,?,?,?,?,?,?), ref: 0042C60C
#800.MFC42U(?,?,?,?,?,?), ref: 0042C61C

Strings

CMainFrame::OnDocTitleChange, xrefs: 0042C554

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#4155#540#6195#6868#800FileH_prolog3_Info
String ID: CMainFrame::OnDocTitleChange
API String ID: 1051503387-2723441459
Opcode ID: 929614fe1b754fd48aca692fca0c620ae05247f172e4cde5004c55c29414534b
Instruction ID: abc36fcb27e2219de25805e9f84905c53c15a57ba71afbbeba9b304d200f05bb
Opcode Fuzzy Hash: 929614fe1b754fd48aca692fca0c620ae05247f172e4cde5004c55c29414534b
Instruction Fuzzy Hash: 9821C231702225ABDB209B61DCCCBBE7364AF10304F4400BBE50AB3290DF78AE498A58

Uniqueness

Uniqueness Score: -1.00%

Function 00472511, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 62registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00472518
#1165.MFC42U(CSrchView::_GetViewRegistryKey,00000000,0000002C,0047277C,CSrchView::_SaveColumns,00000000,00000014,00485109,00000001,00000002,CViewMgr::SaveChildrenViewSettings,00000000,0000000C,00433B6F,CMainFrame::OnDisplayChange,00000000), ref: 00472568
RegCloseKey.ADVAPI32(00000000,00000000,Views), ref: 004725B2
RegCloseKey.ADVAPI32(00000000,Portrait), ref: 004725BD

Strings

CSrchView::_GetViewRegistryKey, xrefs: 00472525
Views, xrefs: 00472583
Find, xrefs: 0047259B
Portrait, xrefs: 00472556
Landscape, xrefs: 00472563, 0047256E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$#1165H_prolog3
String ID: CSrchView::_GetViewRegistryKey$Find$Landscape$Portrait$Views
API String ID: 740446608-3250954646
Opcode ID: e5050300fe70151f7c6facc3756d337030aaa8c9c50815e292b12726738f5af2
Instruction ID: ce79308a4d27993f6bd8034543a90ccabe470eae92090e4d5d2e2024fa1c2393
Opcode Fuzzy Hash: e5050300fe70151f7c6facc3756d337030aaa8c9c50815e292b12726738f5af2
Instruction Fuzzy Hash: FA218471E01214ABCB11EFAAC9D5AEEFB74BF48704F95407FE50973241DB789A048B68

Uniqueness

Uniqueness Score: -1.00%

Function 0047E152, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047E159
#324.MFC42U(0000009A,00000000,00000010,0047D06D,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324), ref: 0047E16A
#540.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E183
#540.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E18C
#540.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E195
#861.MFC42U(004048E0,CPrintingNoteDlg::CPrintingNoteDlg,00000000,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000), ref: 0047E1BA
#861.MFC42U(004048E0,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E1C4
#861.MFC42U(004048E0,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047E1CE

Strings

CPrintingNoteDlg::CPrintingNoteDlg, xrefs: 0047E199

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #540#861$#324H_prolog3
String ID: CPrintingNoteDlg::CPrintingNoteDlg
API String ID: 558486565-3396456456
Opcode ID: c8d57a21e8bf5750362ac5ac50dd19a1b7fba68cab84e350840a33b9907cb1aa
Instruction ID: 8eb6931bf13051773cb6712c3bedd4ce0337261b6d68bacd9be348e321d10bac
Opcode Fuzzy Hash: c8d57a21e8bf5750362ac5ac50dd19a1b7fba68cab84e350840a33b9907cb1aa
Instruction Fuzzy Hash: 3601B175A00369ABD704EB62DC16BECBF24AF61304F20406FD102672C1DFB86B04CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00434658, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 168windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00434662
memset.MSVCRT ref: 004346DA
memset.MSVCRT ref: 004346F4
GetMenuItemRect.USER32(00000000,?,?,?,?,00000000,00000206,00000000,0E0227DC), ref: 00434743
GetLastError.KERNEL32(?,?,?,?,?,004BFB86,000000FF), ref: 0043475F
PathRemoveExtensionW.SHLWAPI(?,00000104), ref: 00434813
PathCompactPathExW.SHLWAPI(?,?,00000096,00000000), ref: 0043482E

Strings

CMainFrame::ProcessMRUMenuToolTip, xrefs: 0043467B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$memset$CompactErrorExtensionH_prolog3_ItemLastMenuRectRemove
String ID: CMainFrame::ProcessMRUMenuToolTip
API String ID: 3528183336-2580506988
Opcode ID: e5cff6733e1fd6d6aff1a2386036a29cd704c19206e30aaa93069f1e3870694d
Instruction ID: 854bae50157c94ae8f23db48d7b23feb732c679bb3f6b257da532ebf772c3925
Opcode Fuzzy Hash: e5cff6733e1fd6d6aff1a2386036a29cd704c19206e30aaa93069f1e3870694d
Instruction Fuzzy Hash: 546190B56002089FDB28DF65CC84FDA77B8AF88304F4044AEE609D7291D774EA84CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004938C7, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004938D1

Strings

%d=, xrefs: 00493A51
CNBMRUList::Save, xrefs: 004938E6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_
String ID: %d=$CNBMRUList::Save
API String ID: 2427045233-379426887
Opcode ID: 4f6ef70e0265c032b5d88868a3c9da702ef8abac250a6ac339682a6a539c38bd
Instruction ID: 32c6f45c7c3c3a75edf27620ba19ccec2bf39824e4624da9d19d7944f6d5d376
Opcode Fuzzy Hash: 4f6ef70e0265c032b5d88868a3c9da702ef8abac250a6ac339682a6a539c38bd
Instruction Fuzzy Hash: 4F51A471D002249BDF25AF64C849B9EBB74BF05315F0042AFE509A72A1CB799E85CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0046D25C, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

#1165.MFC42U(CPageSetupCommon::GetAutoPageSize,0E0227DC,0E0227DC,?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0046D2B5

Part of subcall function 00433815: __EH_prolog3_GS.LIBCMT ref: 0043381F
Part of subcall function 00433815: IsWindow.USER32(00000000), ref: 0043385E
Part of subcall function 00433815: GetClientRect.USER32 ref: 004338BC
Part of subcall function 00433815: FindWindowW.USER32(Tablet_Tip_Main_Window,00000000), ref: 00433987

#1165.MFC42U(?,?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0046D2D5
GetDC.USER32(?), ref: 0046D2E9
#1165.MFC42U(?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0046D307

Part of subcall function 0042AEE6: __EH_prolog3.LIBCMT ref: 0042AEED
Part of subcall function 0042AEE6: #1165.MFC42U(CMainFrame::GetNotebookDPI,00000000,0000000C,0046D314,?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0042AF0A
Part of subcall function 0042AEE6: GetDC.USER32(?), ref: 0042AF32
Part of subcall function 0042AEE6: #2854.MFC42U(00000000,?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0042AF39
Part of subcall function 0042AEE6: GetDeviceCaps.GDI32(?,00000058), ref: 0042AF46
Part of subcall function 0042AEE6: ReleaseDC.USER32 ref: 0042AF54

GetDeviceCaps.GDI32(00000000,00000058), ref: 0046D36F
GetDeviceCaps.GDI32(?,0000005A), ref: 0046D3A1
#1165.MFC42U(?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0046D3C1

Strings

CPageSetupCommon::GetAutoPageSize, xrefs: 0046D299

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$CapsDevice$Window$#2854ClientFindH_prolog3H_prolog3_RectRelease
String ID: CPageSetupCommon::GetAutoPageSize
API String ID: 3742736859-337868212
Opcode ID: b9240b09bdcc19abc7e2548cd0a0aff83649c8a8c53c13a225dc9bb4595ad8b9
Instruction ID: 86f29f8afa00e0ed5d9a542af7fa7dc3a0395ef1b9a8253af68d26b3fd4c6383
Opcode Fuzzy Hash: b9240b09bdcc19abc7e2548cd0a0aff83649c8a8c53c13a225dc9bb4595ad8b9
Instruction Fuzzy Hash: 00510271A09251DFC300DF16D98491ABBE4FF88754F454A9EF8C8A72A5DB34D920CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 00443BB9, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00443BC0
lstrlenW.KERNEL32(?,CNotebookApp::GetPathForNextOpenSave,00000001,00000010,0044253B,00000000,00000059,?,00000001), ref: 00443BFA
SHPathPrepareForWriteW.SHELL32(00000000,00000000,00000001,00000000,CNotebookApp::GetPathForNextOpenSave,00000001,00000010,0044253B,00000000,00000059,?,00000001), ref: 00443C73
SHPathPrepareForWriteW.SHELL32(00000000,00000000,00000001,00000000,00000000,CNotebookApp::GetPathForNextOpenSave,00000001,00000010,0044253B,00000000,00000059,?,00000001), ref: 00443C98
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,00000001,00000000,CNotebookApp::GetPathForNextOpenSave,00000001,00000010,0044253B,00000000,00000059,?,00000001), ref: 00443CAB
SHPathPrepareForWriteW.SHELL32(00000000,00000000,00000001,00000000), ref: 00443CBC
SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000001), ref: 00443CCE

Strings

CNotebookApp::GetPathForNextOpenSave, xrefs: 00443BCE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$PrepareWrite$Folder$H_prolog3lstrlen
String ID: CNotebookApp::GetPathForNextOpenSave
API String ID: 4025021876-2160329405
Opcode ID: e726ef037fdeb5bf58823305468e42782dbfb6517b924612b7b1b705362f3432
Instruction ID: 6ad3f03d3fe4becb9c6735fa9986156f0ff9a33948702f97e38f1b7b4e5ef0f8
Opcode Fuzzy Hash: e726ef037fdeb5bf58823305468e42782dbfb6517b924612b7b1b705362f3432
Instruction Fuzzy Hash: 7531D672A02636A7DB219F668C84AEF7E68EF05B51F00051BF805B7300D7789A01C7E9

Uniqueness

Uniqueness Score: -1.00%

Function 00444E1E, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 105stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00444E28
#1165.MFC42U(CNotebookDoc::SetName,00000000,00000230,00445BFC,?,?), ref: 00444E4E
memset.MSVCRT ref: 00444E70
PropVariantClear.OLE32(?), ref: 00444EE4
lstrlenW.KERNEL32(?,?,?,?,?,?,?), ref: 00444EF7
#1165.MFC42U(?,?,?,?,?,?), ref: 00444F01
#1165.MFC42U(?,?,00000104,00000000,?,?,?,?,?,?), ref: 00444F39

Strings

CNotebookDoc::SetName, xrefs: 00444E41

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$ClearH_prolog3_PropVariantlstrlenmemset
String ID: CNotebookDoc::SetName
API String ID: 3099917296-3905885309
Opcode ID: 15d309ab22ffc681ae2eee9e324a2db552b24463ce975d9f6337327421720d3a
Instruction ID: 8b9094558bec6edc747824322bfd85bedf3971a60b8fd91c958017e5d3c0b884
Opcode Fuzzy Hash: 15d309ab22ffc681ae2eee9e324a2db552b24463ce975d9f6337327421720d3a
Instruction Fuzzy Hash: 4441BA71641219ABEB10EB75CC88FDAB3B9EF98304F0044AEB509E7151DB789A4ACF14

Uniqueness

Uniqueness Score: -1.00%

Function 00459C54, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00459C5E
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 00459CA9
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00459CD2
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00459D08
memset.MSVCRT ref: 00459D35
#6195.MFC42U(?,?,?,?,?,?,00000000,0E0227DC), ref: 00459D64

Strings

CNBToolbar::SetReplacementCtrlValue, xrefs: 00459C6E
%d%s, xrefs: 00459D4B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$#6195H_prolog3_memset
String ID: %d%s$CNBToolbar::SetReplacementCtrlValue
API String ID: 2190035453-957445610
Opcode ID: 0159cba7c0cb5ffed81cfa570e6d9ed0db2c15f358fa913d96a0f443bd9fff62
Instruction ID: 21214c4171d0ddbb1e75fb20880b74d1e8d841c7db69653171c4e47dc1a3f653
Opcode Fuzzy Hash: 0159cba7c0cb5ffed81cfa570e6d9ed0db2c15f358fa913d96a0f443bd9fff62
Instruction Fuzzy Hash: EF318671A01214EBEB349B35CC81BAA77B5FB05705F0000AFF94DE7292DA789D48CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004315B6, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004315BD

Part of subcall function 00431425: __EH_prolog3.LIBCMT ref: 0043142C
Part of subcall function 00431425: #1165.MFC42U(CMainFrame::GetHighlightPen,?,0000000C,0042B2F9,?,00000000,?,00000000,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005), ref: 00431455

#1165.MFC42U(?,?,CMainFrame::SetCurrentHighlightPen,?,00000034,00430CD4,00000000,00000001), ref: 00431608

Part of subcall function 0044EBB0: __EH_prolog3.LIBCMT ref: 0044EBB7
Part of subcall function 0044EBB0: #1165.MFC42U(?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044ECB9

#1165.MFC42U(000000FF), ref: 00431623
#1165.MFC42U ref: 00431637

Part of subcall function 0044E0AC: __EH_prolog3.LIBCMT ref: 0044E0B3
Part of subcall function 0044E0AC: #1165.MFC42U(CNBDocViewCtrl::SetActionState,?,CNotebookView::SetActionState,00000000,00000018,0044D595,00000000,?,00000000), ref: 0044E131

#1165.MFC42U(00000005), ref: 00431649
_ftol2_sse.MSVCRT ref: 00431681
#1165.MFC42U(00008011,?,?,00008011,?,?,CMainFrame::SetCurrentHighlightPen,?,00000034,00430CD4,00000000,00000001), ref: 004316A6

Strings

CMainFrame::SetCurrentHighlightPen, xrefs: 004315CA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$H_prolog3__ftol2_sse
String ID: CMainFrame::SetCurrentHighlightPen
API String ID: 1979401406-3741394974
Opcode ID: 7cbf2e40caab5be3963a1efa0c69000eb69bf2f4e4dda773b2ac05b5978709b4
Instruction ID: 6f3c2f74f3726e47a41a44642cd86e2d9c0012404dc7c714f63baf607dac92a7
Opcode Fuzzy Hash: 7cbf2e40caab5be3963a1efa0c69000eb69bf2f4e4dda773b2ac05b5978709b4
Instruction Fuzzy Hash: C5316071A01618AFDB04EFA5CD92FDD7BA5AF08304F05506EF9059B292DF78A904CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0043149D, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004314A4

Part of subcall function 004313B7: __EH_prolog3.LIBCMT ref: 004313BE
Part of subcall function 004313B7: #1165.MFC42U(CMainFrame::GetWritingPen,?,0000000C,0042B2EA,?,00000000,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0), ref: 004313E7

#1165.MFC42U(?,?,CMainFrame::SetCurrentWritingPen,?,00000034,00445849,00000000,?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920), ref: 004314EA

Part of subcall function 0044EBB0: __EH_prolog3.LIBCMT ref: 0044EBB7
Part of subcall function 0044EBB0: #1165.MFC42U(?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044ECB9

#1165.MFC42U(000000FF,?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00431505
#1165.MFC42U(?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00431519

Part of subcall function 0044E0AC: __EH_prolog3.LIBCMT ref: 0044E0B3
Part of subcall function 0044E0AC: #1165.MFC42U(CNBDocViewCtrl::SetActionState,?,CNotebookView::SetActionState,00000000,00000018,0044D595,00000000,?,00000000), ref: 0044E131

#1165.MFC42U(?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0043152B
_ftol2_sse.MSVCRT ref: 00431562
#1165.MFC42U(00008010,?,?,00008010,000000FF,?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000), ref: 00431585

Strings

CMainFrame::SetCurrentWritingPen, xrefs: 004314B1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$H_prolog3__ftol2_sse
String ID: CMainFrame::SetCurrentWritingPen
API String ID: 1979401406-3727185573
Opcode ID: bcacc2fdd7db21bc9140fb807e238136db2abc35a10c48c02727ccdd857b62f9
Instruction ID: 89095cb578fe79bffddd21415781e05f6922a7cb94dc0db65ac424600abf99f0
Opcode Fuzzy Hash: bcacc2fdd7db21bc9140fb807e238136db2abc35a10c48c02727ccdd857b62f9
Instruction Fuzzy Hash: DB317071A01618AFDB04EBA5CD81F9D7BA5EF48304F05406FF906AB292DE38AD04CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004650C0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85registrystringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004650C7
lstrlenW.KERNEL32(?,CNBSettingsMgr::GetSettingKey,0E0227DC,00000010,00465274,00000000,00000000,?,00000000), ref: 00465102
#1165.MFC42U(00000061), ref: 0046511E
#2885.MFC42U ref: 00465127
RegOpenKeyExW.ADVAPI32(00000000,?,00000000,000F003F,00000000), ref: 0046517E
RegCloseKey.ADVAPI32(80070057), ref: 00465195

Part of subcall function 00464F8C: __EH_prolog3.LIBCMT ref: 00464F93
Part of subcall function 00464F8C: #1165.MFC42U(CNBSettingsMgr::OpenAppRegKey,80070057,00000010,00465BB7,00000000), ref: 00464FE2
Part of subcall function 00464F8C: #2885.MFC42U ref: 00464FEB
Part of subcall function 00464F8C: SHDeleteKeyW.SHLWAPI(00000000,?,00000000,-0040CB30), ref: 0046501C
Part of subcall function 00464F8C: #1165.MFC42U ref: 00465030
Part of subcall function 00464F8C: #2885.MFC42U ref: 00465039

Strings

CNBSettingsMgr::GetSettingKey, xrefs: 004650D9
W, xrefs: 004650D1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#2885$H_prolog3$CloseDeleteOpenlstrlen
String ID: CNBSettingsMgr::GetSettingKey$W
API String ID: 1351654533-2040454585
Opcode ID: a6fb6a5499e89bf7a0ebfa14392b48e6c5a704955ab384a419622a2b0be9f618
Instruction ID: 3848082f1ccb543ee5b15e7681bf92db00356753a18c00b5bf2459c2f4b7269f
Opcode Fuzzy Hash: a6fb6a5499e89bf7a0ebfa14392b48e6c5a704955ab384a419622a2b0be9f618
Instruction Fuzzy Hash: 7A318B71A01606EFCF15DF61C854BBE77B0AF15314F10443EE856AB250EB389E44CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004615CD, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004615D4
#324.MFC42U(00005E28,?,00000008,0042CE5C,?), ref: 004615E6
#567.MFC42U ref: 004615FF
#567.MFC42U ref: 00461614
#567.MFC42U ref: 00461628
#567.MFC42U ref: 0046163C
#567.MFC42U ref: 00461650

Strings

CInkFormatDlg::CInkFormatDlg, xrefs: 0046165E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$#324H_prolog3
String ID: CInkFormatDlg::CInkFormatDlg
API String ID: 3217428371-1631143683
Opcode ID: 11ce86205fa66bb8979dd6c12f64b314f0d34f884e513b882d3d6adaf8279fe6
Instruction ID: e7cdbac0efbc7d4dc6d5829040e096d30532a1182f152912a22da6af2894cf02
Opcode Fuzzy Hash: 11ce86205fa66bb8979dd6c12f64b314f0d34f884e513b882d3d6adaf8279fe6
Instruction Fuzzy Hash: D03127719113188FDF01DF14C8847D9BBA4BF19700F5944BBEC49AF286CBB91A05CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043361A, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00433621
memset.MSVCRT ref: 00433645
GetDC.USER32(?), ref: 00433650
#2854.MFC42U(00000000), ref: 00433657
GetDeviceCaps.GDI32(?,0000005A), ref: 004336A3
MulDiv.KERNEL32(?,00000000), ref: 004336B4
ReleaseDC.USER32 ref: 004336D6

Strings

CMainFrame::CHARFORMAT2_to_LOGFONT, xrefs: 00433631

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2854CapsDeviceH_prolog3Releasememset
String ID: CMainFrame::CHARFORMAT2_to_LOGFONT
API String ID: 2906658938-4093269160
Opcode ID: 9437a95dcba0d525c9bfa856add6e9c0f10139d97bc99d13ea60d338db6909d4
Instruction ID: de476c2537dab8349c498ab1a65baa362d9d9790d38d414bca146843a8e58ae2
Opcode Fuzzy Hash: 9437a95dcba0d525c9bfa856add6e9c0f10139d97bc99d13ea60d338db6909d4
Instruction Fuzzy Hash: 9421F272500740AFDB159FA1DC56AEB7FB0EF19300F0045AEFA9A8B292CA34E515CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0046E3BF, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046E3C6
#2634.MFC42U(00000001,CSimpleFindDialog::UpdateControls,00000000,00000014,00473DF0,CSrchView::UpdateControls,00000000,0000000C,0047443E,?,00000000,00000000,0E0227DC), ref: 0046E3F9
SendMessageW.USER32(?,00000142,00000000,FFFF0000), ref: 0046E423
SendMessageW.USER32(?,00000303,00000000,00000000), ref: 0046E438
#2634.MFC42U(00000000,?,00000000,00000000,0E0227DC), ref: 0046E458

Strings

CSimpleFindDialog::_UpdateAction1Button, xrefs: 0046E467
CSimpleFindDialog::UpdateControls, xrefs: 0046E3CF
>DG, xrefs: 0046E3D4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2634MessageSend$H_prolog3
String ID: >DG$CSimpleFindDialog::UpdateControls$CSimpleFindDialog::_UpdateAction1Button
API String ID: 2723537663-91376666
Opcode ID: d4c882ab06c2fa8db4a155f10fab41554dfb24794ba611cd15a6d9edcfce5cec
Instruction ID: 1f5292d01f9ee166e55f9f2b9ba811dc52c4d7c8971a0d3f14be02efd4796f73
Opcode Fuzzy Hash: d4c882ab06c2fa8db4a155f10fab41554dfb24794ba611cd15a6d9edcfce5cec
Instruction Fuzzy Hash: 5C21DE31351505ABEB08E772CC5ABFCB361AF15305F40012EF152A72E1DFAC6948C72A

Uniqueness

Uniqueness Score: -1.00%

Function 004270F3, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004270FA
GetClientRect.USER32 ref: 00427125
#3792.MFC42U ref: 0042712F
GetParent.USER32(?), ref: 0042713F
#2859.MFC42U(00000000), ref: 00427146
#3792.MFC42U ref: 00427150
GetClientRect.USER32 ref: 00427169

Strings

CSplitWnd::GetSizingParent, xrefs: 00427107

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #3792ClientRect$#2859H_prolog3_Parent
String ID: CSplitWnd::GetSizingParent
API String ID: 3596270620-1115688915
Opcode ID: 9d09e8b4345ea6604d95db6a870d3ffafb5c34576d995f263421a8912b435f70
Instruction ID: bfa9c3c7de52ab9fe1b6f7d298e89178aee581256d2b7d76ad78a1ddac432a90
Opcode Fuzzy Hash: 9d09e8b4345ea6604d95db6a870d3ffafb5c34576d995f263421a8912b435f70
Instruction Fuzzy Hash: 0A114971A01219AFCF00EBA1EC849FE7B79BF48314F50042AF505E7211CB389D448B2C

Uniqueness

Uniqueness Score: -1.00%

Function 0045F1BD, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045F1C4
#489.MFC42U(0000008C,00000000,0000000C,0046148D,0000EFE1,?,?,00000008,00430F6F,?,?,00000001,CMainFrame::OnToolbarPickerItemCmd,00000000,0E0227DC), ref: 0045F1D5
#567.MFC42U(?,?,00000001,CMainFrame::OnToolbarPickerItemCmd,00000000,0E0227DC), ref: 0045F1F3
#567.MFC42U(?,?,00000001,CMainFrame::OnToolbarPickerItemCmd,00000000,0E0227DC), ref: 0045F207
#567.MFC42U(?,?,00000001,CMainFrame::OnToolbarPickerItemCmd,00000000,0E0227DC), ref: 0045F21B

Strings

CPenSettingsPage::CPenSettingsPage, xrefs: 0045F229
$K, xrefs: 0045F21D
K, xrefs: 0045F1F5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$#489H_prolog3
String ID: $K$CPenSettingsPage::CPenSettingsPage$K
API String ID: 3691984168-3221478305
Opcode ID: a583453d9818ad2d6779a40c9f9b95b55b0d8bdd10b4270bc5ae904ccbccc2c1
Instruction ID: b60232ff5fc40b2d5beebcc32f4b8b14fb8c452f20310b1f4e47d135666b4625
Opcode Fuzzy Hash: a583453d9818ad2d6779a40c9f9b95b55b0d8bdd10b4270bc5ae904ccbccc2c1
Instruction Fuzzy Hash: C32149B09112168FDB00DF558889B98BBA4BF08704F4580BFE944AF292CBB85945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0046038E, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00460395
#489.MFC42U(00000606,00000000,0000000C,0046149C,0000EFE1,?,?,00000008,00430F6F,?,?,00000001,CMainFrame::OnToolbarPickerItemCmd,00000000,0E0227DC), ref: 004603A6
#567.MFC42U(?,?,00000001,CMainFrame::OnToolbarPickerItemCmd,00000000,0E0227DC), ref: 004603C4
#567.MFC42U(?,?,00000001,CMainFrame::OnToolbarPickerItemCmd,00000000,0E0227DC), ref: 004603D8
#567.MFC42U(?,?,00000001,CMainFrame::OnToolbarPickerItemCmd,00000000,0E0227DC), ref: 004603EC

Strings

$K, xrefs: 004603EE
CHighlightSettingsPage::CHighlightSettingsPage, xrefs: 004603FA
K, xrefs: 004603C6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$#489H_prolog3
String ID: $K$CHighlightSettingsPage::CHighlightSettingsPage$K
API String ID: 3691984168-2992847178
Opcode ID: 38e30941570f2a1d1992998da17e1191cc5dfef4a95918278555598d17229088
Instruction ID: 88b4a3214ee38d899c81cb378ce0dcd29e46330e00abedc939c88b33db944757
Opcode Fuzzy Hash: 38e30941570f2a1d1992998da17e1191cc5dfef4a95918278555598d17229088
Instruction Fuzzy Hash: 51215BB09012168FDB14DF55C889BE9BBA4BF08704F5540BFE944AF292CBB85944CFE9

Uniqueness

Uniqueness Score: -1.00%

Function 0042EBA8, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042EBAF
#1165.MFC42U(CMainFrame::OnSuspend,00000000,00000014,0042EB11,CMainFrame::OnPowerBroadCast,00000000), ref: 0042EBCD

Part of subcall function 00449931: __EH_prolog3_GS.LIBCMT ref: 0044993B

#1165.MFC42U ref: 0042EBDD
#1165.MFC42U ref: 0042EBF0

Part of subcall function 00444C7F: __EH_prolog3.LIBCMT ref: 00444C86

#1165.MFC42U ref: 0042EC00
#1165.MFC42U(00000001), ref: 0042EC43

Strings

CSrchView::AbortSearch, xrefs: 0042EC1F
CMainFrame::OnSuspend, xrefs: 0042EBBA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$H_prolog3_
String ID: CMainFrame::OnSuspend$CSrchView::AbortSearch
API String ID: 1839702361-3579267090
Opcode ID: 3f3b7d1111f7757822fa9e0c13eda8966f692e1cfc0485bdeac900b0d37f6bfb
Instruction ID: faaa98d025ade8be8777aa032aaa0dd6788800dcc60d062ea2e511455bf45061
Opcode Fuzzy Hash: 3f3b7d1111f7757822fa9e0c13eda8966f692e1cfc0485bdeac900b0d37f6bfb
Instruction Fuzzy Hash: 0A1182306001149FDB14FBA6DD99EAE7BA1AF44304F45407FA5095B2E2DF79AC01CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00430B5B, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00430B62
#540.MFC42U(CMainFrame::GetColorString,00000000,0000001C,00430AA5,?,?,?,?,00000104,?,?), ref: 00430B8C
#2606.MFC42U ref: 00430B9E
#4155.MFC42U(00009CEC,00009CEC), ref: 00430BCC
#4155.MFC42U(00008030,00009CEC), ref: 00430BE8
#535.MFC42U(?,00009CEC), ref: 00430BF2
#800.MFC42U ref: 00430C06

Strings

CMainFrame::GetColorString, xrefs: 00430B72

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #4155$#2606#535#540#800H_prolog3
String ID: CMainFrame::GetColorString
API String ID: 3867748627-89632719
Opcode ID: 56a1274489c57988c40705a336cd7baa72ebba309fdac4da05170c9b6579b39a
Instruction ID: dc599586ea33d95dce9703f1d6f8d490715f0ad7af378d504a863a2c04452cd7
Opcode Fuzzy Hash: 56a1274489c57988c40705a336cd7baa72ebba309fdac4da05170c9b6579b39a
Instruction Fuzzy Hash: 2C114D3090124ADBDF00DFA1D959BEEBBB4AB14318F00416EE415A72C1DFB85A05CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004A8D5C, Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A8D63
#324.MFC42U(000000B4,00000000,00000008,004A81BD,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8D74
#567.MFC42U(?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8D87
#567.MFC42U(?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8DA0
#542.MFC42U(0000000A,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8DB8

Strings

\K, xrefs: 004A8DA6
K, xrefs: 004A8D8D
CRecoverPreviewDlg::CRecoverPreviewDlg, xrefs: 004A8DC0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$#324#542H_prolog3
String ID: CRecoverPreviewDlg::CRecoverPreviewDlg$\K$K
API String ID: 3846978054-1491846410
Opcode ID: 1fa888253b773d95dcb086cd9e013039232afbe4c31e2b53cc74d0b7f2f2da6e
Instruction ID: e0e64bb33ba10b40da30ac14902204f73b32e0387580bdcde823258185a54426
Opcode Fuzzy Hash: 1fa888253b773d95dcb086cd9e013039232afbe4c31e2b53cc74d0b7f2f2da6e
Instruction Fuzzy Hash: E7011D346413059BDB04EF50DD8A7AC7B60AB15705F5040BFED456A2C2DFB81A08CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0044BBCD, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 271COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044BBD7

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

#30.ATL(00000000,00000000), ref: 0044BC8A
#2506.MFC42U ref: 0044BCB0
#30.ATL(00000000,00000000), ref: 0044BDA6
#30.ATL(00000000,00000000), ref: 0044BE51

Strings

CNotebookDoc::_PreSaveAsTemplate, xrefs: 0044BBE6
![D, xrefs: 0044BC6E, 0044BC73

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#2506H_prolog3_
String ID: ![D$CNotebookDoc::_PreSaveAsTemplate
API String ID: 3205958951-141091447
Opcode ID: 79e033ac08cedca59e1dcece81a8677cdbd1b3bc95162dd91eddbd56fa6e176c
Instruction ID: 4f178406c641c4ec2f560b64c1f90c68b3da781f217a43fd06a103483eb5621d
Opcode Fuzzy Hash: 79e033ac08cedca59e1dcece81a8677cdbd1b3bc95162dd91eddbd56fa6e176c
Instruction Fuzzy Hash: 8CB1D970A01209DFEB05DFA5C994BEEBBB9EF88304F2440A9E505EB251DB35DD05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00426926, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 0042697E
InflateRect.USER32(?,?,?), ref: 00426995
PtInRect.USER32(?,?,?), ref: 004269F1
PtInRect.USER32(?,?,?), ref: 00426A3E
PtInRect.USER32(?,?,?), ref: 00426AA2
PtInRect.USER32(?,?,?), ref: 00426B2C

Strings

CSplitWnd::HitTest, xrefs: 00426968

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$ClientInflate
String ID: CSplitWnd::HitTest
API String ID: 256450704-2666364612
Opcode ID: bcfdf6eca2b3bc0a7e2f191035df8dbf38ea8b86d8e8312b4524b49fa8549eb8
Instruction ID: 310aed96e6425d41fbcafe0e748f4e7bbc990ce1524ff640500ca9502780863f
Opcode Fuzzy Hash: bcfdf6eca2b3bc0a7e2f191035df8dbf38ea8b86d8e8312b4524b49fa8549eb8
Instruction Fuzzy Hash: BC8132726083619FCB04CF28D880A6ABBE5FF88750F05892EF995CB311D775E845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0047B8DC, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047B8E6
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,004D7968,_GetMyDocsPathName,00000000,00000124,0047BB75,G_ReplaceMyDocsPath,00000000,00000008,00481CB6,00000105), ref: 0047B911
SHGetMalloc.SHELL32(00000000), ref: 0047B96E
SHGetDesktopFolder.SHELL32(00000000), ref: 0047B9A6

Part of subcall function 0042A2C9: TraceMessage.ADVAPI32(00000000,0000EF51,0000002B,0041E910,00000064,00969CB0,00000004,00000000,?,004B04F0,00969CB0,0000EF51,00000000,?,?), ref: 0042A2E0

Strings

_GetMyDocsPathName, xrefs: 0047B8F1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Folder$DesktopH_prolog3MallocMessagePathTrace
String ID: _GetMyDocsPathName
API String ID: 119957045-3782223744
Opcode ID: 322a934a5fa19053a10bb53c72299f98f0a6e1625d680996cc507d3e81855fd9
Instruction ID: 1fa25753a38c0e306b031430f3781b4c57354385b130d927ef2b923039cc8d2f
Opcode Fuzzy Hash: 322a934a5fa19053a10bb53c72299f98f0a6e1625d680996cc507d3e81855fd9
Instruction Fuzzy Hash: 7871DE71200215ABCB16DF61DE48FAB3BB5EF44304F25805FEA089B3A0D779D941CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004A7A4F, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004A7A59

Part of subcall function 004A79D0: __EH_prolog3.LIBCMT ref: 004A79D7

#540.MFC42U(?,00000000,?,?,?,?,CNotebookApp::_RecoverFileWithPrompting,?,00000110,004A7F6A,?), ref: 004A7AAD
#4155.MFC42U(0000DBA4,?,?,?,?,CNotebookApp::_RecoverFileWithPrompting,?,00000110,004A7F6A,?), ref: 004A7AC6
#800.MFC42U(0000EFEA,00000034,?,?,?,?,?,CNotebookApp::_RecoverFileWithPrompting,?,00000110,004A7F6A,?), ref: 004A7B66

Part of subcall function 004A87F1: __EH_prolog3.LIBCMT ref: 004A87F8
Part of subcall function 004A87F1: #324.MFC42U(?,00000000,0000000C,004A85E5,000000A2,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8807
Part of subcall function 004A87F1: #567.MFC42U(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A881A
Part of subcall function 004A87F1: #540.MFC42U(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8837
Part of subcall function 004A87F1: #540.MFC42U(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8845
Part of subcall function 004A87F1: #540.MFC42U(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8851
Part of subcall function 004A87F1: #861.MFC42U(004048E0,CRecoverDlg::CRecoverDlg,00000000,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8880
Part of subcall function 004A87F1: #861.MFC42U(004048E0,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8889
Part of subcall function 004A87F1: #861.MFC42U(004048E0,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8896

Part of subcall function 004A8919: __EH_prolog3_catch_GS.LIBCMT ref: 004A8920
Part of subcall function 004A8919: #861.MFC42U(?,CRecoverDlg::Init,?,00000030,004A860D,?,?,?,?,?,000000A2,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8957
Part of subcall function 004A8919: FileTimeToSystemTime.KERNEL32(?,00000714,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8967
Part of subcall function 004A8919: #861.MFC42U(?,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8988
Part of subcall function 004A8919: SysFreeString.OLEAUT32(?), ref: 004A898D
Part of subcall function 004A8919: FileTimeToSystemTime.KERNEL32(?,00000714,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A89B2
Part of subcall function 004A8919: #861.MFC42U(?,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A89D5
Part of subcall function 004A8919: SysFreeString.OLEAUT32(?), ref: 004A89DA

#2506.MFC42U(?,?,?,?,?,000000A1,?,?,?,?,CNotebookApp::_RecoverFileWithPrompting,?,00000110,004A7F6A,?), ref: 004A7BC8
#2506.MFC42U(?,?,?,?,?,000000A0,?,?,?,?,CNotebookApp::_RecoverFileWithPrompting,?,00000110,004A7F6A,?), ref: 004A7C1B

Part of subcall function 004A7FC4: __EH_prolog3.LIBCMT ref: 004A7FCB
Part of subcall function 004A7FC4: #1165.MFC42U(CNotebookApp::_RecoverAndOpen,00000000,00000010,004A7CC1,00000000,?,00000001,?,?,?,CNotebookApp::_RecoverFileWithPrompting,?,00000110,004A7F6A,?), ref: 004A8009
Part of subcall function 004A7FC4: #1165.MFC42U ref: 004A800E

Strings

CNotebookApp::_RecoverFileWithPrompting, xrefs: 004A7A69

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #861$#540Time$H_prolog3$#1165#2506FileFreeStringSystem$#324#4155#567#800H_prolog3_catchH_prolog3_catch_
String ID: CNotebookApp::_RecoverFileWithPrompting
API String ID: 2309824089-971925626
Opcode ID: 600c8c4f280c09400ace0b19d113d5173ac4061753122e7d1054cd4a35e74a3b
Instruction ID: 8443a01664faf3db3d2dc4d21b07ad931f126a3b47dccbea8c3a089b160c8bf0
Opcode Fuzzy Hash: 600c8c4f280c09400ace0b19d113d5173ac4061753122e7d1054cd4a35e74a3b
Instruction Fuzzy Hash: ED61E670904209AEDB25DBA1CC95FFE7BB8AF66308F10005FF102A7191DB786A45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00433BEB, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00433BF2
#1165.MFC42U(CMainFrame::OnOoui,00000000,00000054,0042C923), ref: 00433C12
#1165.MFC42U ref: 00433C1D

Part of subcall function 0042A482: __EH_prolog3.LIBCMT ref: 0042A489

GetClientRect.USER32 ref: 00433C4F

Part of subcall function 0044AAFC: __EH_prolog3.LIBCMT ref: 0044AB03

IntersectRect.USER32 ref: 00433D2C
PtInRect.USER32(?,?,?), ref: 00433DC8

Part of subcall function 00429A9B: __EH_prolog3.LIBCMT ref: 00429AA2

Strings

CMainFrame::OnOoui, xrefs: 00433BFB

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3Rect$#1165$ClientH_prolog3_Intersect
String ID: CMainFrame::OnOoui
API String ID: 3887645276-3433903953
Opcode ID: 6f7dbaa788aaf3a0e232cf3bb2bb1cc461027b273cf23fd5db642a78d7dd395a
Instruction ID: a2f195663b7a1250a73a755e53cbf942e5a379d152cf41c20d9afa035778dbca
Opcode Fuzzy Hash: 6f7dbaa788aaf3a0e232cf3bb2bb1cc461027b273cf23fd5db642a78d7dd395a
Instruction Fuzzy Hash: AD613C31A002189FEB10DFE5CD44BEEBBB9AF48745F14406AE901EB251DB79EE05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00491B92, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00491B9C
memset.MSVCRT ref: 00491C02
PathFileExistsW.SHLWAPI(00000000,004900BA,?,?,00000000,00000000), ref: 00491C0B
PathIsDirectoryW.SHLWAPI(?), ref: 00491C61

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

PathFindFileNameW.SHLWAPI(?,?,00000104), ref: 00491CDF
PathRemoveBackslashW.SHLWAPI(?), ref: 00491CFB

Strings

CNBNotebook::_OpenObjectFromFile, xrefs: 00491BCB

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$File$BackslashDirectoryExistsFindH_prolog3_MessageNameRemoveTracememset
String ID: CNBNotebook::_OpenObjectFromFile
API String ID: 1494919399-1372525479
Opcode ID: aedcf92c214d5ed437b941d1a767e1fc83d833ad92021c95e80198e2413414bc
Instruction ID: ba6ddde0ba8e8ba2701f11ded3171e469faa54cbd7b56027b28cead5b93db0c3
Opcode Fuzzy Hash: aedcf92c214d5ed437b941d1a767e1fc83d833ad92021c95e80198e2413414bc
Instruction Fuzzy Hash: EC715671D01229ABDF259F54DC88B9E7B75AF48724F1141EBE909A7260CB389F80CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00486A11, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00486A1B
memset.MSVCRT ref: 00486A63
#1165.MFC42U ref: 00486A6B

Part of subcall function 00441B78: #1662.MFC42U ref: 00441BC9

#1165.MFC42U(?,?,?,00000105,00000001), ref: 00486AC9

Part of subcall function 0048FE9F: __EH_prolog3_GS.LIBCMT ref: 0048FEA9
Part of subcall function 0048FE9F: memset.MSVCRT ref: 0048FEFB

Part of subcall function 0048611E: __EH_prolog3_GS.LIBCMT ref: 00486128
Part of subcall function 0048611E: SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00486158
Part of subcall function 0048611E: #6776.MFC42U(?,?,?,?,00000100), ref: 004861BD
Part of subcall function 0048611E: #1165.MFC42U(?,?,?,00000100), ref: 004861FC
Part of subcall function 0048611E: memset.MSVCRT ref: 00486239
Part of subcall function 0048611E: SysAllocString.OLEAUT32(?), ref: 00486276

#1165.MFC42U ref: 00486BBE
#1165.MFC42U(?,00000105), ref: 00486C11

Part of subcall function 004863F7: __EH_prolog3.LIBCMT ref: 004863FE
Part of subcall function 004863F7: SendMessageW.USER32(?,00000146,00000000,00000000), ref: 00486425
Part of subcall function 004863F7: #6697.MFC42U(00000020), ref: 00486450
Part of subcall function 004863F7: CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00000000,000000FF), ref: 0048646A

Strings

CTOCView::_SetScope, xrefs: 00486A34

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3_memset$MessageSendString$#1662#6697#6776AllocCompareH_prolog3
String ID: CTOCView::_SetScope
API String ID: 1395203970-2003031954
Opcode ID: 57043e010ac7bd77823ad3192a8b154f270a2dc0f9902d9123d850e6376b0f26
Instruction ID: 303ed4e8c9d104052129d0ef5e0b5f49462a2dcd0cef273a6af84d5540e31ca9
Opcode Fuzzy Hash: 57043e010ac7bd77823ad3192a8b154f270a2dc0f9902d9123d850e6376b0f26
Instruction Fuzzy Hash: 41519230601124ABDB94BB65DD59BAE72B5EF48308F1148AFE409D7251EF38EE81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0044B644, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044B64B
#1165.MFC42U(CNotebookDoc::_GetTitleText,?,00000018,0044C1A3,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 0044B678

Part of subcall function 00441B78: #1662.MFC42U ref: 00441BC9

#1165.MFC42U(00000001,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 0044B7CD

Part of subcall function 0044AC97: __EH_prolog3.LIBCMT ref: 0044AC9E

SysStringLen.OLEAUT32(?), ref: 0044B736
SysFreeString.OLEAUT32(?), ref: 0044B752
SysFreeString.OLEAUT32(00000000), ref: 0044B7C7

Strings

CNotebookDoc::_GetTitleText, xrefs: 0044B658

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: String$#1165FreeH_prolog3$#1662
String ID: CNotebookDoc::_GetTitleText
API String ID: 977529962-3515152436
Opcode ID: 18f63c84772e7eb17625eb13caab3e8042481602ad73006cefeba1e5c7a091c3
Instruction ID: c20c96d5702806d25733114e087d9fc9651c44c063d3cedc67817b0409ac406a
Opcode Fuzzy Hash: 18f63c84772e7eb17625eb13caab3e8042481602ad73006cefeba1e5c7a091c3
Instruction Fuzzy Hash: C7516F74A0120ADFEB15DF65C465BAEBBB4EF44304F20806EE405AB351DB39DE41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00491253, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 155stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0049125D
memset.MSVCRT ref: 004912FE
lstrlenW.KERNEL32(?,00000000,?), ref: 0049133F
PathIsDirectoryW.SHLWAPI(?), ref: 00491354
memset.MSVCRT ref: 004913DB

Strings

CNBNotebook::_LoadMRUFolders, xrefs: 0049126D
CNBMRUList::GetMaxSize, xrefs: 004912A4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$DirectoryH_prolog3_Pathlstrlen
String ID: CNBMRUList::GetMaxSize$CNBNotebook::_LoadMRUFolders
API String ID: 2265575128-963356101
Opcode ID: ed0f784e53db06f684be1e6837c10e33c75fc3e606784e2ed4cf15b440cc65c2
Instruction ID: 3a23a3441ed970bdec1f7ce5928a243b6455f61b0d227e773100274c88f38416
Opcode Fuzzy Hash: ed0f784e53db06f684be1e6837c10e33c75fc3e606784e2ed4cf15b440cc65c2
Instruction Fuzzy Hash: AE5112B190021A9BDF20DF55CD84B9AB7B8AF44704F5014EEE609A7251DB38AE85CF29

Uniqueness

Uniqueness Score: -1.00%

Function 0044F1AB, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044F1B2
#1165.MFC42U(CNotebookView::SetZoomLevel,00000000,0000002C,0042CD6F,00000000,00000000), ref: 0044F1D2
#1165.MFC42U(?,?), ref: 0044F2BE
#1165.MFC42U(00000001), ref: 0044F2CD
GetFocus.USER32 ref: 0044F2E7
#1165.MFC42U ref: 0044F2FC

Part of subcall function 00429241: __EH_prolog3.LIBCMT ref: 00429248

Part of subcall function 00429B9B: __EH_prolog3.LIBCMT ref: 00429BA2

Strings

CNotebookView::SetZoomLevel, xrefs: 0044F1BF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$FocusH_prolog3_
String ID: CNotebookView::SetZoomLevel
API String ID: 282196061-4067382698
Opcode ID: 9c32c19681726b349317a65614c6d007ad91e220c705161aa61ebf81532e8b24
Instruction ID: 3b38c02018cc35d47560ad76dfdfef5053c8635e1d81e10af77bb671121dd366
Opcode Fuzzy Hash: 9c32c19681726b349317a65614c6d007ad91e220c705161aa61ebf81532e8b24
Instruction Fuzzy Hash: 1C41A034B001149BEF15AF62D895AAE7BA5BF84304F04407FE806AB292DF7DDC49CA59

Uniqueness

Uniqueness Score: -1.00%

Function 0046D4B4, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046D4BB

Part of subcall function 004AED8E: GetDC.USER32(00000000), ref: 004AEDAF
Part of subcall function 004AED8E: GetLastError.KERNEL32 ref: 004AEDBB

#2854.MFC42U(00000000,?,00000001,?,CPageSetupCommon::UpdateTitleDimensions,00000000,00000028,004670D1,?,?,?,?,?,?,?,?), ref: 0046D4FE
#537.MFC42U(Title,?,00000001,?,CPageSetupCommon::UpdateTitleDimensions,00000000,00000028,004670D1,?,?,?,?,?,?,?,?), ref: 0046D519
#4155.MFC42U(0000EF64,?,00000001,?,CPageSetupCommon::UpdateTitleDimensions,00000000,00000028,004670D1,?,?,?,?,?,?,?,?), ref: 0046D52B

Part of subcall function 00467969: GetTextExtentPoint32W.GDI32(?,?,?,?), ref: 00467980

Part of subcall function 004AEE99: ReleaseDC.USER32 ref: 004AEEBE

#800.MFC42U ref: 0046D63A

Strings

Title, xrefs: 0046D50F
CPageSetupCommon::UpdateTitleDimensions, xrefs: 0046D4C7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2854#4155#537#800ErrorExtentH_prolog3LastPoint32ReleaseText
String ID: CPageSetupCommon::UpdateTitleDimensions$Title
API String ID: 4063837422-1504596200
Opcode ID: c5004da87273f26487a972bf3f4458a67793e446180bc7d845271425e9113406
Instruction ID: ec34db0f8b414a1d03320249db8643079b52613c9b952e76260b20d950117bc1
Opcode Fuzzy Hash: c5004da87273f26487a972bf3f4458a67793e446180bc7d845271425e9113406
Instruction Fuzzy Hash: A751A270F01209EFDB10AFA1D889AEEBFB0FF58300F5144A9E18276195DB744965CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004BD580, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 135fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,00000000,jnwppr.dll,004011BC,?,jnwppr.dll,?), ref: 004BD664
GetLastError.KERNEL32 ref: 004BD680
GetLastError.KERNEL32 ref: 004BD6D8
GetLastError.KERNEL32(00969CB0,0000EF51,00000000), ref: 004BD703

Strings

JournalPrint, xrefs: 004BD6B0
AddPrinterProcessor, xrefs: 004BD59D
jnwppr.dll, xrefs: 004BD5ED, 004BD5FA, 004BD642, 004BD6B5

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CopyFile
String ID: AddPrinterProcessor$JournalPrint$jnwppr.dll
API String ID: 936320341-2281333574
Opcode ID: 0dd4a20a2575ae95b7fabbbaf8079df130c564c295ac0dea39813c94b8b1a0d2
Instruction ID: 73d0b7c6fd515e29b792c0497a8cb73809feece162d448e3db07a4d7b492ae3a
Opcode Fuzzy Hash: 0dd4a20a2575ae95b7fabbbaf8079df130c564c295ac0dea39813c94b8b1a0d2
Instruction Fuzzy Hash: D041B471A002289BD7259A65DD85FEB7768AF54314F0040EBEE08D7291EB78DD848BBC

Uniqueness

Uniqueness Score: -1.00%

Function 0045761B, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00457622
#2445.MFC42U(CNBToolbar::~CNBToolbar,00000000,0000000C,0042A999), ref: 00457740
#2445.MFC42U(CNBToolbar::~CNBToolbar,00000000,0000000C,0042A999), ref: 00457763
#2445.MFC42U(CNBToolbar::~CNBToolbar,00000000,0000000C,0042A999), ref: 00457786
#807.MFC42U(CNBToolbar::~CNBToolbar,00000000,0000000C,0042A999), ref: 004577BB

Strings

0K, xrefs: 0045762C
CNBToolbar::~CNBToolbar, xrefs: 00457638

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2445$#807H_prolog3
String ID: 0K$CNBToolbar::~CNBToolbar
API String ID: 750774920-2812687773
Opcode ID: 16fa29ac581d98c0777d00135a411adc2aaa3f4d949a3ca75a3d3c6b5c339374
Instruction ID: c6034866fc4bec3fed5917120c4571647831b287e018b1aab0072ed885186477
Opcode Fuzzy Hash: 16fa29ac581d98c0777d00135a411adc2aaa3f4d949a3ca75a3d3c6b5c339374
Instruction Fuzzy Hash: B5516C34605701CFD724DF69D480BAABBE1BF09301F04447EE5AE8B2A2CB75B844CB19

Uniqueness

Uniqueness Score: -1.00%

Function 00428251, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(0E0227DC), ref: 0042829A
GetKeyState.USER32(00000011), ref: 004282A2
#2371.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,004BFA0E,000000FF), ref: 004282E0
ScreenToClient.USER32 ref: 0042833F
ClientToScreen.USER32(0E0227DC,0E0227DC), ref: 00428385
SetCursorPos.USER32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004BFA0E), ref: 00428393

Strings

CSplitWnd::OnKeyDown, xrefs: 00428282

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientCursorScreen$#2371State
String ID: CSplitWnd::OnKeyDown
API String ID: 1196014860-3031495268
Opcode ID: 7aaa88116d379efc61d26701c9ee7d1623a721a034bc3ee543a418d28b63b833
Instruction ID: 10655275dfca17abf21f23d977ae0119a18cd306fbd77aa8b5a3d33f26ffcde1
Opcode Fuzzy Hash: 7aaa88116d379efc61d26701c9ee7d1623a721a034bc3ee543a418d28b63b833
Instruction Fuzzy Hash: 82418D31605711DFC324CB28E845B6E77E5FB44721F944A2FF466C26A0DF799800CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 004BD103, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32 ref: 004BD13A
GetLastError.KERNEL32 ref: 004BD1FA

Part of subcall function 004BDF43: malloc.MSVCRT ref: 004BDF5B

Part of subcall function 004359C6: _vsnwprintf.MSVCRT ref: 004359F8

Strings

Journal Note Writer Port:, xrefs: 004BD1BF
AddPort, xrefs: 004BD1C4
Journal Note Port, xrefs: 004BD163
\\%s\,XcvMonitor %s, xrefs: 004BD16E
AddPortW, xrefs: 004BD11E

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ComputerErrorLastName_vsnwprintfmalloc
String ID: AddPort$AddPortW$Journal Note Port$Journal Note Writer Port:$\\%s\,XcvMonitor %s
API String ID: 625755450-4061156272
Opcode ID: 9f31d28fd3cf4acc1c48d437d6c143842fb97caa76cecb7ecc145ebf554aa664
Instruction ID: 567c279712d4b3d6d9f1f66dbe9869e782c1b3cf890f726528283022b4d0e9c8
Opcode Fuzzy Hash: 9f31d28fd3cf4acc1c48d437d6c143842fb97caa76cecb7ecc145ebf554aa664
Instruction Fuzzy Hash: 5231C272A01208ABD705DFA9DD45AEE7BB9EB48314F1404ABF901E2251EB79C9418B78

Uniqueness

Uniqueness Score: -1.00%

Function 0042E271, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042E2DF

Part of subcall function 004335B3: __EH_prolog3.LIBCMT ref: 004335BA
Part of subcall function 004335B3: memset.MSVCRT ref: 004335DD

PathFileExistsW.SHLWAPI(00000206,?,?,00000206,CMainFrame::OnFileMRU,00000000,0E0227DC), ref: 0042E304
#1165.MFC42U ref: 0042E315
#1165.MFC42U ref: 0042E32A

Part of subcall function 00442EB1: __EH_prolog3.LIBCMT ref: 00442EB8
Part of subcall function 00442EB1: #1165.MFC42U(CNotebookApp::OpenDocument,00000000,00000010,00441CD8,?,00000001,00000003,00000001,00000000,00000000,?,00001800,00000000,00000000,00000000,CNotebookApp::OpenFile), ref: 00442EFD

#1165.MFC42U(?,?,00000004), ref: 0042E34A
#1165.MFC42U ref: 0042E35A

Strings

CMainFrame::OnFileMRU, xrefs: 0042E2BC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3memset$ExistsFilePath
String ID: CMainFrame::OnFileMRU
API String ID: 1830320760-628525699
Opcode ID: d5b1828ecb489cc10aae5ae9a661cd79e1d99e56f1ec5ad6b58915ac876ac51c
Instruction ID: 1cda3294fafc5746b5f8b934ba9118e260d8d2c446536b06b68b9dee86b2b217
Opcode Fuzzy Hash: d5b1828ecb489cc10aae5ae9a661cd79e1d99e56f1ec5ad6b58915ac876ac51c
Instruction Fuzzy Hash: 4A319272204255AFD314DB65DD85EABB7DCEB88718F00062FF54597290DA38D904CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004954D9, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 98stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004954E3

Part of subcall function 004943BA: __EH_prolog3.LIBCMT ref: 004943C1

memset.MSVCRT ref: 00495562

Part of subcall function 00494C29: GetPrivateProfileStringW.KERNEL32 ref: 00494C75

lstrlenW.KERNEL32(?,Present,?,00000040,?,?,?,?,?,?), ref: 00495596

Strings

AutoSaveFile, xrefs: 004955C5
CActiveFileList::GetData, xrefs: 00495504
Present, xrefs: 00495575
Flags, xrefs: 004955FF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3H_prolog3_PrivateProfileStringlstrlenmemset
String ID: AutoSaveFile$CActiveFileList::GetData$Flags$Present
API String ID: 2475261855-2599993927
Opcode ID: ead0d85449917dae956f4a2279c4482c3209103a26f856e69a9967c58233037f
Instruction ID: baad79046eab59b46dfb7261beb0bcc4fafa5d55351de269239b3a33caf44ccf
Opcode Fuzzy Hash: ead0d85449917dae956f4a2279c4482c3209103a26f856e69a9967c58233037f
Instruction Fuzzy Hash: BF319371E426389FDF21DA208D41F9DBA64AB04B64F5100BBEE0DA7342D7785E478B98

Uniqueness

Uniqueness Score: -1.00%

Function 004935BC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004935C6
memset.MSVCRT ref: 00493608
GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 0049363D
PathRemoveBackslashW.SHLWAPI(?,?,?,?,00000000,00000000), ref: 0049364A
lstrcmpiW.KERNEL32(00000001,?,?,?,?,00000000,00000000), ref: 00493669
lstrcmpiW.KERNEL32(00000001,?,?,?,?,00000000,00000000), ref: 0049368D

Strings

CNBMRUList::Add, xrefs: 004935DF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Pathlstrcmpi$BackslashH_prolog3_LongNameRemovememset
String ID: CNBMRUList::Add
API String ID: 3341809184-2124779920
Opcode ID: 619f68daaa151114321fd723d60b1527907f9ffd60cf446c150c1eabd584d48e
Instruction ID: f6c26b16b7affc67aa83b5fb4f2f6475adf7ba241001f098f9177bc7dfb0f2db
Opcode Fuzzy Hash: 619f68daaa151114321fd723d60b1527907f9ffd60cf446c150c1eabd584d48e
Instruction Fuzzy Hash: 5431707190052ABFCF30EF95D888E9AB7B4BB09304F4040BAA51997351DB34EE45CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004A7E5B, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004A7E65

Part of subcall function 00495315: memset.MSVCRT ref: 00495337

memset.MSVCRT ref: 004A7EAF
memset.MSVCRT ref: 004A7EC6
lstrlenW.KERNEL32(?), ref: 004A7F87
DeleteFileW.KERNEL32(?), ref: 004A7F98

Strings

CNotebookApp::_RecoverNextCrashedNote, xrefs: 004A7E7A
,TD, xrefs: 004A7EE6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$DeleteFileH_prolog3_lstrlen
String ID: ,TD$CNotebookApp::_RecoverNextCrashedNote
API String ID: 3070161895-432916114
Opcode ID: 9bd014653f5e3023a97787974f3ebbbb08742136f4ee03d9ad33dcb5eec1433a
Instruction ID: 323f45b14378857755146931fc6e218274b0baab868f78b87ee8554d1a0573e7
Opcode Fuzzy Hash: 9bd014653f5e3023a97787974f3ebbbb08742136f4ee03d9ad33dcb5eec1433a
Instruction Fuzzy Hash: AF31507190422C9ADB20EB62CC45BDEB7F8AF54304F5140EAE54DA2142EF399F88CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00443299, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004432A0
_wcsicmp.MSVCRT ref: 004432DC
#1165.MFC42U(CNotebookApp::ActivateInstance,00000000,00000010,00442F33,00000003,?,00000003,CNotebookApp::OpenDocument,00000000,00000010,00441CD8,?,00000001,00000003,00000001,00000000), ref: 004432EC
#1165.MFC42U(00000003), ref: 00443306
#1165.MFC42U(00000003), ref: 00443342
#1165.MFC42U(00000003,00000003,00000000,00000003), ref: 00443364

Strings

CNotebookApp::ActivateInstance, xrefs: 004432B0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3_wcsicmp
String ID: CNotebookApp::ActivateInstance
API String ID: 1515656720-2167320120
Opcode ID: 81fd09974c79ed6c9adce85373aab8cfdef9e62bc8a4d76d9685e5a71a592843
Instruction ID: 4690e9844718ca416ba9854e655402b4b4a50769b533cdca733c60c33229aab8
Opcode Fuzzy Hash: 81fd09974c79ed6c9adce85373aab8cfdef9e62bc8a4d76d9685e5a71a592843
Instruction Fuzzy Hash: CB21D7719006159BE714AF66CC84AAF7BA4BF44715F04412FFC16A7292DF38AE01CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0045ABEA, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045ABF1
IsChild.USER32(?,?), ref: 0045AC54
SendMessageW.USER32(?,00000157,00000000,00000000), ref: 0045AC83
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0045AC9A
SendMessageW.USER32(00000000,00008063,00009CC0,?), ref: 0045ACD5
#5977.MFC42U ref: 0045ACE1

Strings

CNBToolbar::PreTranslateFrameMessage, xrefs: 0045ABFE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$#5977ChildH_prolog3
String ID: CNBToolbar::PreTranslateFrameMessage
API String ID: 3861660577-1158063937
Opcode ID: e1c34cf8e724b01c6aedfba426c3e64bd215da2f5668b24beabb338b9114f117
Instruction ID: 3478d8f89e77f3af46204b1a2ee5a2beb77dc3f5cfbfbe27c133594fbc9c5231
Opcode Fuzzy Hash: e1c34cf8e724b01c6aedfba426c3e64bd215da2f5668b24beabb338b9114f117
Instruction Fuzzy Hash: DA21BF30601211DFDB228F51DC94EAA3B60FF05752F14426BED489B3A2DB38D864CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0044D3AE, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044D3B5
#1165.MFC42U(CNotebookView::LoadZoomSettings,00000000,0000001C,0044D360,00000000,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001), ref: 0044D3DB
#1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044D3DD

Part of subcall function 0044C5F6: __EH_prolog3.LIBCMT ref: 0044C5FD
Part of subcall function 0044C5F6: #1165.MFC42U(CNotebookDoc::GetDocumentZoomType,00000000,0000001C,0044D3E7,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044C615
Part of subcall function 0044C5F6: #1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044C634

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

Part of subcall function 0042973F: __EH_prolog3.LIBCMT ref: 00429746

Part of subcall function 00429485: __EH_prolog3.LIBCMT ref: 0042948C

Part of subcall function 00429CCA: __EH_prolog3.LIBCMT ref: 00429CD1

#1165.MFC42U(?,?,?,0000000C,00000000,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001), ref: 0044D441
GetFocus.USER32(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044D45B
#1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044D46C

Part of subcall function 0044F008: __EH_prolog3.LIBCMT ref: 0044F00F

Strings

CNotebookView::LoadZoomSettings, xrefs: 0044D3C4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3$Focusmemcpy
String ID: CNotebookView::LoadZoomSettings
API String ID: 2152913476-3218336778
Opcode ID: 50137f6096d65821e130bf2383f68228c2ad0779196ce82138d753f4c6640fb3
Instruction ID: 601b7b5a79790c7216800aab152289afcb962f5f8def5c09c9ea2e4a14297b06
Opcode Fuzzy Hash: 50137f6096d65821e130bf2383f68228c2ad0779196ce82138d753f4c6640fb3
Instruction Fuzzy Hash: CE21B130E015249FEF14EB61C856BBDB7A1AF48708F44406EE505B7292DF3CAD058BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0044F845, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000114,NBMapFile,CPgIpc::CreateFileView,?,?,00000000,00000000), ref: 0044F878
GetLastError.KERNEL32(?,00000000,00000000), ref: 0044F885
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F895
memset.MSVCRT ref: 0044F8B1
GetLastError.KERNEL32(?,00000000), ref: 0044F8D7

Strings

NBMapFile, xrefs: 0044F868
CPgIpc::CreateFileView, xrefs: 0044F85B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$CreateMappingViewmemset
String ID: CPgIpc::CreateFileView$NBMapFile
API String ID: 2511537074-2316541370
Opcode ID: b7f11a3e270653acbc498430d61428ac63ef8ab37ee6200573e1119a24680cff
Instruction ID: d8d93ea877d9a15acd54fb9855f966bc64596dc32552a6a7343a3d15ff058c9e
Opcode Fuzzy Hash: b7f11a3e270653acbc498430d61428ac63ef8ab37ee6200573e1119a24680cff
Instruction Fuzzy Hash: D121A7B1600209FFE7109BA59D49F6A77A8EB00318F14417BFA0597291D779DD04C779

Uniqueness

Uniqueness Score: -1.00%

Function 0042ABAF, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042ABB6

Part of subcall function 00431189: __EH_prolog3.LIBCMT ref: 00431190
Part of subcall function 00431189: #1165.MFC42U(CMainFrame::GetCurrentEraser,00000000,0000000C,0042C873,?,00000001,00000005), ref: 004311AB

Part of subcall function 004311E1: __EH_prolog3.LIBCMT ref: 004311E8
Part of subcall function 004311E1: #1165.MFC42U(CMainFrame::SetCurrentEraser,?,0000000C,0042C87E,00000000,00000001,00000008), ref: 00431230
Part of subcall function 004311E1: #1165.MFC42U(00008012,0000000D), ref: 004312AD

#1165.MFC42U(CMainFrame::GetCurrentFlag,00000000,00000000,00000000,CMainFrame::InitAndShowMainWindow,00000000,00000014,004402D1), ref: 0042ABFA
#1165.MFC42U(00000000,00000000,?,0000003B), ref: 0042AC32
#6211.MFC42U(00000005,00000000), ref: 0042AC5C
UpdateWindow.USER32(?), ref: 0042AC65

Strings

CMainFrame::GetCurrentFlag, xrefs: 0042ABE1
CMainFrame::InitAndShowMainWindow, xrefs: 0042ABC3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$#6211UpdateWindow
String ID: CMainFrame::GetCurrentFlag$CMainFrame::InitAndShowMainWindow
API String ID: 1068732450-3682482441
Opcode ID: cd086a851b94efc4a8a44c053a44e452c30f3d51e2ef028f70a5163b8c33d7b0
Instruction ID: 48aa571cc19720f697e07815f13ac28d8249ca0f18e1ca62facf735fb68d67f9
Opcode Fuzzy Hash: cd086a851b94efc4a8a44c053a44e452c30f3d51e2ef028f70a5163b8c33d7b0
Instruction Fuzzy Hash: F5113A71600119AFEB04EBA2DD96FAE7768AF44708F00006EB206671D2DEA86D058B79

Uniqueness

Uniqueness Score: -1.00%

Function 0042DA1A, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042DA21
#1165.MFC42U(CMainFrame::FindProcessByFileName,00000000,00000018,004432FE,00000003), ref: 0042DA3B
#4166.MFC42U(?,00000000,00000000,?,?,?,00000000), ref: 0042DA98
lstrcmpiW.KERNEL32(00000003,00000000,?,?,?,00000000), ref: 0042DAA2
#6307.MFC42U(?,?,?,00000000), ref: 0042DAB2
#6307.MFC42U(?,?,?,00000000), ref: 0042DAC0

Strings

CMainFrame::FindProcessByFileName, xrefs: 0042DA2A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #6307$#1165#4166H_prolog3lstrcmpi
String ID: CMainFrame::FindProcessByFileName
API String ID: 3925976717-435179528
Opcode ID: 7a612ac845295a888e831b07d8f3a18ca41764caee7ef49c537b8a286f354b7b
Instruction ID: ab2b51611e464056186a840faaec0f94e0342f8eb450b140f3e26a8e212e2b4c
Opcode Fuzzy Hash: 7a612ac845295a888e831b07d8f3a18ca41764caee7ef49c537b8a286f354b7b
Instruction Fuzzy Hash: AC11AC71B01111ABE704EBB5EC46FAE7774AF44310F54452BE512E7291EF38AD068B68

Uniqueness

Uniqueness Score: -1.00%

Function 004752F7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004752FE
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 0047532E
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00475349
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00475365
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00475381
#3312.MFC42U(00000000,?), ref: 0047539C

Strings

CSrchView::GetFindPaneSettings, xrefs: 0047530B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$#3312H_prolog3
String ID: CSrchView::GetFindPaneSettings
API String ID: 1134567374-2263800861
Opcode ID: 0a37ebd5ce3ed581c52d9a6ad1fa2233c238b08914ce3680076866f9c8c7efc6
Instruction ID: 6a267174a765f5a05f7a603b785bce2fd1216132f338378cc63c57804143f301
Opcode Fuzzy Hash: 0a37ebd5ce3ed581c52d9a6ad1fa2233c238b08914ce3680076866f9c8c7efc6
Instruction Fuzzy Hash: E0118171180305ABE725AF35CC85FEA77A0EF50704F10443EFA1A6A1E1DFF46944CA18

Uniqueness

Uniqueness Score: -1.00%

Function 0046E833, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046E83A
#540.MFC42U(CSimpleFindDialog::_SetControlText,00000000,0000000C,0046E97F,000003FF,0000DAC4,CSrchChevronButton::SetTrianglesUp,00000000,CSimpleFindDialog::_UpdateMoreButton,00000000,00000014,0046E465,?,00000000,00000000,0E0227DC), ref: 0046E857
#3087.MFC42U(?,?,00000000,00000000,0E0227DC), ref: 0046E866
#4155.MFC42U(?,?,00000000,00000000,0E0227DC), ref: 0046E874
SendMessageW.USER32(?,0000000C,00000000,0E0227DC), ref: 0046E8A7
#800.MFC42U(?,00000000,00000000,0E0227DC), ref: 0046E8DE

Strings

CSimpleFindDialog::_SetControlText, xrefs: 0046E847

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #3087#4155#540#800H_prolog3MessageSend
String ID: CSimpleFindDialog::_SetControlText
API String ID: 237706452-2739868020
Opcode ID: 4ffc589fcf58f911a128128309032b6541ca91a519001e1b200eb445655dd925
Instruction ID: fa2b8fe944f0cc006e2893f692f2052023d6ac0e73f02dd07d372a8864dc0ed0
Opcode Fuzzy Hash: 4ffc589fcf58f911a128128309032b6541ca91a519001e1b200eb445655dd925
Instruction Fuzzy Hash: 4021C035901205EBEB16AFA5CD04EBE3B71EB14308F14806FEA01572A2DB79CD05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00469EE7, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00469EEE
#489.MFC42U(0000006A,00000000,00000008,00466E75,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings), ref: 00469EFC

Part of subcall function 0049DE94: #567.MFC42U(?), ref: 0049DE9F

#567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 00469F4A
#567.MFC42U(?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000), ref: 00469F5E
#567.MFC42U(?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000), ref: 00469F72

Part of subcall function 0049DFAB: #567.MFC42U(?,?), ref: 0049DFB7

Strings

$K, xrefs: 00469F4C
CPageSetupPage::CPageSetupPage, xrefs: 00469FA4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$#489H_prolog3
String ID: $K$CPageSetupPage::CPageSetupPage
API String ID: 3691984168-4286655245
Opcode ID: a7b69d27bf919d9baeef9c296e768a7e8df9e70d27748fbc650148709edef0a8
Instruction ID: 508bd355684fa788709855f07320429518ab0ca217d6b9b74ef1cc2e438b5837
Opcode Fuzzy Hash: a7b69d27bf919d9baeef9c296e768a7e8df9e70d27748fbc650148709edef0a8
Instruction Fuzzy Hash: 19214D30901244DADF05EF61C9967DCBBA0AF25304F5444BED9453F2C6DBB91B48CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0044D193, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044D19A
#1165.MFC42U(00000001), ref: 0044D1CF
#5848.MFC42U(?,00000001), ref: 0044D1DA
#5977.MFC42U(?,00000001), ref: 0044D1E3
#1165.MFC42U(CNotebookView::SetFullScreenMode,00000000,00000008,0044D155,00000000), ref: 0044D1C0

Part of subcall function 00432A4D: __EH_prolog3_GS.LIBCMT ref: 00432A57
Part of subcall function 00432A4D: #1165.MFC42U(0000002C), ref: 00432ABF
Part of subcall function 00432A4D: #1165.MFC42U(0000002C), ref: 00432AE4
Part of subcall function 00432A4D: #4279.MFC42U(00C40000,00000000,00000000,00000002,00000001,0000002C), ref: 00432B63
Part of subcall function 00432A4D: GetSystemMenu.USER32(?,00000000), ref: 00432B6D
Part of subcall function 00432A4D: #2858.MFC42U(00000000), ref: 00432B74
Part of subcall function 00432A4D: RemoveMenu.USER32(?,0000F010,00000000), ref: 00432B97
Part of subcall function 00432A4D: RemoveMenu.USER32(00000000,0000F000,00000000), ref: 00432BA9
Part of subcall function 00432A4D: RemoveMenu.USER32(00000000,0000F030,00000000), ref: 00432BBB
Part of subcall function 00432A4D: InsertMenuW.USER32(00000000,00000000,00000C00,00000000,00000000), ref: 00432BD0

#1165.MFC42U(CNotebookView::SetFullScreenMode,00000000,00000008,0044D155,00000000), ref: 0044D1F4

Strings

CNotebookView::SetFullScreenMode, xrefs: 0044D1A3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165Menu$Remove$#2858#4279#5848#5977H_prolog3H_prolog3_InsertSystem
String ID: CNotebookView::SetFullScreenMode
API String ID: 663312853-657252973
Opcode ID: dfb9143a820388eeaccd32ff20091906f3a7b81eec1250789f68e74460cb4bb0
Instruction ID: 0d518eaa307bb846709c385d661b55085528e490c9be2a3fbf9a6eb3a44224a2
Opcode Fuzzy Hash: dfb9143a820388eeaccd32ff20091906f3a7b81eec1250789f68e74460cb4bb0
Instruction Fuzzy Hash: 6E01A5316000008BD714F761CD5ABBD7761BF54319F25406FE5165B2E2DFB89D46CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0042AEE6, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042AEED
#1165.MFC42U(CMainFrame::GetNotebookDPI,00000000,0000000C,0046D314,?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0042AF0A
GetDC.USER32(?), ref: 0042AF32
#2854.MFC42U(00000000,?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0042AF39
GetDeviceCaps.GDI32(?,00000058), ref: 0042AF46
ReleaseDC.USER32 ref: 0042AF54

Strings

CMainFrame::GetNotebookDPI, xrefs: 0042AEFA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#2854CapsDeviceH_prolog3Release
String ID: CMainFrame::GetNotebookDPI
API String ID: 1672910354-3420076278
Opcode ID: 740c1cd94a25a9d33c86f9b1c7836227ffc767dd2f73de0ff1bea9a60058e182
Instruction ID: 0688a0faa18da0c7121d028d227d8efec9306f5216b79789f59c6c9065b12e01
Opcode Fuzzy Hash: 740c1cd94a25a9d33c86f9b1c7836227ffc767dd2f73de0ff1bea9a60058e182
Instruction Fuzzy Hash: 9301A271601516ABDB00AFA1DD09AFE7B75FF48714F01442EFA06972A1DF789805CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042EC6C, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042EC73
#1165.MFC42U(CMainFrame::OnResume,00000000,0000000C,0042EB0A,CMainFrame::OnPowerBroadCast,00000000), ref: 0042EC91
#1165.MFC42U ref: 0042ECA5

Part of subcall function 004A847A: __EH_prolog3_GS.LIBCMT ref: 004A8484
Part of subcall function 004A847A: #1165.MFC42U(?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8520
Part of subcall function 004A847A: #2506.MFC42U(?,?,?,?,?,000000A2,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A8613

#1165.MFC42U ref: 0042ECAF
#1165.MFC42U ref: 0042ECBD
#1165.MFC42U ref: 0042ECC7

Strings

CMainFrame::OnResume, xrefs: 0042EC7E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#2506H_prolog3H_prolog3_
String ID: CMainFrame::OnResume
API String ID: 3669301483-1927322457
Opcode ID: c0c5da599e1efa733ef028a74772d44c88000b9bf848370a28db1ff085b7cd34
Instruction ID: 1b51b75c450164f69af1696c3d691f3ad0e4fddd9a9d3ec9cc9144f043e6a0b4
Opcode Fuzzy Hash: c0c5da599e1efa733ef028a74772d44c88000b9bf848370a28db1ff085b7cd34
Instruction Fuzzy Hash: 8D011230201154DFD714FBA7CD49E9BBBA4EF94700F4640BAE5099B2A2DA68EC41CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004829DB, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 243COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004829E5

Part of subcall function 004AFAB3: RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\TabletPC,00000000,?,?,Helpers::RegOpenKeyExW,00000000,?,00000000,?,?,00000000), ref: 004AFAE0

Part of subcall function 004AFB47: RegCloseKey.ADVAPI32(00000000,Helpers::RegCloseKey,00000000,00000000,?,?), ref: 004AFB68

Strings

SortProperty, xrefs: 00482C39
SortOrder, xrefs: 00482BD8
CMetaListColumnArray::_ValidateColumn, xrefs: 00482AD5
Columns, xrefs: 00482A24
CMetaListColumnArray::ReadFromRegistry, xrefs: 004829FB

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseH_prolog3_Open
String ID: CMetaListColumnArray::ReadFromRegistry$CMetaListColumnArray::_ValidateColumn$Columns$SortOrder$SortProperty
API String ID: 3821066247-3397604961
Opcode ID: a43191e809ba56467b16c13bbced9d0c7ccba604c24a85bfa7cb45b1311bc711
Instruction ID: 2311a3476275fbded7a6b017fb76b9b1df10f0532ddc54852124ed3dcd18c1a9
Opcode Fuzzy Hash: a43191e809ba56467b16c13bbced9d0c7ccba604c24a85bfa7cb45b1311bc711
Instruction Fuzzy Hash: EF919E71D013299BDF25EEA5CA40BAEB7B4AF04714F21052FD809BB241D7B8AD45CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004843F6, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 218windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004843FD

Part of subcall function 004841CF: __EH_prolog3.LIBCMT ref: 004841D6

Part of subcall function 0048407D: __EH_prolog3.LIBCMT ref: 00484084

Part of subcall function 00435657: memset.MSVCRT ref: 0043566C
Part of subcall function 00435657: TraceEvent.ADVAPI32(0E0227DC,00000000,?,00000002,?,00000000), ref: 004356A5

LockWindowUpdate.USER32(?,00000000,00000000,00000000,CViewMgr::ShowView,00000000,00000014,00432D08,00000000,00000001,Normal,0000002C,0000002C,00000018), ref: 004844A5
SendMessageW.USER32(?,00008004,00000000,00000000), ref: 004844ED
SendMessageW.USER32(?,00008004,00000000,00000001), ref: 00484625
LockWindowUpdate.USER32(00000000), ref: 0048462D

Part of subcall function 00484B80: __EH_prolog3_GS.LIBCMT ref: 00484B8A
Part of subcall function 00484B80: memset.MSVCRT ref: 00484BC6
Part of subcall function 00484B80: #1165.MFC42U(00000000,0E0227DC), ref: 00484BDE
Part of subcall function 00484B80: tolower.MSVCRT ref: 00484C11
Part of subcall function 00484B80: tolower.MSVCRT ref: 00484C1A

Strings

CViewMgr::ShowView, xrefs: 00484406

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$LockMessageSendUpdateWindowmemsettolower$#1165EventH_prolog3_Trace
String ID: CViewMgr::ShowView
API String ID: 2767216146-2865898492
Opcode ID: 248d2b0b87a51566f2e7abde40e39be375611cdc825125cf0ca46ce1b8d6baaf
Instruction ID: 8377d5d7bf12ba795173a504397542b5870a6cfd9bec04faf1739f9e310e1fb1
Opcode Fuzzy Hash: 248d2b0b87a51566f2e7abde40e39be375611cdc825125cf0ca46ce1b8d6baaf
Instruction Fuzzy Hash: FC719230700202ABDF25BB658C55BAE7365ABC4B04F10482FFA05A62D1DB7D9E41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00427965, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

#470.MFC42U(?,CSplitWnd::OnPaint,00000000,0E0227DC), ref: 004279C6
GetClientRect.USER32 ref: 004279DC
InflateRect.USER32(?,?,?), ref: 004279F3
#4018.MFC42U(?), ref: 00427ADB
#755.MFC42U ref: 00427BC7

Strings

CSplitWnd::OnPaint, xrefs: 004279B0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$#4018#470#755ClientInflate
String ID: CSplitWnd::OnPaint
API String ID: 327478204-1133339869
Opcode ID: 0accef28103801a11f685f093c5f8e90a06a8acef3082e050256f6686969ade9
Instruction ID: eae60e3580606ad7edb9e1e977b676c85ac958d3cff1966dcd11a0e30a434c2b
Opcode Fuzzy Hash: 0accef28103801a11f685f093c5f8e90a06a8acef3082e050256f6686969ade9
Instruction Fuzzy Hash: F391E0716097409FC318CF59D884A6ABBF5FF88704F004A2EF99A83751DB74E944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0048E64F, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0048E656
GetFileAttributesExW.KERNEL32(?,00000000,?,CNBFolder::Initialize,?,00000048,004916EE,00000000,00000000,?,CNBNotebook::_OpenAddFolder,00000000,0000001C,00491DCB,00000000,000000FC), ref: 0048E6DF
GetLastError.KERNEL32 ref: 0048E6EE
SHGetSettings.SHELL32(?,00000001), ref: 0048E76F

Strings

CNBFileObject::_GetInitState, xrefs: 0048E6A9, 0048E784
CNBFolder::Initialize, xrefs: 0048E670

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesErrorFileH_prolog3_LastSettings
String ID: CNBFileObject::_GetInitState$CNBFolder::Initialize
API String ID: 2857593485-2396189910
Opcode ID: 2b63fcc5d30762d4fe56aa61c15ee8f36fb7b388404a20a0c7c2ba077ff59dfb
Instruction ID: 3015299f6e091f0fcd98f5e155f6d7cd6ee830a08f3911db9e41ab32059066cd
Opcode Fuzzy Hash: 2b63fcc5d30762d4fe56aa61c15ee8f36fb7b388404a20a0c7c2ba077ff59dfb
Instruction Fuzzy Hash: 76716D70A01209EFDB15FF92D985AADB771AF10308F20482FF911AB2A1DB799D45CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00476862, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 193stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(Journal Note Writer,?,CNBPrinter::FindNBPrinter,00000000,0000001C,0044DFC3,?,00000068), ref: 004768BE
__EH_prolog3.LIBCMT ref: 00476869

Part of subcall function 004767E5: __EH_prolog3.LIBCMT ref: 004767EC
Part of subcall function 004767E5: lstrlenW.KERNEL32(?,CNBPrinter::IsNBPrinter,00000000,0000000C,004769F8,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00476811

lstrlenW.KERNEL32( 2A,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,CNBPrinter::FindNBPrinter,00000000,0000001C), ref: 00476A27

Strings

CNBPrinter::FindNBPrinter, xrefs: 0047687D
Journal Note Writer, xrefs: 0047688E, 004768BD, 004768E4
2A, xrefs: 00476A06, 00476A1D, 00476A52, 00476A24, 00476A57

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$H_prolog3
String ID: 2A$CNBPrinter::FindNBPrinter$Journal Note Writer
API String ID: 3247104991-11029606
Opcode ID: 1e2aea940b66c50ec4e36e0b7d2ff0a743445a66ba75faf3ed9737923d7380ba
Instruction ID: c73e414b46f2940b13a71763a83301e18e2411019d7ec31e9a1c80b01cd0d3bd
Opcode Fuzzy Hash: 1e2aea940b66c50ec4e36e0b7d2ff0a743445a66ba75faf3ed9737923d7380ba
Instruction Fuzzy Hash: DC61C1B1A002069FDB159F65C945BFFB7B2AF04308F25842FE505AB2A1DB7DC845CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0049188C, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00491893
CoGetClassObject.OLE32(00404B1C,00000001,00000000,00401100,00000000,CNBNotebook::_InitSelf,00000000,00000014,0048FBC6), ref: 004918D0
#543.MFC42U(00000000,00000000,00000000), ref: 00491A43
InitializeCriticalSection.KERNEL32(00000008), ref: 00491A53

Part of subcall function 0042A2C9: TraceMessage.ADVAPI32(00000000,0000EF51,0000002B,0041E910,00000064,00969CB0,00000004,00000000,?,004B04F0,00969CB0,0000EF51,00000000,?,?), ref: 0042A2E0

Strings

CNBNotebook::_InitSelf, xrefs: 004918A0
@K, xrefs: 00491A4C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #543ClassCriticalH_prolog3InitializeMessageObjectSectionTrace
String ID: @K$CNBNotebook::_InitSelf
API String ID: 3691835663-3307054357
Opcode ID: 8537ff4f8dd1803bd7d2ce1a7fd12ab89a087c579e38c2e77c295a0b01f33a4a
Instruction ID: 9a98cda3574f8c06b236541dd6ea4243f78ccf6c1e6a667de852cde70f53dd4c
Opcode Fuzzy Hash: 8537ff4f8dd1803bd7d2ce1a7fd12ab89a087c579e38c2e77c295a0b01f33a4a
Instruction Fuzzy Hash: CD519F70A013179BDF199FA1C955BBE7BB1AF04308F14447FE500AA2A1DB79CD81CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00427DA5, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00427DEA
#2859.MFC42U(00000000), ref: 00427DF1
OffsetRect.USER32(?,00000000,?), ref: 00427EDB
OffsetRect.USER32(?,?,00000000), ref: 00427F0D
OffsetRect.USER32(?,00000000,?), ref: 00427F54

Strings

CSplitWnd::OnMouseMove, xrefs: 00427DDC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: OffsetRect$#2859Capture
String ID: CSplitWnd::OnMouseMove
API String ID: 503420928-3215426059
Opcode ID: 2943eb40eded97e4912d8d2f046b4cefec9b323896ae32561c32655d7b6d60b2
Instruction ID: d0b8096c1f101cfc82501316bd61e586ebf3105de66fd23f9a55e06c28656505
Opcode Fuzzy Hash: 2943eb40eded97e4912d8d2f046b4cefec9b323896ae32561c32655d7b6d60b2
Instruction Fuzzy Hash: 92516E31309556EFDB18CF28D888FAAB7A5FF85300F55462AF559C3240CB38AD50CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00493B0B, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 140stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00493B12
lstrlenW.KERNEL32(?,00000000), ref: 00493BD5
PathFileExistsW.SHLWAPI(?), ref: 00493BFB

Strings

b2I, xrefs: 00493B68
CNBMRUEnum::CNBMRUEnum, xrefs: 00493B60
CNBMRUList::CreateEnumerator, xrefs: 00493B1F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ExistsFileH_prolog3Pathlstrlen
String ID: CNBMRUEnum::CNBMRUEnum$CNBMRUList::CreateEnumerator$b2I
API String ID: 3057980361-2201575161
Opcode ID: ce676fbee5e674d66e614ef9da8c0c0de4d1c7eaf6e36aa5c27ff8f02a700170
Instruction ID: 387c7d88926b0f594350dec933d4242c1476c09d7929cf221e158f47a738afc8
Opcode Fuzzy Hash: ce676fbee5e674d66e614ef9da8c0c0de4d1c7eaf6e36aa5c27ff8f02a700170
Instruction Fuzzy Hash: 4351B031A006168FCF11DF55C984AAEBFB0FF46305B10846FE911AB361CB78DA41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00484C67, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00484C6E

Part of subcall function 00425432: #3087.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00425483

#3084.MFC42U(CViewMgr::SwapViews,00000001,00000024,00484B5F,?,?,CViewMgr::ApplyViewLocation,00000001,00000010,004844DD,00000001), ref: 00484CD6
#3084.MFC42U ref: 00484CDD
#5945.MFC42U(00000000), ref: 00484CE9
#5945.MFC42U(00000000), ref: 00484CEF

Strings

CViewMgr::SwapViews, xrefs: 00484C83

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #3084#5945$#3087H_prolog3
String ID: CViewMgr::SwapViews
API String ID: 4003048048-1192151933
Opcode ID: 6fa80c63cfdcee2dc73deadcdc9b9fb6f5c9dd39e6702859ecafdaedb49516dd
Instruction ID: 531018103e6772b128bdb8071f61d87915905d75663a68a80455ff118b9dad03
Opcode Fuzzy Hash: 6fa80c63cfdcee2dc73deadcdc9b9fb6f5c9dd39e6702859ecafdaedb49516dd
Instruction Fuzzy Hash: BA416D729004299BDF02DF64C8406AEB7B2BF85310B1A416AEC15BF310DAB6BE05CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00441143, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

#1148.MFC42U(?,00000000), ref: 00441211
UnregisterTraceGuids.ADVAPI32(00C89CB1,0000EF52,CNotebookApp::_UnInitFileMgr,00000000,00000000), ref: 00441287
#2717.MFC42U(CNotebookApp::_UnInitFileMgr,00000000,00000000), ref: 004412A5

Strings

CIdleTaskMgr::Flush, xrefs: 0044119A
CNotebookApp::ExitInstance, xrefs: 00441175
CNotebookApp::_UnInitFileMgr, xrefs: 00441218

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1148#2717GuidsTraceUnregister
String ID: CIdleTaskMgr::Flush$CNotebookApp::ExitInstance$CNotebookApp::_UnInitFileMgr
API String ID: 1248799435-1192910051
Opcode ID: 240728d0dc58d6f113005fa63fb5da30428804f465300d9268b2721e0478d564
Instruction ID: 3644f1a14605814e0f64b6eace00a97eb32f6106b386c2c064397659c744c535
Opcode Fuzzy Hash: 240728d0dc58d6f113005fa63fb5da30428804f465300d9268b2721e0478d564
Instruction Fuzzy Hash: 1441C1317046409FD714DF26C885B6AB7E4BF54718F04452FF956A73A0CBB8AC44CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004348BA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004348C1
#1165.MFC42U(CMainFrame::InsertMenuMRUInkTitle,?,00000018,004332B1,?,?,?,?,?,?,?), ref: 004348E7
#2855.MFC42U(?), ref: 00434958
InsertMenuW.USER32(00000001,?,00000004,?,00000000), ref: 00434971
InsertMenuW.USER32(00000001,?,00000000,?,00000002), ref: 004349D5

Strings

CMainFrame::InsertMenuMRUInkTitle, xrefs: 004348CC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: InsertMenu$#1165#2855H_prolog3
String ID: CMainFrame::InsertMenuMRUInkTitle
API String ID: 1659417835-2621877238
Opcode ID: 19d9ec32fa9007b93e0ae9f664a895164726602ccd8bcc51515789d058fee6a8
Instruction ID: 89e4972db3da3f13e7bfac1caf3a77a243a94156795aabf42c77cbc45c8a2163
Opcode Fuzzy Hash: 19d9ec32fa9007b93e0ae9f664a895164726602ccd8bcc51515789d058fee6a8
Instruction Fuzzy Hash: A8417F7160020AAFDB11CF61D941FAF7BB1AF48314F14806AFA05AB2A1C739E910DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004A8E0A, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004A8E14

Part of subcall function 00495704: __EH_prolog3.LIBCMT ref: 0049570B

memset.MSVCRT ref: 004A8E95

Part of subcall function 004951C8: memset.MSVCRT ref: 004951F9

CompareStringW.KERNEL32(0000007F,00000001,?,000000FF,?,000000FF,?,?,?), ref: 004A8EFE
#1001.MFC42U(?), ref: 004A8F1C
#1085.MFC42U(?,?), ref: 004A8F37

Strings

CRecoverPreviewDlg::Init, xrefs: 004A8E36

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$#1001#1085CompareH_prolog3H_prolog3_catch_String
String ID: CRecoverPreviewDlg::Init
API String ID: 2634370560-2536125012
Opcode ID: af9f0d62857afe5e124d21e6af3b87611283b10140298def2f8be3a3e7f2efaa
Instruction ID: 3e2aca69db87b8390eda53ee189f464251194c0b49e861d1036612f74860edb0
Opcode Fuzzy Hash: af9f0d62857afe5e124d21e6af3b87611283b10140298def2f8be3a3e7f2efaa
Instruction Fuzzy Hash: B7419170A01219AFDF209B91CC88B9AB7B5EB25314F1041EEE508A6251DF78DE84CF18

Uniqueness

Uniqueness Score: -1.00%

Function 0044B819, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044B820
SysFreeString.OLEAUT32(00000000), ref: 0044B8FE

Part of subcall function 0044B644: __EH_prolog3.LIBCMT ref: 0044B64B
Part of subcall function 0044B644: #1165.MFC42U(CNotebookDoc::_GetTitleText,?,00000018,0044C1A3,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 0044B678
Part of subcall function 0044B644: SysStringLen.OLEAUT32(?), ref: 0044B736

PropVariantCopy.OLE32(?,?,?), ref: 0044B8A0
PropVariantClear.OLE32(?), ref: 0044B8C7
PropVariantClear.OLE32(?), ref: 0044B8CD

Strings

CNotebookDoc::_SaveTitleText, xrefs: 0044B82D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: PropVariant$ClearH_prolog3String$#1165CopyFree
String ID: CNotebookDoc::_SaveTitleText
API String ID: 2074540697-730430674
Opcode ID: ab45741d547167f8bbeb6d77bd1784697c51a836eab2fc7044c92d19dd4d2ae8
Instruction ID: e5856823aae7a67077991a442d7f16eb3948d537cf8792c8c4a9bc30eb33d933
Opcode Fuzzy Hash: ab45741d547167f8bbeb6d77bd1784697c51a836eab2fc7044c92d19dd4d2ae8
Instruction Fuzzy Hash: 9A310E75E00229AFDB01DFE8C845AEEBBB8FF48704F10052AE515F7251D7789A05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0048C5BF, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C5C6

Part of subcall function 0048A0CF: __EH_prolog3.LIBCMT ref: 0048A0D6

Part of subcall function 0048A5D0: memset.MSVCRT ref: 0048A612

lstrlenW.KERNEL32(00000000,00170008,00000000,CNBFileObject::_SetFilePathProps,00000000,00000010,0048EE79,?,CNBFolder::_InitializeFromFolder,00000001,00000044,0048E8A1,?,00100000,00000010,00000000), ref: 0048C62A
PathFindFileNameW.SHLWAPI(00000000,00000000), ref: 0048C68B
PathRemoveBackslashW.SHLWAPI(00000000,00180008,00000000), ref: 0048C6BB
PathFindFileNameW.SHLWAPI(00000000), ref: 0048C6C2

Part of subcall function 0042A2C9: TraceMessage.ADVAPI32(00000000,0000EF51,0000002B,0041E910,00000064,00969CB0,00000004,00000000,?,004B04F0,00969CB0,0000EF51,00000000,?,?), ref: 0042A2E0

Strings

CNBFileObject::_SetFilePathProps, xrefs: 0048C5D5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$FileFindH_prolog3Name$BackslashMessageRemoveTracelstrlenmemset
String ID: CNBFileObject::_SetFilePathProps
API String ID: 2417672637-4283825509
Opcode ID: 315e0c15732f9f8bb6ccdd7cd83c0e04c4879b1e611ef2725bfd4d3391cbf7bd
Instruction ID: 4f5862cf129f3825551e0ff228ff920b37a0b8a9025a2ac468b72b052904c9c8
Opcode Fuzzy Hash: 315e0c15732f9f8bb6ccdd7cd83c0e04c4879b1e611ef2725bfd4d3391cbf7bd
Instruction Fuzzy Hash: C8310131A012259BCB01AB658885ABF77B5EF48714F14482FF901BB291EBBC9D0587B9

Uniqueness

Uniqueness Score: -1.00%

Function 004435AD, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004435B7
SHGetMalloc.SHELL32(?), ref: 004435EC
SHGetFolderLocation.SHELL32(00000000,00000005,00000000,00000000,?), ref: 0044360E
memset.MSVCRT ref: 00443630

Part of subcall function 0047A3D6: __EH_prolog3_GS.LIBCMT ref: 0047A3E0
Part of subcall function 0047A3D6: #1165.MFC42U(G_GetMyNotesDirectoryName,?,00000218,0047A686,00000000,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A41F
Part of subcall function 0047A3D6: memset.MSVCRT ref: 0047A467
Part of subcall function 0047A3D6: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?,?,00000104,00000064), ref: 0047A47B
Part of subcall function 0047A3D6: #1165.MFC42U(?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A48B
Part of subcall function 0047A3D6: PathCombineW.SHLWAPI(?,?,?,?,00000104,?,?,00000104,00000064), ref: 0047A4B8
Part of subcall function 0047A3D6: PathFileExistsW.SHLWAPI(?,?,?,00000104,?,?,00000104,00000064), ref: 0047A4C9
Part of subcall function 0047A3D6: lstrlenW.KERNEL32(Notes,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A4D9
Part of subcall function 0047A3D6: #1165.MFC42U(Notes,00000000,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A4FB
Part of subcall function 0047A3D6: lstrlenW.KERNEL32(?,00000064,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A507

Part of subcall function 00443449: __EH_prolog3_GS.LIBCMT ref: 00443453

SHGetFolderLocation.SHELL32(00000000,00000000,00000000,00000000,?), ref: 004436A7

Strings

CNotebookApp::InitializeDefaultBrowsePIDL, xrefs: 004435C0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165FolderH_prolog3_Path$Locationlstrlenmemset$CombineExistsFileMalloc
String ID: CNotebookApp::InitializeDefaultBrowsePIDL
API String ID: 2510545952-3003931607
Opcode ID: 3984b8d6bb900521f32735eda323317ebd564f72400f682bb8d8d3017d66ecfe
Instruction ID: 462aa75bdab7e25747578732839db71c17bc7a62c49e19cbe3301fa0ba28876c
Opcode Fuzzy Hash: 3984b8d6bb900521f32735eda323317ebd564f72400f682bb8d8d3017d66ecfe
Instruction Fuzzy Hash: 94415370A01225BBEB24DFA1DC59B9A77B8AF08715F1041EAE408E7250DB38DF84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004495BF, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004495C9
memset.MSVCRT ref: 00449611
#1165.MFC42U ref: 00449676
#1165.MFC42U ref: 0044968C
#1165.MFC42U ref: 0044968E

Strings

CNotebookDoc::SetInkSelectionPen, xrefs: 004495D8

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3_memset
String ID: CNotebookDoc::SetInkSelectionPen
API String ID: 3823675065-1525153838
Opcode ID: 8cf3343d34bd0ac6434f058606171bc7e3f64e47947e12e04c5e3eab13f30849
Instruction ID: 93725f2e5d97fb6b375fcedbc5d700fa37c3b262bc78c80b36fbd285c3145097
Opcode Fuzzy Hash: 8cf3343d34bd0ac6434f058606171bc7e3f64e47947e12e04c5e3eab13f30849
Instruction Fuzzy Hash: A6415E70E013198FEB14DFA9C985BDEB7B4BF44304F15806AE548AB296DB389E41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00427C57, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

#1193.MFC42U(00000009,CSplitWnd::SetSplitCursor,00000000,0E0227DC), ref: 00427C9C
SetCursor.USER32(?), ref: 00427CE2
#1143.MFC42U(?,0000000C,?,?,?,?,?,?,004BFA0E,000000FF), ref: 00427D26
SetCursor.USER32(?,?,?,?,?,?,?,004BFA0E,000000FF), ref: 00427D69
#1562.MFC42U(00000009,?,?,?,?,?,?,004BFA0E,000000FF), ref: 00427D7C

Strings

CSplitWnd::SetSplitCursor, xrefs: 00427C8C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$#1143#1193#1562
String ID: CSplitWnd::SetSplitCursor
API String ID: 1471262606-3182489474
Opcode ID: 772035c78d26e86ead8fbb0d872e46955f5f895df46e59ffa695d8391b61a1d5
Instruction ID: da9bc7f43945f05985617a312cc15b3a9a3fe89db8e40e40b68feb50e329e1d6
Opcode Fuzzy Hash: 772035c78d26e86ead8fbb0d872e46955f5f895df46e59ffa695d8391b61a1d5
Instruction Fuzzy Hash: C431AD7170D3509BD724CF6AEC85A2A37A4EB85718F50093FE515C72A0EB7CE8008B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0047A5CF, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0047A5D9
memset.MSVCRT ref: 0047A636
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,000000FF,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A64A
memset.MSVCRT ref: 0047A672

Part of subcall function 0047A3D6: __EH_prolog3_GS.LIBCMT ref: 0047A3E0
Part of subcall function 0047A3D6: #1165.MFC42U(G_GetMyNotesDirectoryName,?,00000218,0047A686,00000000,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A41F
Part of subcall function 0047A3D6: memset.MSVCRT ref: 0047A467
Part of subcall function 0047A3D6: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?,?,00000104,00000064), ref: 0047A47B
Part of subcall function 0047A3D6: #1165.MFC42U(?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A48B
Part of subcall function 0047A3D6: PathCombineW.SHLWAPI(?,?,?,?,00000104,?,?,00000104,00000064), ref: 0047A4B8
Part of subcall function 0047A3D6: PathFileExistsW.SHLWAPI(?,?,?,00000104,?,?,00000104,00000064), ref: 0047A4C9
Part of subcall function 0047A3D6: lstrlenW.KERNEL32(Notes,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A4D9
Part of subcall function 0047A3D6: #1165.MFC42U(Notes,00000000,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A4FB
Part of subcall function 0047A3D6: lstrlenW.KERNEL32(?,00000064,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A507

PathCombineW.SHLWAPI(?,?,?,00000000,?,?,?,?,?,?,?,?,00465982,?,CNBSettingsMgr::Get), ref: 0047A6A1

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

G_GetMyNotesPath, xrefs: 0047A5F9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$#1165memset$CombineFolderH_prolog3_lstrlen$ExistsFileMessageTrace
String ID: G_GetMyNotesPath
API String ID: 511137580-2308732761
Opcode ID: 7a8d79ee8e71d3649afadc85f7a515e8035acbfb02aa50469c10a88e57715349
Instruction ID: 88e1cfab5aff91e9b5b3fd3f2e467bfc59f0982577c14289d593ed4b2a646a1f
Opcode Fuzzy Hash: 7a8d79ee8e71d3649afadc85f7a515e8035acbfb02aa50469c10a88e57715349
Instruction Fuzzy Hash: 5231F5B1A001249BD7258B10CD48FDE77B8AF44314F4180ABFA0897252D778CE94CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0042E056, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

#1165.MFC42U(CMainFrame::OnBrowseMoveNote,00000000,0E0227DC), ref: 0042E0B6
memset.MSVCRT ref: 0042E0EB
memset.MSVCRT ref: 0042E101
#1165.MFC42U ref: 0042E109

Part of subcall function 00442F86: __EH_prolog3.LIBCMT ref: 00442F8D
Part of subcall function 00442F86: #540.MFC42U(CNotebookApp::BrowseFolder,?,00000030,0042E121,?,?,?), ref: 00442FB3
Part of subcall function 00442F86: #4155.MFC42U(0000EF30), ref: 00442FCF
Part of subcall function 00442F86: SHBrowseForFolderW.SHELL32(00000000), ref: 00443018
Part of subcall function 00442F86: SHGetMalloc.SHELL32(00000000), ref: 0044307F
Part of subcall function 00442F86: #800.MFC42U ref: 004430B2

Part of subcall function 0044512E: __EH_prolog3_GS.LIBCMT ref: 00445138
Part of subcall function 0044512E: PathFindFileNameW.SHLWAPI(00000000), ref: 004451A9
Part of subcall function 0044512E: lstrlenW.KERNEL32(00000000), ref: 004451BE
Part of subcall function 0044512E: memset.MSVCRT ref: 004451E3
Part of subcall function 0044512E: memset.MSVCRT ref: 00445214
Part of subcall function 0044512E: lstrlenW.KERNEL32(?,00000000), ref: 00445248
Part of subcall function 0044512E: lstrlenW.KERNEL32(?), ref: 0044525B

#1165.MFC42U(?,?,?,?,?), ref: 0042E140

Strings

CMainFrame::OnBrowseMoveNote, xrefs: 0042E09F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$#1165lstrlen$#4155#540#800BrowseFileFindFolderH_prolog3H_prolog3_MallocNamePath
String ID: CMainFrame::OnBrowseMoveNote
API String ID: 154616447-2634677889
Opcode ID: 47ef500556f19b834524920f260b746ad0ee63b09c92b7bdfc62008872a03c6e
Instruction ID: a161dab032d8b3c219a06ee26a1027e6e81d07a23b2773f47189dec608bea872
Opcode Fuzzy Hash: 47ef500556f19b834524920f260b746ad0ee63b09c92b7bdfc62008872a03c6e
Instruction Fuzzy Hash: 4B3184B1604344AFD720DB66DD85FABB3DCEB88718F41052FF54993241DA38E904CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00435310, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

#5024.MFC42U(?,?,?,CMainFrame::OnSize,00000000,0E0227DC), ref: 0043536A
#5651.MFC42U(00000000,0000FFFF,0000E900,00000001,?,00000000,00000001), ref: 0043539D
#4294.MFC42U(?,?,?,?,00000001), ref: 004353E3
#5651.MFC42U(00000000,0000FFFF,0000E900,00000000,00000000,00000000,00000001), ref: 0043540A

Strings

CViewMgr::MoveWindow, xrefs: 004353B2
CMainFrame::OnSize, xrefs: 00435351

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #5651$#4294#5024
String ID: CMainFrame::OnSize$CViewMgr::MoveWindow
API String ID: 3331558564-1688415184
Opcode ID: 624a26ec222e86b89073df6b20e1c8bbfe65a69bb6d478f0837641c99942a24b
Instruction ID: fe854a2a6e8a66b614520aab128f8ecd6fa41544d283e7845969bc850ab69bbd
Opcode Fuzzy Hash: 624a26ec222e86b89073df6b20e1c8bbfe65a69bb6d478f0837641c99942a24b
Instruction Fuzzy Hash: 1D31EF31208341AFD714DF69CD81F6A7BE8FB58714F000A3EF656922D0CA75E9008B1A

Uniqueness

Uniqueness Score: -1.00%

Function 00497A05, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00497A46
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00497A5B
LoadLibraryW.KERNEL32(?,?,?,00000000), ref: 00497AC9
GetLastError.KERNEL32(?,?,00000000), ref: 00497AE9

Strings

SafeLoadMAPI32, xrefs: 00497A26
mapi32.dll, xrefs: 00497AB2

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryErrorLastLibraryLoadSystemmemset
String ID: SafeLoadMAPI32$mapi32.dll
API String ID: 3043707446-2575677419
Opcode ID: 284b4b5955cdabce6f7e19498390d7fa8df97d232c7b3309422b29f965490da4
Instruction ID: 2828d6b38508f8782c3564dea833a0c7d95cb266d575e10b127150362dd643ab
Opcode Fuzzy Hash: 284b4b5955cdabce6f7e19498390d7fa8df97d232c7b3309422b29f965490da4
Instruction Fuzzy Hash: 1231D3317402189ADB24DB65CC89EEA7B78EF50304F1004AFE949D3291DA78DE85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042EA77, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

#4118.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0178,000000FF), ref: 0042EB32
SetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0178), ref: 0042EB55
#1165.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004C0178,000000FF), ref: 0042EB5B

Strings

CMainFrame::QuerySuspend, xrefs: 0042EB14
CMainFrame::OnPowerBroadCast, xrefs: 0042EAAA
DQMB, xrefs: 0042EB70

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#4118ForegroundWindow
String ID: CMainFrame::OnPowerBroadCast$CMainFrame::QuerySuspend$DQMB
API String ID: 1984090801-1496100076
Opcode ID: 4cbb1d532dd5167fc73d98ed5ed9c19f34c1af48868fb00197cffac40fd1d5f7
Instruction ID: abd47e99291409aecd97a47c93b56eb82f0a22897025f2c8d4e6ae6d5443436e
Opcode Fuzzy Hash: 4cbb1d532dd5167fc73d98ed5ed9c19f34c1af48868fb00197cffac40fd1d5f7
Instruction Fuzzy Hash: 413104313082119FD710EF67E989A2B7B94FB54368F90452FF442823A1DE3DE941CA6E

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3A9, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042E416

Part of subcall function 004335B3: __EH_prolog3.LIBCMT ref: 004335BA
Part of subcall function 004335B3: memset.MSVCRT ref: 004335DD

PathFileExistsW.SHLWAPI(?,?,00000206,00000206,CMainFrame::OnFolderMRU,00000000,0E0227DC), ref: 0042E43B
#1165.MFC42U ref: 0042E446

Part of subcall function 00442EB1: __EH_prolog3.LIBCMT ref: 00442EB8
Part of subcall function 00442EB1: #1165.MFC42U(CNotebookApp::OpenDocument,00000000,00000010,00441CD8,?,00000001,00000003,00000001,00000000,00000000,?,00001800,00000000,00000000,00000000,CNotebookApp::OpenFile), ref: 00442EFD

#1165.MFC42U(?,00000001,00000004), ref: 0042E46B
#1165.MFC42U ref: 0042E47F

Strings

CMainFrame::OnFolderMRU, xrefs: 0042E3F3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3memset$ExistsFilePath
String ID: CMainFrame::OnFolderMRU
API String ID: 1830320760-2165567363
Opcode ID: 1e7e8ffec5e35664c252b368edeb92e066526399f8c931572eba23ca32abeba3
Instruction ID: fb7a627ea9ff2b9023189b9021759a46145f59a66a420859aeaeb131100da5e7
Opcode Fuzzy Hash: 1e7e8ffec5e35664c252b368edeb92e066526399f8c931572eba23ca32abeba3
Instruction Fuzzy Hash: 8431B072204245AFD720DFA5DD89FAB77DCEB58324F00052FF64587291DA38D90487AA

Uniqueness

Uniqueness Score: -1.00%

Function 004BD245, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32 ref: 004BD27C

Part of subcall function 004BDF43: malloc.MSVCRT ref: 004BDF5B

Part of subcall function 004359C6: _vsnwprintf.MSVCRT ref: 004359F8

Strings

RemovePort, xrefs: 004BD260
DeletePort, xrefs: 004BD306
Journal Note Writer Port:, xrefs: 004BD301
Journal Note Port, xrefs: 004BD2A5
\\%s\,XcvMonitor %s, xrefs: 004BD2B0

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ComputerName_vsnwprintfmalloc
String ID: DeletePort$Journal Note Port$Journal Note Writer Port:$RemovePort$\\%s\,XcvMonitor %s
API String ID: 1783214968-1387778671
Opcode ID: 69b1fd500bad9be2df7fa2643be900b3e9fecd345d7bcd8f558d3e2140194f02
Instruction ID: b8932f00b5b125d81cc27e8463a2468908bf5b3da4928ce2ddf4a5e9c7a146cf
Opcode Fuzzy Hash: 69b1fd500bad9be2df7fa2643be900b3e9fecd345d7bcd8f558d3e2140194f02
Instruction Fuzzy Hash: 14217372D01208AFD701DF96DC85EEEBBB8EF48354F14016BF902A3241EB7999458B79

Uniqueness

Uniqueness Score: -1.00%

Function 00494D7B, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00494DCA
lstrlenW.KERNEL32(?,ModifiedDate,?,00000040,?,00000000), ref: 00494E10
StrToInt64ExW.SHLWAPI(?,00000001,?), ref: 00494E36
GetLastError.KERNEL32 ref: 00494E7C

Strings

ModifiedDate, xrefs: 00494DEE
CNBFileSettings::ReadValueFILETIME, xrefs: 00494DA1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorInt64Lastlstrlenmemset
String ID: CNBFileSettings::ReadValueFILETIME$ModifiedDate
API String ID: 3643085013-3749977607
Opcode ID: 8bad473733cac21dcbacff51a7de58efe33887069050496c7e7cb35a5bb7603d
Instruction ID: 1c9b5de0f260c5f40539e9d56ab91cdba79001349b5e4ac4438212811227b772
Opcode Fuzzy Hash: 8bad473733cac21dcbacff51a7de58efe33887069050496c7e7cb35a5bb7603d
Instruction Fuzzy Hash: B5315E75E012299BDF20DF65CC40FAABB78BB44754F0080BAA949E7341DA749E458FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00431961, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00431968

Part of subcall function 0042AE91: __EH_prolog3.LIBCMT ref: 0042AE98
Part of subcall function 0042AE91: #1165.MFC42U(CMainFrame::GetCurrentHighlightPenIndex,00000000,0000000C,0042B2EF,?,00000000,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0), ref: 0042AEB0

#1165.MFC42U(CMainFrame::SetHighlightPensSettings,00000000,00000028,0042E6D5,?,00000001,00000000,?,00000000), ref: 004319DB
#1165.MFC42U(CMainFrame::SetHighlightPen,?,CMainFrame::SetHighlightPensSettings,00000000,00000028,0042E6D5,?,00000001,00000000,?,00000000), ref: 00431A17

Strings

CMainFrame::SetHighlightPensSettings, xrefs: 00431978
W, xrefs: 00431A02
CMainFrame::SetHighlightPen, xrefs: 004319FA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CMainFrame::SetHighlightPen$CMainFrame::SetHighlightPensSettings$W
API String ID: 3111753120-1642198148
Opcode ID: 3c33b549ba812e37f7ae4ed022f34fd00477e3f46057aa5ee1ba51c2f30c05f3
Instruction ID: 5afbe40598d2723fefbde2e4bdfdf9b5542d7b5094ae205071ad1cdf21c96935
Opcode Fuzzy Hash: 3c33b549ba812e37f7ae4ed022f34fd00477e3f46057aa5ee1ba51c2f30c05f3
Instruction Fuzzy Hash: 0931A331901209DFDF10EF95C985BEEB7F0AF18315F20806BE905A7291DB7C5A45CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004316D7, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004316DE

Part of subcall function 0042AE3C: __EH_prolog3.LIBCMT ref: 0042AE43
Part of subcall function 0042AE3C: #1165.MFC42U(CMainFrame::GetCurrentWritingPenIndex,00000000,0000000C,0042B2E0,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0,00000005,00009C7C), ref: 0042AE5B

#1165.MFC42U(CMainFrame::SetWritingPensSettings,00000000,00000028,0042E6A3,?,00000001,00000000,?,00000000), ref: 00431750
#1165.MFC42U(CMainFrame::SetWritingPen,?,CMainFrame::SetWritingPensSettings,00000000,00000028,0042E6A3,?,00000001,00000000,?,00000000), ref: 0043178C

Strings

CMainFrame::SetWritingPen, xrefs: 0043176F
W, xrefs: 00431777
CMainFrame::SetWritingPensSettings, xrefs: 004316EE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CMainFrame::SetWritingPen$CMainFrame::SetWritingPensSettings$W
API String ID: 3111753120-1402849406
Opcode ID: e0a9980b558b704619ea825674e67fbe11bf29d74d11aa2b228793ad95c39846
Instruction ID: 7b9c8cb7dd95721d1529072b8dfaf8e16a0aa27c53eef5bed834b549893bbbbd
Opcode Fuzzy Hash: e0a9980b558b704619ea825674e67fbe11bf29d74d11aa2b228793ad95c39846
Instruction Fuzzy Hash: 8931A530900209DFDF10DF95C985BEEB7F4AF08319F14806AE905A7290DB7C9A45CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00458573, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(004D4EF8), ref: 004585DB
CopyRect.USER32 ref: 004585FF
SendMessageW.USER32(?,00000419,004D2078,00000000), ref: 00458632
SendMessageW.USER32(?,0000041D,00000000,00008011), ref: 00458647
InvalidateRect.USER32(?,00008011,00000001,?,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0,00000005,00009C7C), ref: 00458654

Strings

CNBToolbar::SetPaintRect, xrefs: 0045858D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$MessageSend$CopyEmptyInvalidate
String ID: CNBToolbar::SetPaintRect
API String ID: 2558161568-3422194919
Opcode ID: b8cee0c8e7351d75f518c515d676aaee17ae3145b4a3823c1f077dd6733964fc
Instruction ID: 8c1ac8852c4036b1c44fa3e6a107afd09855aabaa0fd7435cefad8560cad5c54
Opcode Fuzzy Hash: b8cee0c8e7351d75f518c515d676aaee17ae3145b4a3823c1f077dd6733964fc
Instruction Fuzzy Hash: 2A316B75700209AFDB08DF69CC81FAAB7B5FB58301F10416EE91AA7251DF35AC15CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00448CAC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00448CB6

Part of subcall function 0044C3B6: __EH_prolog3.LIBCMT ref: 0044C3BD

Part of subcall function 00445EBD: __EH_prolog3_GS.LIBCMT ref: 00445EC7
Part of subcall function 00445EBD: memset.MSVCRT ref: 00445F32
Part of subcall function 00445EBD: PathStripPathW.SHLWAPI(?,?,00000104,00000058), ref: 00445F56
Part of subcall function 00445EBD: #1165.MFC42U(?,00000000), ref: 00445F70

#1165.MFC42U ref: 00448D1A

Part of subcall function 00441AC7: __EH_prolog3.LIBCMT ref: 00441ACE

memset.MSVCRT ref: 00448D46
#1165.MFC42U(?,00000000,?,?,00000000,00000058), ref: 00448D72

Strings

%08x, xrefs: 00448D52
CNotebookDoc::PreOnCloseDocument, xrefs: 00448CC3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3H_prolog3_Pathmemset$Strip
String ID: %08x$CNotebookDoc::PreOnCloseDocument
API String ID: 363853345-608553358
Opcode ID: 1e2dc9a49083c0b6ed35522ca3f51ddf26899938cad0c9f18caf95be3fd43cf5
Instruction ID: 99b38ec68d208de8e171ead3a710905c466b168a1b5193a7e31f3fbfd3f9bc29
Opcode Fuzzy Hash: 1e2dc9a49083c0b6ed35522ca3f51ddf26899938cad0c9f18caf95be3fd43cf5
Instruction Fuzzy Hash: 632195B1E012289FEB20DBB1C845EEEB774AF04704F15406EE915A7292DB789D04CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00426BB4, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(0E0227DC), ref: 00426C00
#2854.MFC42U(00000000), ref: 00426C07
#3215.MFC42U ref: 00426C0F
PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 00426C45
ReleaseDC.USER32 ref: 00426C64

Part of subcall function 004AEC85: SelectObject.GDI32(?,00000000), ref: 004AECAA
Part of subcall function 004AEC85: GetLastError.KERNEL32(?,?,005A0049), ref: 004AECB6

Strings

CSplitWnd::OnInvertTracker, xrefs: 00426BEF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2854#3215ErrorLastObjectReleaseSelect
String ID: CSplitWnd::OnInvertTracker
API String ID: 3138939772-467936217
Opcode ID: 26a8f64e998243552b7be5005f09e8925ad51459a0dd7e8a08c3aeaeb7a0f1f0
Instruction ID: 8fe72a57f7e26a000ede649c5f244c6acf106adadd714ed4777c2f0f3575240a
Opcode Fuzzy Hash: 26a8f64e998243552b7be5005f09e8925ad51459a0dd7e8a08c3aeaeb7a0f1f0
Instruction Fuzzy Hash: 39217472204641AFC714DF65DD85E66BBE9FB88710B04863EF559832A0DF35EC00CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00450B48, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00450B4F
#1165.MFC42U(CItemPicker::CreatePickerWnd,00000000,0000003C,00456B08,004570B7,MSNB_IP_IPWC,00000000,004570B7,?,?,00000000,?,CImagePicker::CreateImagePicker,00000000,00000010,004584F3), ref: 00450B6F
GetWindowLongW.USER32(00000000,000000EC), ref: 00450B7D
GetClassInfoW.USER32 ref: 00450B94
RegisterClassW.USER32 ref: 00450BC9

Strings

CItemPicker::CreatePickerWnd, xrefs: 00450B5E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$#1165H_prolog3InfoLongRegisterWindow
String ID: CItemPicker::CreatePickerWnd
API String ID: 827250693-3281833989
Opcode ID: 93db69c0495b4c8d2f4fa1a3c96be4ea2ba2a7a33e759bc790395635521110dd
Instruction ID: 7d7c9e82e5848f5de242122db66d721d3e58b6dee0615b563ba74bd9300d1301
Opcode Fuzzy Hash: 93db69c0495b4c8d2f4fa1a3c96be4ea2ba2a7a33e759bc790395635521110dd
Instruction Fuzzy Hash: EC2126B1900209ABDB14DFA5DC85AEEBBB9EF48715F10402EF506B7290CB389905CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004599F2, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004599F9
#5878.MFC42U(?,0000800F,00000001,?,CNBToolbar::SetHorizontal,00000000,0000001C,00458A9E,?,?,?,?,00000104,00000000), ref: 00459A49
SendMessageW.USER32(?,0000041D,?,?), ref: 00459A6A
#6193.MFC42U(00000000,?,?,00000000,00000000,00000115,?,?,?,?,00000104,00000000), ref: 00459A9F
#6211.MFC42U(00000005,?,?,?,?,00000104,00000000,?,?,?,?,?,0000008B,0000000B), ref: 00459AAF

Strings

CNBToolbar::SetHorizontal, xrefs: 00459A06

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #5878#6193#6211H_prolog3_MessageSend
String ID: CNBToolbar::SetHorizontal
API String ID: 3245263065-705204083
Opcode ID: 7b33f7194f6afc983dc3b67edc414fbb705ef4682a0521da37c05421673a7e51
Instruction ID: 58df2f7a59556f09e7fc4b3154109f435c22a8a2141475a807159f5388d04d9f
Opcode Fuzzy Hash: 7b33f7194f6afc983dc3b67edc414fbb705ef4682a0521da37c05421673a7e51
Instruction Fuzzy Hash: 16217171A011159FCB04CFA8CC84EEABB76FF48304F08407EEA09AB261CB359801CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00484B80, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00484B8A
memset.MSVCRT ref: 00484BC6
#1165.MFC42U(00000000,0E0227DC), ref: 00484BDE

Part of subcall function 004659D3: __EH_prolog3.LIBCMT ref: 004659DA
Part of subcall function 004659D3: lstrlenW.KERNEL32(00000003,00000010,0047A43B,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?), ref: 00465A35

tolower.MSVCRT ref: 00484C11
tolower.MSVCRT ref: 00484C1A

Strings

CViewMgr::GetStoredViewLocation, xrefs: 00484B99

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: tolower$#1165H_prolog3H_prolog3_lstrlenmemset
String ID: CViewMgr::GetStoredViewLocation
API String ID: 1077527790-2940447330
Opcode ID: 180f82f53fe39ad2281fedfd4362d2f45c3bdab3967d8de59e32d937c84df701
Instruction ID: b846eae426403699be76fc86fb87651c7cfe5bd21031ed6075b439ad997d9417
Opcode Fuzzy Hash: 180f82f53fe39ad2281fedfd4362d2f45c3bdab3967d8de59e32d937c84df701
Instruction Fuzzy Hash: 901189729822349BD720AB75DCC8BCF3264AF80310F1505BAE40997190CB788D45CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00434032, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00434039
#1165.MFC42U(CMainFrame::OnInsertFlagOOUI,00000000,00000010,0042D223,?), ref: 00434057
#1165.MFC42U ref: 0043409A
#1165.MFC42U ref: 004340B4
#1165.MFC42U(00000000,000000C2,?,?), ref: 004340E3

Strings

CMainFrame::OnInsertFlagOOUI, xrefs: 00434040

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CMainFrame::OnInsertFlagOOUI
API String ID: 3111753120-1633289531
Opcode ID: 41554d070cc140b6bf90221806f2d3868fed34cc65cdb63083573658c9debb07
Instruction ID: 7fa4b1dc56db4e7e5a9cd6695bb2a1b83b22a7ffb85c8d33b497018292ba50cc
Opcode Fuzzy Hash: 41554d070cc140b6bf90221806f2d3868fed34cc65cdb63083573658c9debb07
Instruction Fuzzy Hash: 14218731A012159FD714EBA5CC49FEA77B0EB58310F158077E608AB3E1CA7DAD00CE69

Uniqueness

Uniqueness Score: -1.00%

Function 0049598F, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00495996

Part of subcall function 004943BA: __EH_prolog3.LIBCMT ref: 004943C1

Part of subcall function 00494A7F: WritePrivateProfileStringW.KERNEL32(?,00000000,?,?), ref: 00494AC4
Part of subcall function 00494A7F: GetLastError.KERNEL32 ref: 00494ACE

Strings

AutoSaveFile, xrefs: 004959FC
TRUE, xrefs: 004959BD
CActiveFileList::_SetData, xrefs: 004959AC
Present, xrefs: 004959E0
Flags, xrefs: 00495A34

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorH_prolog3H_prolog3_LastPrivateProfileStringWrite
String ID: AutoSaveFile$CActiveFileList::_SetData$Flags$Present$TRUE
API String ID: 3453314896-1801772736
Opcode ID: 84423be000199d6d55db62cdac6be7a69403a34835b6bbe234ba65f71e7a6690
Instruction ID: c2622839f1e9d13683d0c795ccb4c7840142e4da2b5047f08a31d6ef26006484
Opcode Fuzzy Hash: 84423be000199d6d55db62cdac6be7a69403a34835b6bbe234ba65f71e7a6690
Instruction Fuzzy Hash: D0116D71D012288BCF11EF95C851AEDBAB6AB88B14F04423AED04BB241C7385D4287BD

Uniqueness

Uniqueness Score: -1.00%

Function 00441066, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004410A3
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,CNotebookApp::_ResetCurrentDirectory,00000000), ref: 004410B9
PathRemoveFileSpecW.SHLWAPI(?,?,CNotebookApp::_ResetCurrentDirectory,00000000), ref: 004410CA
SetCurrentDirectoryW.KERNEL32(?,?,CNotebookApp::_ResetCurrentDirectory,00000000), ref: 004410D7
GetLastError.KERNEL32(?,CNotebookApp::_ResetCurrentDirectory,00000000), ref: 004410F3

Strings

CNotebookApp::_ResetCurrentDirectory, xrefs: 0044107D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CurrentDirectoryErrorLastModuleNamePathRemoveSpecmemset
String ID: CNotebookApp::_ResetCurrentDirectory
API String ID: 1061634109-110754422
Opcode ID: 1c32535eb8b1763bd6c59373fac3cbae6c7b98503f3ba7b2e0d248fccc881b0f
Instruction ID: 7c13e2797a86905371f5974868a7f5d339ae29191c64f05eb04c7476dab55782
Opcode Fuzzy Hash: 1c32535eb8b1763bd6c59373fac3cbae6c7b98503f3ba7b2e0d248fccc881b0f
Instruction Fuzzy Hash: 3011757064020C9BEB50DB65DD89FEA7778BB14304F4004AAE605D71A1DB78DA84CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00479295, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047929C
WaitForSingleObject.KERNEL32(?,000000FF,Helpers::WaitForSingleObject,?,CThreadMgr::SetThreadAbort,00000000,CThreadMgr::AbortThread,?,00000020,0047CD7A,?), ref: 004792F6
GetLastError.KERNEL32 ref: 00479301

Strings

Helpers::WaitForSingleObject, xrefs: 004792E9
CThreadMgr::AbortThread, xrefs: 004792A9
CThreadMgr::SetThreadAbort, xrefs: 004792BA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorH_prolog3LastObjectSingleWait
String ID: CThreadMgr::AbortThread$CThreadMgr::SetThreadAbort$Helpers::WaitForSingleObject
API String ID: 1274566506-561853299
Opcode ID: 92f3ccfc41fda8637e9d8d9f6c817c20f9b6c07cf38083f582e965610fa07b90
Instruction ID: facee20696831fa229d14fbc353719856a4bec55c00c1c2f9cddaa783bdaf89c
Opcode Fuzzy Hash: 92f3ccfc41fda8637e9d8d9f6c817c20f9b6c07cf38083f582e965610fa07b90
Instruction Fuzzy Hash: F421C3709001099BDB04EF62C941AFE7374AF14318F20856FE925A72D1DB3E9E46CB79

Uniqueness

Uniqueness Score: -1.00%

Function 00457451, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0045745B
SendMessageW.USER32(?,00000410,?,00000000), ref: 00457499
SendMessageW.USER32(?,00000427,00000000,?), ref: 004574A7
SendMessageW.USER32(?,0000040B,?,00000064), ref: 00457513

Strings

d, xrefs: 004574AB
CNBReBar::SetBandSizeAndStyle, xrefs: 0045747A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$H_prolog3_
String ID: CNBReBar::SetBandSizeAndStyle$d
API String ID: 3491702567-3834303100
Opcode ID: cdbb82c85507dcc7f13930f5779d4b17c462d794deaeeea036b6de43406621d3
Instruction ID: 87995a5e2c7cc7ffc3bf08cee0d2087ea4ec0dd49ca1ec89d1d795ab6f36df7c
Opcode Fuzzy Hash: cdbb82c85507dcc7f13930f5779d4b17c462d794deaeeea036b6de43406621d3
Instruction Fuzzy Hash: C4212871910119EBDF10DFA9CC85ADD7BB4FF08304F0080AAFA48A7252CB759995CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004AC098, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004AC09F
#1165.MFC42U(CJournalNotificationWnd::SetJournalNotification,00000000,CJournalNotification::Init,00000000,00000028,004AC1DB,?,GetJournalNotification,00000000,00000014,004AC27D,ShowJournalNotification,?,0E0227DC,?), ref: 004AC0D5
#6437.MFC42U(08000080,00000000,00000000,C0000000,?,?,00000000,00000000,CJournalNotificationWnd::Create,00000000,?,GetJournalNotification,00000000,00000014,004AC27D,ShowJournalNotification), ref: 004AC128

Strings

CJournalNotificationWnd::Create, xrefs: 004AC0DC
CJournalNotification::Init, xrefs: 004AC0AC
CJournalNotificationWnd::SetJournalNotification, xrefs: 004AC0B7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#6437H_prolog3_
String ID: CJournalNotification::Init$CJournalNotificationWnd::Create$CJournalNotificationWnd::SetJournalNotification
API String ID: 3443349129-639404303
Opcode ID: bfb0932708659a54187170db86bdd13cef4ff351d8b6b746403b3588a4219b6e
Instruction ID: 0cbfe3bb8f22e6621ae986365891b7602bb3e794e4bb9744184cec3e4bde0fc7
Opcode Fuzzy Hash: bfb0932708659a54187170db86bdd13cef4ff351d8b6b746403b3588a4219b6e
Instruction Fuzzy Hash: 3D1163B1D01208AFD744EBA5CC85FEDB7B49B15308F14806EF915A3241DB395E44CB78

Uniqueness

Uniqueness Score: -1.00%

Function 0044D0EA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044D0F1
#1165.MFC42U(CNotebookView::ToggleFullScreenMode,?,00000014,0042AB7E,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 0044D11A
#1165.MFC42U ref: 0044D12F
#3792.MFC42U ref: 0044D137

Part of subcall function 0044D193: __EH_prolog3.LIBCMT ref: 0044D19A
Part of subcall function 0044D193: #1165.MFC42U(CNotebookView::SetFullScreenMode,00000000,00000008,0044D155,00000000), ref: 0044D1C0
Part of subcall function 0044D193: #1165.MFC42U(00000001), ref: 0044D1CF
Part of subcall function 0044D193: #5848.MFC42U(?,00000001), ref: 0044D1DA
Part of subcall function 0044D193: #5977.MFC42U(?,00000001), ref: 0044D1E3

#1165.MFC42U(00000000), ref: 0044D158

Part of subcall function 0044F12D: __EH_prolog3.LIBCMT ref: 0044F134

Part of subcall function 00459C54: __EH_prolog3_GS.LIBCMT ref: 00459C5E
Part of subcall function 00459C54: SendMessageW.USER32(?,00000146,00000000,00000000), ref: 00459CA9
Part of subcall function 00459C54: SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00459CD2
Part of subcall function 00459C54: SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00459D08
Part of subcall function 00459C54: memset.MSVCRT ref: 00459D35
Part of subcall function 00459C54: #6195.MFC42U(?,?,?,?,?,?,00000000,0E0227DC), ref: 00459D64

Strings

CNotebookView::ToggleFullScreenMode, xrefs: 0044D103

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3MessageSend$#3792#5848#5977#6195H_prolog3_memset
String ID: CNotebookView::ToggleFullScreenMode
API String ID: 2713991477-4018342658
Opcode ID: 27c3ca0228fe3ff84657d636e66a3bdf9a9e65f010cd48a3d38cad533aaa1dd2
Instruction ID: e7f0449232ca8223f57bc7fcccb9625a5d5e26f8eba1749bac72eeca6cb94221
Opcode Fuzzy Hash: 27c3ca0228fe3ff84657d636e66a3bdf9a9e65f010cd48a3d38cad533aaa1dd2
Instruction Fuzzy Hash: F0117C72A111149FEF04EB65CD59FAE77A4AF04314F0540AAE805EB2A1DA78EE04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004863F7, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004863FE
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 00486425
#6697.MFC42U(00000020), ref: 00486450
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00000000,000000FF), ref: 0048646A

Strings

, xrefs: 00486430
CTOCView::_FindPathInScopeBox, xrefs: 0048640B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #6697CompareH_prolog3MessageSendString
String ID: $CTOCView::_FindPathInScopeBox
API String ID: 3332013766-4294437300
Opcode ID: f0159a4424d3dee8e9c05186d9fcc847a87e12e095c3db9677c416706b65fc56
Instruction ID: d1aef3103f2a20d4d45906389fcc3f88ca4def00fa169a8a4522dcf659611acc
Opcode Fuzzy Hash: f0159a4424d3dee8e9c05186d9fcc847a87e12e095c3db9677c416706b65fc56
Instruction Fuzzy Hash: 33119170901225DBCF149F95CC49BEE7B70FF15714F10062AF516AB2D0DB785941CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0049430D, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00494314
PathFileExistsW.SHLWAPI(00000000,CNBFileSettings::~CNBFileSettings,00000000,0000000C,0048F6F4,00000000), ref: 0049433C
GetFileAttributesW.KERNEL32(00000000), ref: 0049434A
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 00494357

Strings

CNBFileSettings::~CNBFileSettings, xrefs: 00494324
,TD, xrefs: 0049431D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Attributes$ExistsH_prolog3Path
String ID: ,TD$CNBFileSettings::~CNBFileSettings
API String ID: 2271883362-4128598810
Opcode ID: e9b188aa0a3a6afcef708829ca8f8e5d71a072cd26176113e7b088829baf9ead
Instruction ID: ce738cea465545f8a6d0607adf417c995e52674dcd5a595ff1ede209d6627ef2
Opcode Fuzzy Hash: e9b188aa0a3a6afcef708829ca8f8e5d71a072cd26176113e7b088829baf9ead
Instruction Fuzzy Hash: 5B118230500601DFCB249F22C849EAABBE1BF80305F10847FE49A86670CB39A882DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004791EB, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004791F2
#1105.MFC42U(0047D75E,00000000,00000000,00000000,00000000,00000000,CThreadMgr::AddThread,00000000,0000001C,0047D3F8,?,?,?,CNotebookDocPrint::OnPrint,?,000003D8), ref: 00479224
#1165.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 00479249

Part of subcall function 00479106: __EH_prolog3.LIBCMT ref: 0047910D
Part of subcall function 00479106: #2606.MFC42U(CThreadMgr::Init,00000000,0000000C,0047923C,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324), ref: 00479133

Strings

CThreadMgr::AddThread, xrefs: 004791FF
CNotebookApp::PreThreadCleanup, xrefs: 0047925E
CNotebookApp::OnNewThread, xrefs: 00479250

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1105#1165#2606
String ID: CNotebookApp::OnNewThread$CNotebookApp::PreThreadCleanup$CThreadMgr::AddThread
API String ID: 3430840539-2061625477
Opcode ID: 47c36bb4421d191ad59a21a518310dbb4b5c41451e810206dc5cf4262753de1f
Instruction ID: f25843acfeec5a63642d116f20b115194966c09bac14eab49ec6961bf89e6868
Opcode Fuzzy Hash: 47c36bb4421d191ad59a21a518310dbb4b5c41451e810206dc5cf4262753de1f
Instruction Fuzzy Hash: 32115E31500205ABCB24EFA2CC45DEFBB74FF95704B40486FE52667291DB78A905CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0045F2BA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045F2C1
#616.MFC42U(CPenSettingsPage::~CPenSettingsPage,00000000,0000000C,00461537,CInkSettingsPropSheet::~CInkSettingsPropSheet,00000000,0000000C,00430F98), ref: 0045F33D
#609.MFC42U ref: 0045F34D
#692.MFC42U ref: 0045F35C
#768.MFC42U ref: 0045F368

Strings

CPenSettingsPage::~CPenSettingsPage, xrefs: 0045F2D7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #609#616#692#768H_prolog3
String ID: CPenSettingsPage::~CPenSettingsPage
API String ID: 3656527247-149202764
Opcode ID: d0d9c5bd271f9efca3e2872f0a015de7cfe225005da67b80e25600c3659a15ba
Instruction ID: 3af4fb5a7bdafbb56f79613586f1f4bed987b5c86873bf1ae16cba88b93aff46
Opcode Fuzzy Hash: d0d9c5bd271f9efca3e2872f0a015de7cfe225005da67b80e25600c3659a15ba
Instruction Fuzzy Hash: 21218C30601746DFD714DFA5C499BEEBBB0AF08308F1004AEE56A97291CB742A04CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00460493, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046049A
#616.MFC42U(CHighlightSettingsPage::~CHighlightSettingsPage,00000000,0000000C,00461528,CInkSettingsPropSheet::~CInkSettingsPropSheet,00000000,0000000C,00430F98), ref: 00460516
#609.MFC42U ref: 00460526
#692.MFC42U ref: 00460535
#768.MFC42U ref: 00460541

Strings

CHighlightSettingsPage::~CHighlightSettingsPage, xrefs: 004604B0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #609#616#692#768H_prolog3
String ID: CHighlightSettingsPage::~CHighlightSettingsPage
API String ID: 3656527247-157979435
Opcode ID: 2314ec8c9bea5daba079bf53afd3825a0b244284a7e40e82082f7cd8c64cbc90
Instruction ID: bfb92e9531e525824b9681f0d641e115ea24aa28a6aac2fee40ae7f64d5269a5
Opcode Fuzzy Hash: 2314ec8c9bea5daba079bf53afd3825a0b244284a7e40e82082f7cd8c64cbc90
Instruction Fuzzy Hash: D4215C70601706DFDB24DFA5C499BEEBBA0BF09308F1044AEE16B97291DB742A44CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047C09E, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047C0A5
#1165.MFC42U(G_FileAllowedInMRU,00000000,0000000C,00445C09), ref: 0047C0C3

Part of subcall function 004924F0: __EH_prolog3.LIBCMT ref: 004924F7
Part of subcall function 004924F0: lstrlenW.KERNEL32(?,CNBNotebook::IsExcludableTempFile,00000000,00000008,0047C0D8), ref: 00492519

Part of subcall function 0047C044: SHGetSettings.SHELL32(?,00000001), ref: 0047C069
Part of subcall function 0047C044: GetFileAttributesW.KERNEL32(?), ref: 0047C079

PathFindExtensionW.SHLWAPI ref: 0047C0F2
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,.jnt,000000FF), ref: 0047C111

Strings

G_FileAllowedInMRU, xrefs: 0047C0AE
.jnt, xrefs: 0047C105

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165AttributesCompareExtensionFileFindPathSettingsStringlstrlen
String ID: .jnt$G_FileAllowedInMRU
API String ID: 2258506413-2903718611
Opcode ID: 0331f3ef81a27c803a546863746861d07c3dc4324904901bb08fcc29ae42421e
Instruction ID: 01ead7ea6452501d956ac5543c0149f5b24e5dfbc9231dbe60cd088aef46148d
Opcode Fuzzy Hash: 0331f3ef81a27c803a546863746861d07c3dc4324904901bb08fcc29ae42421e
Instruction Fuzzy Hash: 9C01F7313101106BDB1467A6CC8BBFE3251AF45B20F94427EF61AA72D3DEAC6C45C65C

Uniqueness

Uniqueness Score: -1.00%

Function 0048608A, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00486091
#3087.MFC42U(000003F4,CTOCView::_UpdateNavButtons,00000000,00000014,004872BF,CTOCView::_Repopulate,00000000,0000000C,004855EE), ref: 004860C8
#3087.MFC42U(000003F3), ref: 004860D5
#2634.MFC42U(00000001), ref: 00486103
#2634.MFC42U(00000001), ref: 00486109

Strings

CTOCView::_UpdateNavButtons, xrefs: 004860A1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2634#3087$H_prolog3
String ID: CTOCView::_UpdateNavButtons
API String ID: 707104217-1289320478
Opcode ID: ea864dfb182500db3be7fdbb608159c64cebe59b33729026be3554263b832b7b
Instruction ID: 7020b2eafb4f6431a165b8d0486fb2073741fdeb3da935d99c66993952b14165
Opcode Fuzzy Hash: ea864dfb182500db3be7fdbb608159c64cebe59b33729026be3554263b832b7b
Instruction Fuzzy Hash: EB01AD31E0012A8BCF04EBA58C519FF77B5AF89700F05047FE606A3281CB796A01CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0046E8FB, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046E902
#3087.MFC42U(000003FF,00000000,000003FF,0000DAC4,CSrchChevronButton::SetTrianglesUp,00000000,CSimpleFindDialog::_UpdateMoreButton,00000000,00000014,0046E465,?,00000000,00000000,0E0227DC), ref: 0046E98B
#2634.MFC42U(?,00000000,00000000,0E0227DC), ref: 0046E993

Strings

CSrchChevronButton::SetTrianglesUp, xrefs: 0046E939
CSimpleFindDialog::_UpdateMoreButton, xrefs: 0046E90B
eF, xrefs: 0046E910

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2634#3087H_prolog3
String ID: CSimpleFindDialog::_UpdateMoreButton$CSrchChevronButton::SetTrianglesUp$eF
API String ID: 3515138675-2993829241
Opcode ID: 5c4347057098537da8a0a2c7e750a1ede34f72d42a846300ba057c8f000438ae
Instruction ID: b2779372f30cb274fb9e52adcf0b7749981fb9675484a480c432c728a804b4d8
Opcode Fuzzy Hash: 5c4347057098537da8a0a2c7e750a1ede34f72d42a846300ba057c8f000438ae
Instruction Fuzzy Hash: F201D2317002049BDB14F7B3CC5ABEE22A4AF49728F40003EA216672D2DF7D6804C72A

Uniqueness

Uniqueness Score: -1.00%

Function 0042B620, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042B627
#3792.MFC42U(CMainFrame::GetWindowPlacement,00000000,00000008,00465486,?), ref: 0042B64F
#1165.MFC42U ref: 0042B65C

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

memset.MSVCRT ref: 0042B680
#3865.MFC42U(00000000), ref: 0042B68D

Strings

CMainFrame::GetWindowPlacement, xrefs: 0042B634

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#3792#3865H_prolog3memcpymemset
String ID: CMainFrame::GetWindowPlacement
API String ID: 2094452958-885237186
Opcode ID: f4a9dda8e1f6b85b2ac3ad3669962ffee9c47aa29de25f59e00965466c278136
Instruction ID: e7547dca206d45edffc5d753e6d3df4c9b94863a7262b4a97904892fa9c7c056
Opcode Fuzzy Hash: f4a9dda8e1f6b85b2ac3ad3669962ffee9c47aa29de25f59e00965466c278136
Instruction Fuzzy Hash: 5E01A235701220ABD710AB629D49BAF6B25DF59B04F50403FF906AB292DF6C890587BF

Uniqueness

Uniqueness Score: -1.00%

Function 004928D9, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004928E0
#521.MFC42U(?,00000000,CNBNotebook::_RefreshMRUFolderContents,?,00000018,00492999,?,CNBNotebook::InitializeMRUFolders,?,00000010,004404D2,00000000), ref: 00492907
#4162.MFC42U(000000FF,?,CNBNotebook::InitializeMRUFolders,?,00000010,004404D2,00000000), ref: 00492916

Part of subcall function 00491253: __EH_prolog3_GS.LIBCMT ref: 0049125D

#6303.MFC42U(00000000,?,CNBNotebook::InitializeMRUFolders,?,00000010,004404D2,00000000), ref: 00492930
#6303.MFC42U(?,CNBNotebook::InitializeMRUFolders,?,00000010,004404D2,00000000), ref: 0049293B

Strings

CNBNotebook::_RefreshMRUFolderContents, xrefs: 004928ED

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #6303$#4162#521H_prolog3H_prolog3_
String ID: CNBNotebook::_RefreshMRUFolderContents
API String ID: 962892091-1648838709
Opcode ID: 4680afe26ff9038bb4cd1a16ba4595acceca1123cd7cb4e78fe0452cc0254da7
Instruction ID: 2ad714c650dc878ea07f998fb90433eab5759f176b998899dc4a15ab0edf886e
Opcode Fuzzy Hash: 4680afe26ff9038bb4cd1a16ba4595acceca1123cd7cb4e78fe0452cc0254da7
Instruction Fuzzy Hash: 59015A71C00119ABCB00EBA1CC819EDBBB4AF18314B5044AEE41273280DB796A09CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00435867, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043586E
#1165.MFC42U(CBootCleanup::~CBootCleanup,00000000,00000014,00440093), ref: 00435892
#1165.MFC42U ref: 004358A1
#1165.MFC42U(CPgIpc::IsRegistered,00000000), ref: 004358C6

Part of subcall function 0044FA2C: __EH_prolog3.LIBCMT ref: 0044FA33
Part of subcall function 0044FA2C: #521.MFC42U(00000000,CPgIpc::Unregister,00000000,0000001C,0042B85D), ref: 0044FA5E

Strings

CPgIpc::IsRegistered, xrefs: 004358A4
CBootCleanup::~CBootCleanup, xrefs: 0043587B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$#521
String ID: CBootCleanup::~CBootCleanup$CPgIpc::IsRegistered
API String ID: 1249166615-1568007928
Opcode ID: 768eaa0ca62b96727377652788411defcfc73a47eb84aaf16b537494b93c31e8
Instruction ID: e349fa5d69f12d55afdfa921c8b3792000091e4193b6f90018027b91756e575c
Opcode Fuzzy Hash: 768eaa0ca62b96727377652788411defcfc73a47eb84aaf16b537494b93c31e8
Instruction Fuzzy Hash: 3EF062315001498FCB04FFA2CC959EDB7B4AF54318F1540BE9505272A2DB79AD45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00475E36, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00475E3D
#324.MFC42U(000000B2,00000000,00000008,0044BCA6), ref: 00475E4E
#567.MFC42U ref: 00475E67
#567.MFC42U ref: 00475E7C
#567.MFC42U ref: 00475E90

Strings

CTemplateSaveDlg::CTemplateSaveDlg, xrefs: 00475EA4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$#324H_prolog3
String ID: CTemplateSaveDlg::CTemplateSaveDlg
API String ID: 3217428371-215651796
Opcode ID: 4a7bbce38e5397a3b5515d4935287358f49d5cae7c6774a73c4afdff83a4d84f
Instruction ID: 00bf929f19afc909a6914ec5418fff68442678a40900233922f0ac7492f7f32e
Opcode Fuzzy Hash: 4a7bbce38e5397a3b5515d4935287358f49d5cae7c6774a73c4afdff83a4d84f
Instruction Fuzzy Hash: F7014F306013049BDB01EF51C8857ECB7A0BF55304F5144AED9456B2C2CBB91E09CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004929B5, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004929BC
#521.MFC42U(?,00000000,CNBNotebook::OnPreClose,?,0000001C,0044123A,CNotebookApp::_UnInitFileMgr,00000000,00000000), ref: 004929EA
#4162.MFC42U(000000FF), ref: 004929F9
#6303.MFC42U ref: 00492A08
#6303.MFC42U ref: 00492A13

Strings

CNBNotebook::OnPreClose, xrefs: 004929C9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #6303$#4162#521H_prolog3
String ID: CNBNotebook::OnPreClose
API String ID: 957012806-1730889315
Opcode ID: 64700635b179ee0dbfd79321eb71b70b8bbb7242e09bb2e85cc7a49c0ea90f3d
Instruction ID: 20af73cbe0eb713c83d51699c3efd8221cc730a5fded3c3a62747c9a192e0561
Opcode Fuzzy Hash: 64700635b179ee0dbfd79321eb71b70b8bbb7242e09bb2e85cc7a49c0ea90f3d
Instruction Fuzzy Hash: 44016D7180124DEFCB00EBA1CC809EDBBB4AF18324F54406EE41273291DB786A09DB25

Uniqueness

Uniqueness Score: -1.00%

Function 0044DC11, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044DC18
#6211.MFC42U(00000005,CNotebookView::ShowViewer,00000000,00000008,0044D554,00000000,CNotebookView::OnCloseDocument,00000000,0000000C,0044976C), ref: 0044DC44
#1165.MFC42U ref: 0044DC4A
#5848.MFC42U(?,00000001), ref: 0044DC59
#6211.MFC42U(00000000,CNotebookView::ShowViewer,00000000,00000008,0044D554,00000000,CNotebookView::OnCloseDocument,00000000,0000000C,0044976C), ref: 0044DC63

Strings

CNotebookView::ShowViewer, xrefs: 0044DC21

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #6211$#1165#5848H_prolog3
String ID: CNotebookView::ShowViewer
API String ID: 3454534450-1699460276
Opcode ID: 13e3139cb985e0f82a62cbcc36bb464e726fbd1a02e2577ee2c09bef3b71dbfd
Instruction ID: a276c7c764b0bbbeb68b79ca249c1e9ce40698b827a66fee084af2723effa206
Opcode Fuzzy Hash: 13e3139cb985e0f82a62cbcc36bb464e726fbd1a02e2577ee2c09bef3b71dbfd
Instruction Fuzzy Hash: F3F06D346102019BD704EB61CD9ABA937B0BB14706F10407FA546E71D1DFB8A904CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00444A5E, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00444A65
#609.MFC42U(CTemplateSaveDlg::~CTemplateSaveDlg,00000000,0000000C,0044BE7E), ref: 00444A9F
#609.MFC42U ref: 00444AAB
#609.MFC42U ref: 00444AB4
#641.MFC42U ref: 00444ABC

Strings

CTemplateSaveDlg::~CTemplateSaveDlg, xrefs: 00444A77

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #609$#641H_prolog3
String ID: CTemplateSaveDlg::~CTemplateSaveDlg
API String ID: 3296809873-898202919
Opcode ID: 076ebc0fefc7cf847a0ab79596ba488a0ae1c0df3ed08d82b1bcf0750acf52a4
Instruction ID: 20a4481d11d1c00d8e32d817df51e94dbe005c883c08554b7f1e2cef84125e91
Opcode Fuzzy Hash: 076ebc0fefc7cf847a0ab79596ba488a0ae1c0df3ed08d82b1bcf0750acf52a4
Instruction Fuzzy Hash: 7BF09030900249EEC704EBA1DC567ECBB70BF51314F5041AED416632D1DFB82A09CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00444C0B, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00444C12

Part of subcall function 0044985C: __EH_prolog3.LIBCMT ref: 00449863

#800.MFC42U(CNotebookDoc::~CNotebookDoc,00000000,0000000C,00444BF2), ref: 00444C52
#800.MFC42U ref: 00444C62
#652.MFC42U ref: 00444C6E

Strings

3KD, xrefs: 00444C1C
CNotebookDoc::~CNotebookDoc, xrefs: 00444C28

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #800H_prolog3$#652
String ID: 3KD$CNotebookDoc::~CNotebookDoc
API String ID: 2144456771-812786258
Opcode ID: 8e46cc862545d3290dbd7c434f833ecd494da5c0e205f592867036ac21e1a1d2
Instruction ID: 4a4a1cc273f242e52e02378fdd295dc7d465d5844bbe999ab08bc23def641fb8
Opcode Fuzzy Hash: 8e46cc862545d3290dbd7c434f833ecd494da5c0e205f592867036ac21e1a1d2
Instruction Fuzzy Hash: B2F06230905246EBEB04EB65D9097ECBBB0AF61314F60416EE116631D2DFB81A09DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004A7CFC, Relevance: 9.0, APIs: 6, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A7D03
#800.MFC42U(00000004,004A8651,?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A7D20
#800.MFC42U(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A7D2C
#800.MFC42U(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A7D38
#795.MFC42U(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A7D41
#641.MFC42U(?,?,?,CNotebookApp::ResumeOpenNote,00000000), ref: 004A7D4D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #800$#641#795H_prolog3
String ID:
API String ID: 2599620003-0
Opcode ID: 513f5871a1aa206b9ce7d9d31323fb96bdd448c9a1bc9a92f8558ffc69c5d379
Instruction ID: b306ec5be0b430503dd7163f7f2a3544397669693f642ccf94a054313ba6ecc5
Opcode Fuzzy Hash: 513f5871a1aa206b9ce7d9d31323fb96bdd448c9a1bc9a92f8558ffc69c5d379
Instruction Fuzzy Hash: B8F05E74A01249EFD708EBA4DD197ECFBA4BF55310F10419ED45693291CF742B08CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0044C4FA, Relevance: 9.0, APIs: 6, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C501
#795.MFC42U(00000004,0044C4E7,?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C518
#609.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C528
#609.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C538
#795.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C545
#641.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C551

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #609#795$#641H_prolog3
String ID:
API String ID: 2664589273-0
Opcode ID: 947e3d524c4d2628371bfa01e77977c5ea76d787e0a54ead972555c37df5a6be
Instruction ID: 47ec181065461a90cad634821ee6a1c52cce245d88576923b2324615f90cf3b4
Opcode Fuzzy Hash: 947e3d524c4d2628371bfa01e77977c5ea76d787e0a54ead972555c37df5a6be
Instruction Fuzzy Hash: 70F01734501249DFDB04EFA4D9997EC7B60BB15305F6041BEE8469A292DF740A09CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00450625, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

SetRect.USER32 ref: 004507AA
#1165.MFC42U(?,?,?,?,?,CItemPicker::Init,00000000), ref: 004507D1

Part of subcall function 004AF6EC: LoadStringW.USER32(?,00009CD2,00000000,?), ref: 004AF717
Part of subcall function 004AF6EC: GetLastError.KERNEL32(?,00000000,?,0047A4AB), ref: 004AF723

#1165.MFC42U(?,?,?,?,?,CItemPicker::Init,00000000), ref: 00450837

Strings

CItemPicker::Init, xrefs: 0045065F
W, xrefs: 004508ED

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$ErrorLastLoadRectString
String ID: CItemPicker::Init$W
API String ID: 3608106130-4042895292
Opcode ID: baa029fc1f46d4a3487afbd5c0efd4621b93c93b802dc7cce657bb87ab5162fa
Instruction ID: aa8eee7ad571636a108e2647ad13b71eca4d74749a0854ac91b5d88465142c86
Opcode Fuzzy Hash: baa029fc1f46d4a3487afbd5c0efd4621b93c93b802dc7cce657bb87ab5162fa
Instruction Fuzzy Hash: 21919D75204300DFD729EF25D941B67B7E1EF44315F14882FE9868B2A2DB38E848CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0044EBB0, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044EBB7

Part of subcall function 0042985B: __EH_prolog3.LIBCMT ref: 00429862

#1165.MFC42U(?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044ECB9
#1165.MFC42U(?,00000000,?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044ED39
GetSysColor.USER32(00000008), ref: 0044ED56

Strings

CNotebookView::SetPen, xrefs: 0044EBC7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3$Color
String ID: CNotebookView::SetPen
API String ID: 3808182031-3055791644
Opcode ID: 9703abb0cba702b5792b3e2ca493a22dc8af5bb92e3f43c882fead311103e09f
Instruction ID: f06a1fa2df8c0791ac6d5af7428a5b65aab114ee90ad5f9642aa3e7fdcb89c10
Opcode Fuzzy Hash: 9703abb0cba702b5792b3e2ca493a22dc8af5bb92e3f43c882fead311103e09f
Instruction Fuzzy Hash: 2A9193B190020ADFEB10CF95C844FAEBBB5BF84314F24455AE905AB381DB79ED42CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00462C09, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

#1165.MFC42U(CTextBoxFontDlg::DoModal,00000000,0E0227DC,6DEDD6D0,00000000,00000001), ref: 00462C69

Part of subcall function 0043361A: __EH_prolog3.LIBCMT ref: 00433621
Part of subcall function 0043361A: memset.MSVCRT ref: 00433645
Part of subcall function 0043361A: GetDC.USER32(?), ref: 00433650
Part of subcall function 0043361A: #2854.MFC42U(00000000), ref: 00433657
Part of subcall function 0043361A: GetDeviceCaps.GDI32(?,0000005A), ref: 004336A3
Part of subcall function 0043361A: MulDiv.KERNEL32(?,00000000), ref: 004336B4
Part of subcall function 0043361A: ReleaseDC.USER32 ref: 004336D6

#2508.MFC42U(?,?), ref: 00462D72
#3014.MFC42U(?), ref: 00462D88
#1165.MFC42U ref: 00462D91

Strings

CTextBoxFontDlg::DoModal, xrefs: 00462C54

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#2508#2854#3014CapsDeviceH_prolog3Releasememset
String ID: CTextBoxFontDlg::DoModal
API String ID: 3339334519-2821710130
Opcode ID: 62b2077d3cdf42c2922adaf2ac1f8039a34eb4132210e99406c6411668d0187e
Instruction ID: acaa7a2ee73e16f5d800ead71f5154d9d9d1973d5582b34ecc4e47df4a9d31ea
Opcode Fuzzy Hash: 62b2077d3cdf42c2922adaf2ac1f8039a34eb4132210e99406c6411668d0187e
Instruction Fuzzy Hash: B391FE30504A01ABDB28CF24C6857A73BB1BF85304F04407EEC998B35AE7B99905CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004804A3, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004804AA
GetLastError.KERNEL32(0000104C,00000000,00000000,00000000,CMetaListView::_UpdateItemData,00000000,00000074,00480791,00000000,0E0227DC,00001004,00000000,00000000,CMetaListView::_EnsureDataIsLoaded,00000000,00000018), ref: 004806A3

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

SysFreeString.OLEAUT32(00000000), ref: 00480716

Part of subcall function 0047EAC4: SendMessageW.USER32(?,00000000,?,00000000), ref: 0047EAEA

Strings

CMetaListView::_UpdateItemData, xrefs: 004804B9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$ErrorFreeH_prolog3LastSendStringTrace
String ID: CMetaListView::_UpdateItemData
API String ID: 3221549090-123868742
Opcode ID: e558d84edd9d1ac240090ff34879f54bd1d4b4bf1d8416b7cbc5a949b53117ec
Instruction ID: 77aff3643274289a56877c778186b002184a4d6461469e59a0a3406185b53d1f
Opcode Fuzzy Hash: e558d84edd9d1ac240090ff34879f54bd1d4b4bf1d8416b7cbc5a949b53117ec
Instruction Fuzzy Hash: 6581BF70A102099FDF48EFA5C895BEEBBB4BF44314F10442EE901AB291D778E949CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004902EE, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004902F5

Strings

CNBNotebook::OpenNoteDocument, xrefs: 00490315

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_
String ID: CNBNotebook::OpenNoteDocument
API String ID: 2427045233-2172509690
Opcode ID: b9dd33f79b5c5efc16d82f2eeddbf21b7be4e2410a8de8b12838b08e527f7cc4
Instruction ID: 0053ed4eb30782e35555132cc84b86b160eda5e4f0b35459de324469801d9a8b
Opcode Fuzzy Hash: b9dd33f79b5c5efc16d82f2eeddbf21b7be4e2410a8de8b12838b08e527f7cc4
Instruction Fuzzy Hash: 0A718C71E01218EFCF15CF95D984B9EBBB1AF48710F25446AEA05AB351DB38AC41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00482CC4, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 169registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(0E0227DC,Columns), ref: 00482D36

Strings

SortProperty, xrefs: 00482E58
SortOrder, xrefs: 00482E3F
CMetaListColumnArray::WriteToRegistry, xrefs: 00482CED
Columns, xrefs: 00482D30, 00482D4D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Delete
String ID: CMetaListColumnArray::WriteToRegistry$Columns$SortOrder$SortProperty
API String ID: 1035893169-3532245548
Opcode ID: 7e00a360ddb98d7f939e06dd08e6441e9b51d2686294e9f0262d24c4d7d02172
Instruction ID: 37b6cf97e6b01e4e1713f440c6871153dc2d3c7ac173c0360b5df30bff57e555
Opcode Fuzzy Hash: 7e00a360ddb98d7f939e06dd08e6441e9b51d2686294e9f0262d24c4d7d02172
Instruction Fuzzy Hash: FB516271D003289BDB25EF95C941BAEBBB4AF44714F25452FE909BF241C778AD01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004A20CB, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 167comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A20D2
CoCreateInstance.OLE32(00401180,00000000,00000001,00401150,?,CCorrectionUI::ActivateProfile,6DEDD6D0,0000002C,004A2093), ref: 004A210C
CoCreateInstance.OLE32(00401190,00000000,00000001,00401160,?,?,00000000), ref: 004A2185
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 004A223C

Strings

CCorrectionUI::ActivateProfile, xrefs: 004A20E2

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateInstance$FreeH_prolog3Task
String ID: CCorrectionUI::ActivateProfile
API String ID: 2092684631-1016179693
Opcode ID: 819a15b4632e9141987448fecc0ab65ea1c74aae624fc83e581a239488febeec
Instruction ID: c5050f972d34bc38b4480f15425557ab4002b91c5a3def3fc95f9374e9593042
Opcode Fuzzy Hash: 819a15b4632e9141987448fecc0ab65ea1c74aae624fc83e581a239488febeec
Instruction Fuzzy Hash: 12513A71E0121AAFCB10DF99C984EAEBBB5FF49704F10409AF905BB250D7799D41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004409F4, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 163comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004409FB
CoCreateInstance.OLE32(00404ADC,00000000,00000001,00404AEC,?,CheckInkInstallation,?,0000001C,00440DDC,?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440A3C
CoCreateInstance.OLE32(00404ABC,00000000,00000001,00404ACC,?,?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440A7A
CoCreateInstance.OLE32(00404AAC,00000000,00000001,00404A9C,?,?,00000001,?,00000000,00000000,004D63F0,0E0227DC), ref: 00440A96

Strings

CheckInkInstallation, xrefs: 00440A06

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateInstance$H_prolog3
String ID: CheckInkInstallation
API String ID: 1057929044-3671479951
Opcode ID: 1a356ac6e716ee7e887e0025a1b1c7b13f0b10bfb073caedef4386802741fbf4
Instruction ID: 3b931ba004691ab7420805bfbdb38227b6f6fcce4a5c3b87e82d68491e753431
Opcode Fuzzy Hash: 1a356ac6e716ee7e887e0025a1b1c7b13f0b10bfb073caedef4386802741fbf4
Instruction Fuzzy Hash: F5516D70A013559FEB15CF95C944EAEBB74EF04718F15449AEA04AB2A1C379EC40CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 00428962, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 004254AE: GetDlgCtrlID.USER32 ref: 004254D0
Part of subcall function 004254AE: IsChild.USER32(?,?), ref: 004254DF

GetScrollPos.USER32(?,00000002), ref: 004289E2
GetScrollPos.USER32(?,00000002), ref: 00428A05
SetScrollPos.USER32 ref: 00428A52
SetScrollPos.USER32 ref: 00428AAF

Strings

CSplitWnd::DoScrollBy, xrefs: 00428999

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Scroll$ChildCtrl
String ID: CSplitWnd::DoScrollBy
API String ID: 656700424-1971627441
Opcode ID: 18c803b2aa71576b52faf9f0c3747410b23ccdbb6bb20b81d76e1580b7959b81
Instruction ID: ac9addaef23ef5b7eebcff6ef25e89be6ac0b2c0acbba714e164f69b4b853839
Opcode Fuzzy Hash: 18c803b2aa71576b52faf9f0c3747410b23ccdbb6bb20b81d76e1580b7959b81
Instruction Fuzzy Hash: 4F516831309211AFCB11DF25D844A2FBBE5FB88754F040A2EF896972A1CF34D951CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0044BA23, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044BA2A

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

PropVariantClear.OLE32(?), ref: 0044BAFB
PropVariantClear.OLE32(?), ref: 0044BB5E
SafeArrayDestroy.OLEAUT32(00000000), ref: 0044BB9A

Strings

CNotebookDoc::_SaveFlagData, xrefs: 0044BA39

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ClearPropVariant$#1165ArrayDestroyH_prolog3Safe
String ID: CNotebookDoc::_SaveFlagData
API String ID: 3699095520-2008936400
Opcode ID: 558e77c6e12f5ffa51885490dbfbaae4462598c83cc3ab68dfd8b44ef4ba82b2
Instruction ID: eff558149a028a71a847dc6f48d58e62412a40b53648e68f3900117da9e18b97
Opcode Fuzzy Hash: 558e77c6e12f5ffa51885490dbfbaae4462598c83cc3ab68dfd8b44ef4ba82b2
Instruction Fuzzy Hash: 67512071A0061AEFEB00CFA4C854BEEB7B5FF48705F10051EE501EB250D7B9AA05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0044F33B, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044F342
#1165.MFC42U(CNotebookView::OnUpdateZoomSetting,00000000,00000010,0043078E,?), ref: 0044F35F

Part of subcall function 0044CD38: __EH_prolog3.LIBCMT ref: 0044CD3F

Strings

CNotebookView::OnUpdateZoomSetting, xrefs: 0044F352

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165
String ID: CNotebookView::OnUpdateZoomSetting
API String ID: 2986221888-104983526
Opcode ID: 5122929b66f3414b6d0f6e0487374fe3c4cfa238183308e5f0865a1503cd2a0a
Instruction ID: 0915b351c561a86562a8ab9c04900f50e55408c177739826c9a73e712c3715c7
Opcode Fuzzy Hash: 5122929b66f3414b6d0f6e0487374fe3c4cfa238183308e5f0865a1503cd2a0a
Instruction Fuzzy Hash: 89416D706002069BEB14AF66C99497FB761EF68304B60443FD8569B295CE7CAC0ED72A

Uniqueness

Uniqueness Score: -1.00%

Function 0044805A, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00448061
#1165.MFC42U(CNotebookDoc::PasteFromClipBoard,?,00000038,0042D576,00000000), ref: 004480A4
#1662.MFC42U ref: 004480AD

Part of subcall function 00435657: memset.MSVCRT ref: 0043566C
Part of subcall function 00435657: TraceEvent.ADVAPI32(0E0227DC,00000000,?,00000002,?,00000000), ref: 004356A5

Part of subcall function 0049E743: __EH_prolog3.LIBCMT ref: 0049E74A

Part of subcall function 004481E2: __EH_prolog3_GS.LIBCMT ref: 004481E9
Part of subcall function 004481E2: SetRectEmpty.USER32(?), ref: 0044825C
Part of subcall function 004481E2: #1165.MFC42U(?,00000001), ref: 00448262
Part of subcall function 004481E2: #1165.MFC42U(?,00000001), ref: 00448279

#1165.MFC42U(?,?,?,-0000EF6B,?,00000001), ref: 00448134

Part of subcall function 0042A3DE: __EH_prolog3.LIBCMT ref: 0042A3E5

Strings

CNotebookDoc::PasteFromClipBoard, xrefs: 00448071

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$#1662EmptyEventH_prolog3_RectTracememset
String ID: CNotebookDoc::PasteFromClipBoard
API String ID: 1670301334-1890339911
Opcode ID: 5ab8bb8eafd047c8c2befffd84377320857860a1a4acf105d14038a1222b9df0
Instruction ID: 9b852947c5f1ad53cb3d18074db1b4eca18607a6e15696478452c3ca46239d93
Opcode Fuzzy Hash: 5ab8bb8eafd047c8c2befffd84377320857860a1a4acf105d14038a1222b9df0
Instruction Fuzzy Hash: ED517F70A0120ADFEB01DBA5CD45EFEBBB4BF54304F14406EE501E7241DB78AA05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004A8170, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004A817A

Part of subcall function 004A8D5C: __EH_prolog3.LIBCMT ref: 004A8D63
Part of subcall function 004A8D5C: #324.MFC42U(000000B4,00000000,00000008,004A81BD,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8D74
Part of subcall function 004A8D5C: #567.MFC42U(?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8D87
Part of subcall function 004A8D5C: #567.MFC42U(?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8DA0
Part of subcall function 004A8D5C: #542.MFC42U(0000000A,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8DB8

Part of subcall function 004A8E0A: __EH_prolog3_catch_GS.LIBCMT ref: 004A8E14
Part of subcall function 004A8E0A: memset.MSVCRT ref: 004A8E95
Part of subcall function 004A8E0A: CompareStringW.KERNEL32(0000007F,00000001,?,000000FF,?,000000FF,?,?,?), ref: 004A8EFE
Part of subcall function 004A8E0A: #1001.MFC42U(?), ref: 004A8F1C
Part of subcall function 004A8E0A: #1085.MFC42U(?,?), ref: 004A8F37

Part of subcall function 0049430D: __EH_prolog3.LIBCMT ref: 00494314
Part of subcall function 0049430D: PathFileExistsW.SHLWAPI(00000000,CNBFileSettings::~CNBFileSettings,00000000,0000000C,0048F6F4,00000000), ref: 0049433C
Part of subcall function 0049430D: GetFileAttributesW.KERNEL32(00000000), ref: 0049434A
Part of subcall function 0049430D: SetFileAttributesW.KERNEL32(00000000,00000000), ref: 00494357

#2506.MFC42U(00406594,?,?,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8213

Part of subcall function 004A788D: __EH_prolog3_GS.LIBCMT ref: 004A7897
Part of subcall function 004A788D: memset.MSVCRT ref: 004A78CA

DeleteFileW.KERNEL32(?,?,?,?,00406594,?,?,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A8343

Strings

CNotebookApp::_PrimaryInstanceRecovery, xrefs: 004A81A1
,TD, xrefs: 004A81C8, 004A822D, 004A82CE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: File$#567AttributesH_prolog3H_prolog3_memset$#1001#1085#2506#324#542CompareDeleteExistsH_prolog3_catch_PathString
String ID: ,TD$CNotebookApp::_PrimaryInstanceRecovery
API String ID: 243382298-3420160837
Opcode ID: 13bf04b1376007e384c84cee149293b5edaefb120617f420225cb502487594a3
Instruction ID: bef8d24594d6d4c2790442bec6933c3601a47ce33eebeff64e98b4705944c697
Opcode Fuzzy Hash: 13bf04b1376007e384c84cee149293b5edaefb120617f420225cb502487594a3
Instruction Fuzzy Hash: CF516A309106589EDB24EB61CD94BEDB7B5AF65309F0000EEE40AA2141DF3D5F88CF29

Uniqueness

Uniqueness Score: -1.00%

Function 00493088, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049308F
lstrlenW.KERNEL32(00000000,CNBMRUEnum::_AddEnumItemSorted,00000000,00000010,00493C1B,00000001), ref: 004930D0
lstrlenW.KERNEL32(00000000,00000000), ref: 0049315C
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00000000,000000FF), ref: 0049317D

Part of subcall function 0042A2C9: TraceMessage.ADVAPI32(00000000,0000EF51,0000002B,0041E910,00000064,00969CB0,00000004,00000000,?,004B04F0,00969CB0,0000EF51,00000000,?,?), ref: 0042A2E0

Strings

CNBMRUEnum::_AddEnumItemSorted, xrefs: 0049309C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$CompareH_prolog3MessageStringTrace
String ID: CNBMRUEnum::_AddEnumItemSorted
API String ID: 2763762250-521811257
Opcode ID: 3f70a7b6c78e17df655d33c765d170fd7949ab54d56474b815b3fa86210be1e8
Instruction ID: 9fee745bf6bf1f477720e06bc9afc203e0a3e2648725a4e6cf04889a6db11a3e
Opcode Fuzzy Hash: 3f70a7b6c78e17df655d33c765d170fd7949ab54d56474b815b3fa86210be1e8
Instruction Fuzzy Hash: 2D41B0306002059FCF249F65C886E6A7BB1FB45345F15497FE8269B2A1CB78EE44CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0044EE57, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044EE5E
#1165.MFC42U(CNotebookView::SetTipDimensions,00000000,00000024,0044ED19,?,00000000,?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 0044EED3
#1165.MFC42U(?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044EF58
#1165.MFC42U(?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044EF5A

Strings

CNotebookView::SetTipDimensions, xrefs: 0044EE6B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CNotebookView::SetTipDimensions
API String ID: 3111753120-2981848984
Opcode ID: 2f675efe8a225cdf4c82ef5dbceeab2037b097d109b713142f42aee77bc6ac17
Instruction ID: ebf894804790ffc1ee23684fcfbbe3ce9658d9d3930ca747c0d66ab8998507d3
Opcode Fuzzy Hash: 2f675efe8a225cdf4c82ef5dbceeab2037b097d109b713142f42aee77bc6ac17
Instruction Fuzzy Hash: F7419E71D0122AAFDB04CF91C885EBEBB74FF08714F15409AEA0577291D778AE05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD8E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

#861.MFC42U(?,CMainFrame::OnCopyData,00000000,0E0227DC), ref: 0042DDE6
PostMessageW.USER32(0E0227DC,00008008,00000000,00000000), ref: 0042DE20

Strings

CMainFrame::OnCopyData, xrefs: 0042DDC5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #861MessagePost
String ID: CMainFrame::OnCopyData
API String ID: 2366188421-2980944078
Opcode ID: dfc9f8eca708dff34bc4f682d4f8c6bcf7bd3271031a50faa77aef34282ee316
Instruction ID: 76084065ca44fa65809c6df6a20b1c632f61bd44096e41a821e84d239be48c02
Opcode Fuzzy Hash: dfc9f8eca708dff34bc4f682d4f8c6bcf7bd3271031a50faa77aef34282ee316
Instruction Fuzzy Hash: 3431DE31704610DBCB268F10EC45BA777A0FBA5B14F56457AE9059F2A5CB789801CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00443449, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00443453
SHGetDesktopFolder.SHELL32(?,_GetChildFolderLocation,?,00000338,00443661,?,00000000), ref: 004434C7
StrRetToBufW.SHLWAPI(?,?,?,00000104), ref: 00443520
PathAppendW.SHLWAPI(?), ref: 0044353A

Strings

_GetChildFolderLocation, xrefs: 00443479

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: AppendDesktopFolderH_prolog3_Path
String ID: _GetChildFolderLocation
API String ID: 537087284-3974161431
Opcode ID: 4980bb97c8afef1896246138bd5b4ababf9e6127e75176f3382622015e46ac08
Instruction ID: 4a2f0ab42434bbcec05caeb786af96ae75d54ce1e8a2e6c4a984d39b82605b54
Opcode Fuzzy Hash: 4980bb97c8afef1896246138bd5b4ababf9e6127e75176f3382622015e46ac08
Instruction Fuzzy Hash: DB415471D01239AFDB61DF94D888B9DB778AF48B15F1041EAE908A7210D7789F818FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00449A76, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

#1165.MFC42U(CNotebookDoc::StartAutoSaveTimer,0E0227DC,0E0227DC,00000000,?,00000000,CMainFrame::OnCommand,00000000,0E0227DC), ref: 00449ACF
#1165.MFC42U(?,00000000), ref: 00449B02
#1165.MFC42U ref: 00449B32
GetLastError.KERNEL32(?,00449CA3), ref: 00449B5C

Strings

CNotebookDoc::StartAutoSaveTimer, xrefs: 00449AAB

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$ErrorLast
String ID: CNotebookDoc::StartAutoSaveTimer
API String ID: 4133017469-2249348950
Opcode ID: baea48d9b9b9eb1027725ec3ba6371b0e65e5c1e599dbdf6295c0a2ccf7ff529
Instruction ID: a034ca6b7e7775661b7c4f0d7b13ea187a4576439c9c097808d6d8ae38c97aee
Opcode Fuzzy Hash: baea48d9b9b9eb1027725ec3ba6371b0e65e5c1e599dbdf6295c0a2ccf7ff529
Instruction Fuzzy Hash: 7731CF716043968BE300CF15D980F2BBBE8FB84764F04062FF85187290DB78ED058BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00428562, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00425432: #3087.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00425483

#1130.MFC42U(00000000), ref: 004285CD
GetScrollPos.USER32(?,00000002), ref: 00428606
#6438.MFC42U(?,?,?,?), ref: 00428620
SetScrollPos.USER32 ref: 0042863D

Strings

CSplitWnd::OnMouseWheel, xrefs: 00428594

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Scroll$#1130#3087#6438
String ID: CSplitWnd::OnMouseWheel
API String ID: 1066452192-2827753031
Opcode ID: c312e1aae649fa1719cb19440c5fbc9576c5b32fa09ccf21f767d543694a60e3
Instruction ID: c8a61ff0a63a6d83f021207190f087de45476cae3664feb7b28cd05884738275
Opcode Fuzzy Hash: c312e1aae649fa1719cb19440c5fbc9576c5b32fa09ccf21f767d543694a60e3
Instruction Fuzzy Hash: 2031DC32204701AFC711DF21EC45F2ABBE4FB88714F50092EF952822A0DF75E801CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00432E3B, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00432E45

Part of subcall function 00466E2B: __EH_prolog3_GS.LIBCMT ref: 00466E32
Part of subcall function 00466E2B: #567.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 00466E91
Part of subcall function 00466E2B: GetLocaleInfoW.KERNEL32(00000400,0000000D,?,00000003,CPageSettingsPropSheet::CPageSettingsPropSheet,00000000,?,?,?,?,?,?,00000074,00432E7A,0000EF59), ref: 00466F0F
Part of subcall function 00466E2B: _wtoi.MSVCRT ref: 00466F1D
Part of subcall function 00466E2B: #1165.MFC42U(?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337), ref: 00466F38

#2520.MFC42U(0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00432E84
#1165.MFC42U(?,?,00000000,CPageSettingsPropSheet::Stationery,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00432F0F

Strings

CMainFrame::ShowPageSettings, xrefs: 00432E58
CPageSettingsPropSheet::Stationery, xrefs: 00432E9D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3_$#2520#567InfoLocale_wtoi
String ID: CMainFrame::ShowPageSettings$CPageSettingsPropSheet::Stationery
API String ID: 3107119092-3210762295
Opcode ID: e6af7b6e5beb212aae63b9555fdfb8c2ea6918a9fd2e483cfea50fb540553b29
Instruction ID: be180df396cfa1f1fa81a1f8ce92c3bff37e39e66df33e432371404335fdbc05
Opcode Fuzzy Hash: e6af7b6e5beb212aae63b9555fdfb8c2ea6918a9fd2e483cfea50fb540553b29
Instruction Fuzzy Hash: 4C31B570902159AFEB11DB50CD44EEEBB78AF19708F14449AF40957242C7B89F85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0047F00B, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

SetCursor.USER32(?,CMetaListView::SortItems,00000000,80030104,?,?,?,?,?,CMainFrame::OnSysCommand,00000000,0E0227DC), ref: 0047F03C
SetCursor.USER32(0E0227DC,?,?,?,?,CMainFrame::OnSysCommand,00000000,0E0227DC), ref: 0047F0E9

Part of subcall function 00480911: SendMessageW.USER32(00000000,0000120B,00000000,?), ref: 004809AA

Strings

CMetaListView::_IsSorted, xrefs: 0047F097
CMetaListView::SortItems, xrefs: 0047F023
CMetaListObjectComparator::Init, xrefs: 0047F06A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$MessageSend
String ID: CMetaListObjectComparator::Init$CMetaListView::SortItems$CMetaListView::_IsSorted
API String ID: 2101300310-1779796569
Opcode ID: 363db6d0329e01b4baa884fdeaf511437a78ab36a67333784fe8065b86bc9583
Instruction ID: 4a729b57bb086de6ac8e475595402fd3610f23213a6af55022f38a7bef8c0cbf
Opcode Fuzzy Hash: 363db6d0329e01b4baa884fdeaf511437a78ab36a67333784fe8065b86bc9583
Instruction Fuzzy Hash: C931AF71A00259FFCB14EF56C842AEDB774EF04718F10802BE515A7282DB78AA49CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004339E9, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

#6456.MFC42U(?,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00433A45
#1165.MFC42U(?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00433A50
#3792.MFC42U(?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00433A60
#1165.MFC42U(?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00433A8C

Strings

CMainFrame::OnSettingChange, xrefs: 00433A1A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#3792#6456
String ID: CMainFrame::OnSettingChange
API String ID: 3653592287-379844846
Opcode ID: e1558e37b0ba20bc8df958571c20cd3f5465bee3049f4e67e78da4d53734e92d
Instruction ID: 90176ba16c6d8977b43699227bf636efa5d0c0d46cb1f01633b6c8f969eecc0a
Opcode Fuzzy Hash: e1558e37b0ba20bc8df958571c20cd3f5465bee3049f4e67e78da4d53734e92d
Instruction Fuzzy Hash: 4621B4703002106BD714BF66D996B2B7798EB58725F04112FF885863E2DF6C9D44866E

Uniqueness

Uniqueness Score: -1.00%

Function 0047F344, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047F34B

Strings

`, xrefs: 0047F3A1
CMetaListView::SetGroups, xrefs: 0047F358

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CMetaListView::SetGroups$`
API String ID: 431132790-1621127278
Opcode ID: ce672e967dbef8b20881eefb14d5d331b9e2aad9c46ba790ce61bd2c729e993b
Instruction ID: 710ba138decf07600be298b81cb18865dd45e38070c87a11da0c05d4010d12de
Opcode Fuzzy Hash: ce672e967dbef8b20881eefb14d5d331b9e2aad9c46ba790ce61bd2c729e993b
Instruction Fuzzy Hash: 5531CD719002298BDB21DFA5C844BEF7BB0BB54314F00857BED18AB381C7789949CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004262E9, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,00000000), ref: 00426341

Part of subcall function 00425432: #3087.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00425483

ScreenToClient.USER32 ref: 0042635F
#3792.MFC42U ref: 0042638D
#3792.MFC42U ref: 004263B8

Strings

CSplitWnd::TrackRowSize, xrefs: 00426320

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #3792ClientScreen$#3087
String ID: CSplitWnd::TrackRowSize
API String ID: 2690869150-950547550
Opcode ID: 2bad9d9df98cd61452a590fadb58e8a9011b8ca6f1f22d6f95f79dbc3d0df30f
Instruction ID: 98f55abca233fbf4ef886a47a3193cb22390ab9128ef3c1b1ed13b2c1bced4d0
Opcode Fuzzy Hash: 2bad9d9df98cd61452a590fadb58e8a9011b8ca6f1f22d6f95f79dbc3d0df30f
Instruction Fuzzy Hash: C131CD352086529FC714DF19C884E6BBBE9FF98764F10452EF896C33A1DB34A804CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004263F3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,00000000), ref: 0042644B

Part of subcall function 00425432: #3087.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00425483

ScreenToClient.USER32 ref: 00426469
#3792.MFC42U ref: 00426491
#3792.MFC42U ref: 004264BC

Strings

CSplitWnd::TrackColumnSize, xrefs: 0042642A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #3792ClientScreen$#3087
String ID: CSplitWnd::TrackColumnSize
API String ID: 2690869150-3408652701
Opcode ID: 74051bc0b870f4fcf8429c4d36dae0776fec4da68cdb407e82747ccd6a7c60b7
Instruction ID: ed5d087da1fd17060ed144ca72837ecd6aca24575fee308f517f6d03033474dc
Opcode Fuzzy Hash: 74051bc0b870f4fcf8429c4d36dae0776fec4da68cdb407e82747ccd6a7c60b7
Instruction Fuzzy Hash: 0731D135208651AFC714EF15D884E2BB7E5FF98724F10466EF896833A1DB34E804CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00479C19, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00479C20
GdipGetImageEncodersSize.GDIPLUS(?,?,G_GetCodecClsid,00000000,0000001C,0044B467), ref: 00479C72
GdipGetImageEncoders.GDIPLUS(?,00000000,00000000), ref: 00479CAE
lstrcmpW.KERNEL32(00000030,?), ref: 00479CD3

Strings

G_GetCodecClsid, xrefs: 00479C35

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodersGdipImage$H_prolog3Sizelstrcmp
String ID: G_GetCodecClsid
API String ID: 3585070880-4205719252
Opcode ID: 638ee648c10e5541ba160e88ca09e3c705f979d047f14d8aa1be1e0b8c3af967
Instruction ID: b87d5e2f3cd18f9b34f9d60dc90fec86c414b6e8d2063ccff6164f64f7603811
Opcode Fuzzy Hash: 638ee648c10e5541ba160e88ca09e3c705f979d047f14d8aa1be1e0b8c3af967
Instruction Fuzzy Hash: 16315A72C0021A8FDF12DF9188446EEBAB5FF04304F15412BE91ABB250C7B94E458B99

Uniqueness

Uniqueness Score: -1.00%

Function 0047AB67, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0047ABB6
GetTempFileNameW.KERNEL32(?,00412130,00000000,?,00000000,00000000,?), ref: 0047ABE5
GetLastError.KERNEL32 ref: 0047ABEF
lstrlenW.KERNEL32(?), ref: 0047AC1F

Strings

G_GetNBTempFile, xrefs: 0047AB90

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastNameTemplstrlenmemset
String ID: G_GetNBTempFile
API String ID: 1927630931-4058422756
Opcode ID: f94eb267a2bddfdffdc7a2b2471c5d955067106973f5f4d77cb96743bf17151d
Instruction ID: 6257cdabcf1c968548a407e537615491384a3b0576a47d566011c6eb76dcb443
Opcode Fuzzy Hash: f94eb267a2bddfdffdc7a2b2471c5d955067106973f5f4d77cb96743bf17151d
Instruction Fuzzy Hash: 4821FB32D4113CABCB21DB54DC88BEEB374AB54710F1041EBE90DA7210DB785E958BDA

Uniqueness

Uniqueness Score: -1.00%

Function 004430CF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00443141
#1165.MFC42U ref: 00443177
#1165.MFC42U ref: 00443185
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00443197

Strings

CNotebookApp::_BrowseCallback, xrefs: 0044311E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$MessageSendmemset
String ID: CNotebookApp::_BrowseCallback
API String ID: 3097544716-3525999191
Opcode ID: c7858266093c474d0808b5d8d1b7c9bf5527a6b6ba32c23551dee00e0f34c0c4
Instruction ID: f0b2851d1fd26a0404f7da4a0ae29229407b8aefa367c81b9d1834105a35e39e
Opcode Fuzzy Hash: c7858266093c474d0808b5d8d1b7c9bf5527a6b6ba32c23551dee00e0f34c0c4
Instruction Fuzzy Hash: C321B170204344AFE720DF66DD86E6B73E8EF94B29F00452FF54597290DB389D04CA6A

Uniqueness

Uniqueness Score: -1.00%

Function 00449931, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044993B

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

Part of subcall function 00495315: memset.MSVCRT ref: 00495337

PathGetDriveNumberW.SHLWAPI(?), ref: 00449A06
#1165.MFC42U(?,00000000,00000000), ref: 00449A3C

Strings

CNotebookDoc::AutoSave, xrefs: 0044994B
,TD, xrefs: 00449997

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$DriveH_prolog3_NumberPathmemset
String ID: ,TD$CNotebookDoc::AutoSave
API String ID: 3364642716-4110002099
Opcode ID: abb84bbd5fa4720afa05135d4d53b55fba7341205a70e4cadcfa6d9d262400dd
Instruction ID: ec72625c15bfc840929094a71082c71c22594803ee88c4bde9ce1c58f86f317a
Opcode Fuzzy Hash: abb84bbd5fa4720afa05135d4d53b55fba7341205a70e4cadcfa6d9d262400dd
Instruction Fuzzy Hash: F9317CB19006699FDB20EB61CC85BEEB7B5AF44314F0101EEA509B7241DB396E94CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0048E39D, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0048E3A7
memset.MSVCRT ref: 0048E3DD
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,?), ref: 0048E428
SHFileOperationW.SHELL32(?,?,?,?,?,?,?,?,?,?), ref: 0048E46A

Strings

CNBNote::_DeleteNoteFile, xrefs: 0048E3B7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesH_prolog3_Operationmemset
String ID: CNBNote::_DeleteNoteFile
API String ID: 1195534896-3234317664
Opcode ID: 058599d7a1979accf13992365783ff5e2836055c2a31fd05371b260a9779e6d1
Instruction ID: 43f652d871634f320b85f161a47c2b5d2a7e7fc6b38b56d0096158dafc64e189
Opcode Fuzzy Hash: 058599d7a1979accf13992365783ff5e2836055c2a31fd05371b260a9779e6d1
Instruction Fuzzy Hash: 6731B671900128ABDB20EFA5DC48BDE77B4AF04714F4044EBE908A7291DB78DE858F58

Uniqueness

Uniqueness Score: -1.00%

Function 00428CC7, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

#4078.MFC42U(?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00428D2D
#3490.MFC42U(?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00428D39
#5848.MFC42U(?,00000001,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00428D44

Part of subcall function 00425432: #3087.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00425483

#5977.MFC42U(?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00428D73

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

CSplitWnd::SetActivePane, xrefs: 00428CF8

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #3087#3490#4078#5848#5977MessageTrace
String ID: CSplitWnd::SetActivePane
API String ID: 1957824333-2386778067
Opcode ID: e2c5c8b1d84bf625ad8a35eff1fd05d74e3cadb32f2e667290ca88eb1f101a24
Instruction ID: ea1703648fe7572bb524cc36377e59a643b64285ba4f41c27ba1d680e5f63698
Opcode Fuzzy Hash: e2c5c8b1d84bf625ad8a35eff1fd05d74e3cadb32f2e667290ca88eb1f101a24
Instruction Fuzzy Hash: 3421C1313162109BC72A9F11EE05B6E7BA1EBA4724F90452FF901872E1CF78DC04CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00490C2E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00490C35
lstrcmpiW.KERNEL32(?,00000000), ref: 00490C7E
PathFileExistsW.SHLWAPI(?), ref: 00490C95
#1165.MFC42U ref: 00490C9F

Strings

CNBNotebook::MoveCopyNoteDocument, xrefs: 00490C45

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165ExistsFileH_prolog3Pathlstrcmpi
String ID: CNBNotebook::MoveCopyNoteDocument
API String ID: 227523813-4084424255
Opcode ID: ce5fe097dc295c672ed14c38f63f7d7f78acee6a6951d11fa2526cb07c566011
Instruction ID: 4155c4eabf7914c06c176e32ce72c788307831cf671197d63e80fc049b989bf9
Opcode Fuzzy Hash: ce5fe097dc295c672ed14c38f63f7d7f78acee6a6951d11fa2526cb07c566011
Instruction Fuzzy Hash: 8E216072A012259FDF14DF91D945BBEBB78AF04B14F15012BED05BB251C778AE0087B9

Uniqueness

Uniqueness Score: -1.00%

Function 0046EA45, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

#540.MFC42U(CSimpleFindDialog::_BrowseForPath,00000000,0E0227DC,?,00000000,00000000,?,?,?,?,?,?,?,?,CMainFrame::OnCommand,00000000), ref: 0046EA8E
#4155.MFC42U(0000DAC6), ref: 0046EAB2
SHBrowseForFolderW.SHELL32(?), ref: 0046EAFF
#800.MFC42U ref: 0046EB1A

Strings

CSimpleFindDialog::_BrowseForPath, xrefs: 0046EA7C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #4155#540#800BrowseFolder
String ID: CSimpleFindDialog::_BrowseForPath
API String ID: 650654480-3637273337
Opcode ID: 2b9b9f9604091bc3f1d37ecd9d0f0b84265ca5da85e2c8b908a77c884f0c3e4d
Instruction ID: 07385f2a27247edfc7e6b6be7d3fde8001d573991edbc2389cafeb320260b715
Opcode Fuzzy Hash: 2b9b9f9604091bc3f1d37ecd9d0f0b84265ca5da85e2c8b908a77c884f0c3e4d
Instruction Fuzzy Hash: 583181762083419FC310CF56C884B5BBBE4FBA4725F140A2EF99583290EB75E808CB57

Uniqueness

Uniqueness Score: -1.00%

Function 004299AC, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00429A09
SafeArrayAccessData.OLEAUT32(?,0E0227DC), ref: 00429A33
SafeArrayUnaccessData.OLEAUT32(?), ref: 00429A63
SafeArrayDestroy.OLEAUT32(?), ref: 00429A6D

Strings

CNBDocViewCtrl::GetRiffleRect, xrefs: 004299E8

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$Data$AccessDestroyEmptyRectUnaccess
String ID: CNBDocViewCtrl::GetRiffleRect
API String ID: 2899599939-3308471609
Opcode ID: 7b2ed6afe5584207c829e1ceb6cf797fa38c5eb759291ea77e8f188e461a4d20
Instruction ID: 862b8fd9e8e77a304f5bfc30edf85fb4a97d8f75f92ee6a9763d47ee42f89409
Opcode Fuzzy Hash: 7b2ed6afe5584207c829e1ceb6cf797fa38c5eb759291ea77e8f188e461a4d20
Instruction Fuzzy Hash: D5314A72208741EFC310CF25D845A6ABBE8FB88724F14892EF85987290DB35E805CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00433B06, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00433E61: __EH_prolog3.LIBCMT ref: 00433E68
Part of subcall function 00433E61: #1165.MFC42U(CMainFrame::CancelInProgressInkStroke,?,00000014,0042D999,?,?,?,?,?,?,?,?,?,?,?,004BFB86), ref: 00433E8C
Part of subcall function 00433E61: #1165.MFC42U(?,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00433E99

Part of subcall function 00483C97: __EH_prolog3.LIBCMT ref: 00483C9E

Part of subcall function 004850C0: __EH_prolog3.LIBCMT ref: 004850C7

Part of subcall function 0042BE8C: __EH_prolog3_GS.LIBCMT ref: 0042BE96
Part of subcall function 0042BE8C: #1165.MFC42U(CMainFrame::SaveToolbars,?,000000A4,00432A87,CMainFrame::SetFullScreen,?,00000248,0044D207,00000000), ref: 0042BECF
Part of subcall function 0042BE8C: #540.MFC42U ref: 0042BF2E
Part of subcall function 0042BE8C: #540.MFC42U ref: 0042BF3A
Part of subcall function 0042BE8C: #3792.MFC42U ref: 0042BF42
Part of subcall function 0042BE8C: #2810.MFC42U(?,%s\,FullScreen), ref: 0042BF66
Part of subcall function 0042BE8C: SendMessageW.USER32(?,0000040C,00000000,00000000), ref: 0042BF8F
Part of subcall function 0042BE8C: SendMessageW.USER32(?,0000041C,00000000,00000064), ref: 0042BFB8
Part of subcall function 0042BE8C: #2810.MFC42U(?,%s\%s%s,?,Band,00000000), ref: 0042BFF2

#3792.MFC42U(CMainFrame::OnDisplayChange,00000000,0E0227DC), ref: 00433B7F
#4508.MFC42U(?,?,FullScreen), ref: 00433BC0

Part of subcall function 004328A6: __EH_prolog3_GS.LIBCMT ref: 004328B0
Part of subcall function 004328A6: MonitorFromWindow.USER32(?,00000001), ref: 004328E5
Part of subcall function 004328A6: GetMonitorInfoW.USER32 ref: 004328F3
Part of subcall function 004328A6: SHAppBarMessage.SHELL32(00000004,?), ref: 0043292F
Part of subcall function 004328A6: SetRectEmpty.USER32(?), ref: 00432937
Part of subcall function 004328A6: SHAppBarMessage.SHELL32(00000005,00000024), ref: 0043294B
Part of subcall function 004328A6: CopyRect.USER32 ref: 00432983
Part of subcall function 004328A6: #3916.MFC42U(?), ref: 00432990
Part of subcall function 004328A6: memset.MSVCRT ref: 004329A0
Part of subcall function 004328A6: IsIconic.USER32 ref: 004329AE
Part of subcall function 004328A6: #6191.MFC42U(?), ref: 004329CF

Strings

FullScreen, xrefs: 00433BA2
CMainFrame::OnDisplayChange, xrefs: 00433B3D
Normal, xrefs: 00433BAB, 00433BB0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$#1165H_prolog3$#2810#3792#540H_prolog3_MonitorRectSend$#3916#4508#6191CopyEmptyFromIconicInfoWindowmemset
String ID: CMainFrame::OnDisplayChange$FullScreen$Normal
API String ID: 1508791961-3229684195
Opcode ID: 619195580f1950770ac828e8d78d823ffe101d81ef2267cb9adcc62f53313382
Instruction ID: 203af33678339278b6867e2b222d6233e78b293796625596023d77751e61db1a
Opcode Fuzzy Hash: 619195580f1950770ac828e8d78d823ffe101d81ef2267cb9adcc62f53313382
Instruction Fuzzy Hash: 3111D1313046405BCB18BF269852B2E7699EBC5B29F00493FF856833C2DE3C9A04879D

Uniqueness

Uniqueness Score: -1.00%

Function 00464E2A, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00464E31
#1165.MFC42U(CNBSettingsMgr::UpdateGlobalSetting,80070057,00000018,00464DFC,?,80070057,?,?,00000001,80070057,CNBSettingsMgr::CacheFlushItem,80070057,00000020,00465CC2,?), ref: 00464E8C
#1165.MFC42U(00000000,?,?), ref: 00464EBD

Strings

W, xrefs: 00464E39
CNBSettingsMgr::UpdateGlobalSetting, xrefs: 00464E41

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CNBSettingsMgr::UpdateGlobalSetting$W
API String ID: 3111753120-1018855564
Opcode ID: de12659e20344271e4fe2ddc1a9f645607cc84eac22e9e03e814d0bb9fefc136
Instruction ID: 7c62554adf221c80ba94e3bf7844748afe919d98f738ede43799013335c17229
Opcode Fuzzy Hash: de12659e20344271e4fe2ddc1a9f645607cc84eac22e9e03e814d0bb9fefc136
Instruction Fuzzy Hash: 36219071A00206CFDF10DF99C985ABE77B4FF55304F11406BE404AB291EB799E44CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00448886, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00448890
#1165.MFC42U(CNotebookDoc::InsertPicture,?,00000218,00434164,?), ref: 004488E7
SysAllocString.OLEAUT32(?), ref: 00448912
SysFreeString.OLEAUT32(00000000), ref: 00448955

Part of subcall function 00435657: memset.MSVCRT ref: 0043566C
Part of subcall function 00435657: TraceEvent.ADVAPI32(0E0227DC,00000000,?,00000002,?,00000000), ref: 004356A5

Strings

CNotebookDoc::InsertPicture, xrefs: 004488A1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: String$#1165AllocEventFreeH_prolog3_Tracememset
String ID: CNotebookDoc::InsertPicture
API String ID: 1496192115-280028797
Opcode ID: a0777da9b8a2f3db6d2ad7ff948c6995a5dd56e4420cc6f47803dd363dba6ec9
Instruction ID: 93c17d6b48712d3fd78945184018a9f9fb64d88bce07eec2c0cdcaacee29332a
Opcode Fuzzy Hash: a0777da9b8a2f3db6d2ad7ff948c6995a5dd56e4420cc6f47803dd363dba6ec9
Instruction Fuzzy Hash: E6210774A411299BDB60AB56CC49EEF7768AF19314F1080AFF508A7251CF78DD81CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00464B93, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 63registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00435580: RegCreateKeyExW.ADVAPI32(00000000,KF,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,?,00464BEE,00000000), ref: 004355A7
Part of subcall function 00435580: RegCloseKey.ADVAPI32(?,?,00464BEE,00000000,Version,?,?,?,?,?,?,0E0227DC), ref: 004355BB

RegSetValueExW.ADVAPI32(?,00000000,00000000,00000004,00000000,00000004,00000000,Version,?,?,?,?,?,?,0E0227DC), ref: 00464C07
RegCloseKey.ADVAPI32(?,00000000,Version,?,?,?,?,?,?,0E0227DC), ref: 00464C26

Strings

Version, xrefs: 00464BDB
CNBSettingsMgr::WriteVersion, xrefs: 00464BA8
W, xrefs: 00464BA0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$CreateValue
String ID: CNBSettingsMgr::WriteVersion$Version$W
API String ID: 1009429713-1725434890
Opcode ID: b075ccaf33a7b48c777c0119bb4eb1bdc678a74b4a4d62097c82baa0b7e91a38
Instruction ID: 478ec9b27fda87cc6bad2196f195d16f3cb7adaa607597db39d9a6b9232e040d
Opcode Fuzzy Hash: b075ccaf33a7b48c777c0119bb4eb1bdc678a74b4a4d62097c82baa0b7e91a38
Instruction Fuzzy Hash: A9214D71D01209EFCF10EFA5C885AAFBBB4EB04315F11456AAA05A7240E7349E44DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0044FD0D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(?,?,?,CPgIpc::ActivateProcess,00000000,?,?,00000000), ref: 0044FD63
SetWindowPlacement.USER32(?,0000002C,?,00000000), ref: 0044FD83
SetForegroundWindow.USER32(?,?,00000000), ref: 0044FD8A

Strings

,, xrefs: 0044FD5C
CPgIpc::ActivateProcess, xrefs: 0044FD35

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Placement$Foreground
String ID: ,$CPgIpc::ActivateProcess
API String ID: 487774593-811422551
Opcode ID: 8b8970027e21aae7422b174685e004e887e3d3c9435a23839747308885723e1e
Instruction ID: 7badce092205e14c9f08c7750be743684b5c10abe836dc64d08d613dd8caa9fe
Opcode Fuzzy Hash: 8b8970027e21aae7422b174685e004e887e3d3c9435a23839747308885723e1e
Instruction Fuzzy Hash: 9211B472A12118EBDB00DFE5DC45DEDB7B8EF04314F14402BF912E7240DB3869048BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0048F60E, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0048F618
memset.MSVCRT ref: 0048F65A

Part of subcall function 004943BA: __EH_prolog3.LIBCMT ref: 004943C1

Part of subcall function 00494C29: GetPrivateProfileStringW.KERNEL32 ref: 00494C75

lstrlenW.KERNEL32(?,LastOpenedNote,?,00000104,00000000), ref: 0048F6B8

Part of subcall function 0048A0CF: __EH_prolog3.LIBCMT ref: 0048A0D6

Strings

LastOpenedNote, xrefs: 0048F695
CNBFolder::_LoadFolderSettingsMetadata, xrefs: 0048F631

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$H_prolog3_PrivateProfileStringlstrlenmemset
String ID: CNBFolder::_LoadFolderSettingsMetadata$LastOpenedNote
API String ID: 4119056155-4153588771
Opcode ID: 20f1d42f94f4aa59e56e10d03d8e2b3514d381cafdb90f9606b3f01e7ac6b5e6
Instruction ID: a69bd9c5177073e88681cef30ce0f319d4dc56c89a2cfca617694995df7f3673
Opcode Fuzzy Hash: 20f1d42f94f4aa59e56e10d03d8e2b3514d381cafdb90f9606b3f01e7ac6b5e6
Instruction Fuzzy Hash: 1A2144B1D011289BCB20EB60CC41BDD7778AF14744F0405FAE60CA7142EB749F49CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00483AF9, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00483B00
#1165.MFC42U(CViewInfo::GetShowSize,00000000,00000024,004842CB,?,00000000,00000000,CViewMgr::SizeView,00000000,00000028,004845F1,00000001,00000000,00000000,00000001,00000001), ref: 00483B26
GetClientRect.USER32 ref: 00483B4F

Strings

CViewMgr::GetClientRect, xrefs: 00483B39
CViewInfo::GetShowSize, xrefs: 00483B10

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165ClientH_prolog3_Rect
String ID: CViewInfo::GetShowSize$CViewMgr::GetClientRect
API String ID: 3890244326-2988681871
Opcode ID: 4543784ec4ae6d761c9f712b71e818cb0d0572f2deca27ead64f6f26c7f83678
Instruction ID: 3efd8a44bcce48e973942a7b702ea5f28617a5134083f3cd0e6acc51dfab8aa8
Opcode Fuzzy Hash: 4543784ec4ae6d761c9f712b71e818cb0d0572f2deca27ead64f6f26c7f83678
Instruction Fuzzy Hash: DD215670501615DFCB10EF66C984A9DBBB0FF04711F10866EE419DB391DB38E944CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042A9EC, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

#4451.MFC42U(?,CMainFrame::OnCreate,00000000,0E0227DC), ref: 0042AA35
#1165.MFC42U ref: 0042AA40

Part of subcall function 0042B081: __EH_prolog3_GS.LIBCMT ref: 0042B088
Part of subcall function 0042B081: #540.MFC42U(CMainFrame::CreateMenuAndCtrlBars,00000000,00000054,0042AA53), ref: 0042B0A5
Part of subcall function 0042B081: #6611.MFC42U(?,00008400,56002800,0000E804), ref: 0042B0C5
Part of subcall function 0042B081: #4158.MFC42U(00000070,?,?,?,00000070), ref: 0042B10B
Part of subcall function 0042B081: #4158.MFC42U(00000075,?,?,?,00000075,?,?,?,?,?,?,?,?,0000008B,0000000B), ref: 0042B197

RegisterPowerSettingNotification.USER32 ref: 0042AA60
RegisterPowerSettingNotification.USER32 ref: 0042AA75

Strings

CMainFrame::OnCreate, xrefs: 0042AA22

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #4158NotificationPowerRegisterSetting$#1165#4451#540#6611H_prolog3_
String ID: CMainFrame::OnCreate
API String ID: 3846686552-2650254082
Opcode ID: 9ac6c1fcb1b80713d9cbacec58c596810f9ff03b02b4864e7320b6d2024ea12f
Instruction ID: 4e0e1fe886e2c8d83f4644c0829981d6caf8d5e64d1f2e28feeb6b7ddac5211c
Opcode Fuzzy Hash: 9ac6c1fcb1b80713d9cbacec58c596810f9ff03b02b4864e7320b6d2024ea12f
Instruction Fuzzy Hash: BA117C71605240AFC710DF26DD85F56BBA5EB88720F50473FB86A872E1DB389804CA2A

Uniqueness

Uniqueness Score: -1.00%

Function 00467AAF, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00467AB6
#489.MFC42U(00000604,00000000,00000008,00466E65,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000), ref: 00467AC8
#567.MFC42U(?,?,?,?,?,00000074,00432E7A,0000EF59,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000), ref: 00467AF1

Part of subcall function 0049DFAB: #567.MFC42U(?,?), ref: 0049DFB7

Part of subcall function 0049DE94: #567.MFC42U(?), ref: 0049DE9F

Strings

$K, xrefs: 00467AF7
CLineSetupPage::CLineSetupPage, xrefs: 00467B67

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$#489H_prolog3
String ID: $K$CLineSetupPage::CLineSetupPage
API String ID: 3691984168-1923511042
Opcode ID: d090610d5e0b67dce0e01444895b37c1681030a5e2cd30552db4ab5303ac6bb0
Instruction ID: 1d47f844804d4da2093b319e2148bb7015754e27252d6871667de5fdd2160ee1
Opcode Fuzzy Hash: d090610d5e0b67dce0e01444895b37c1681030a5e2cd30552db4ab5303ac6bb0
Instruction Fuzzy Hash: 1D214F70A01646EFD709DF76C4957D8FBA4BF28308F90416E952953282DB782718CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042A8FB, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042A902
#800.MFC42U(CMainFrame::~CMainFrame,00000000,0000000C,0042A8D8), ref: 0042A966
#800.MFC42U ref: 0042A9CF
#674.MFC42U ref: 0042A9DB

Strings

CMainFrame::~CMainFrame, xrefs: 0042A918

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #800$#674H_prolog3
String ID: CMainFrame::~CMainFrame
API String ID: 2350649645-2132378577
Opcode ID: a2b431e46da6c3728808df78d29a4ed4bacec7564224e81d617b767a2acfb5d7
Instruction ID: 541c7a444ddc4699690d6514e5224d36229fed0c6a31fce609b13a34008d45cd
Opcode Fuzzy Hash: a2b431e46da6c3728808df78d29a4ed4bacec7564224e81d617b767a2acfb5d7
Instruction Fuzzy Hash: 8E21B230605646EED708EBB6D5597ECFB70BF55308F4041AED819532C2DF782A18CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00450081, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000114,NBMapFile,CPgIpc::IsInstanceOpen,00000000,?,?,?,?,?,004401A9,00000000), ref: 004500AA
GetLastError.KERNEL32(?,?,?,004401A9,00000000), ref: 004500B6

Part of subcall function 004AFE0C: CloseHandle.KERNEL32(?,Helpers::CloseHandle,00000000,-00000024), ref: 004AFE2D
Part of subcall function 004AFE0C: GetLastError.KERNEL32 ref: 004AFE39

GetLastError.KERNEL32(?,?,?,004401A9,00000000), ref: 004500E2

Strings

CPgIpc::IsInstanceOpen, xrefs: 00450090
NBMapFile, xrefs: 0045009A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CloseCreateFileHandleMapping
String ID: CPgIpc::IsInstanceOpen$NBMapFile
API String ID: 1396873618-570887814
Opcode ID: a9989d20826fe62b5d39ec90b766804ea682b021a5d0d0880eae623dff23e6bd
Instruction ID: 053396c057e3ca5ee588cdd689582aba69127069a72b1b031482b1060e9ce821
Opcode Fuzzy Hash: a9989d20826fe62b5d39ec90b766804ea682b021a5d0d0880eae623dff23e6bd
Instruction Fuzzy Hash: FB018E32200120ABC7145B5A9C09F773F68DB41725F20426BFE04972E2CA79D801C2FE

Uniqueness

Uniqueness Score: -1.00%

Function 0042B885, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

#1165.MFC42U(CMainFrame::OnEndSession,00000000,0E0227DC), ref: 0042B8D6
#1165.MFC42U ref: 0042B8DD
#1165.MFC42U ref: 0042B8EA

Part of subcall function 00449931: __EH_prolog3_GS.LIBCMT ref: 0044993B

#4584.MFC42U(00000001,CMainFrame::OnEndSession,00000000,0E0227DC), ref: 0042B908

Strings

CMainFrame::OnEndSession, xrefs: 0042B8BC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#4584H_prolog3_
String ID: CMainFrame::OnEndSession
API String ID: 1799443413-1851146148
Opcode ID: 4686a0e20c5bd71dd880f9721f95cecebfed1e411d07b9fb9096ad877b86f365
Instruction ID: 1991601ee935b60558812d6544a77972b2b5a7bea5f81848395aba4210d399b2
Opcode Fuzzy Hash: 4686a0e20c5bd71dd880f9721f95cecebfed1e411d07b9fb9096ad877b86f365
Instruction Fuzzy Hash: 1511E3326086049FC714EF15DD85E6A77E9FB84324F44423FF51587290DB389C00CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00464A7C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00464A83
SHDeleteKeyW.SHLWAPI(00000000,?,CNBSettingsMgr::DeleteSettingReg,80070057,00000010,00464D91,?,?,?,00000001,80070057,CNBSettingsMgr::CacheFlushItem,80070057,00000020,00465CC2,?), ref: 00464ACD
SHDeleteValueW.SHLWAPI(00000000,?,?,CNBSettingsMgr::DeleteSettingReg,80070057,00000010,00464D91,?,?,?,00000001,80070057,CNBSettingsMgr::CacheFlushItem,80070057,00000020,00465CC2), ref: 00464AED

Part of subcall function 00464A34: __EH_prolog3.LIBCMT ref: 00464A3B

Strings

W, xrefs: 00464A8D
CNBSettingsMgr::DeleteSettingReg, xrefs: 00464A95

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteH_prolog3$Value
String ID: CNBSettingsMgr::DeleteSettingReg$W
API String ID: 923501673-857338430
Opcode ID: 4c6ff916f86cc7281d1b27355c069256483278cf3a657674c902619281c2c12a
Instruction ID: 4f53518294048651566de8aab0926c0bfa6f50ad0b43e8bbd209a4ec77063c48
Opcode Fuzzy Hash: 4c6ff916f86cc7281d1b27355c069256483278cf3a657674c902619281c2c12a
Instruction Fuzzy Hash: 8D11E772901116DBCF04DBA1CC45ABEB370AF54715F21402FE401B7191EB3CAE0587AE

Uniqueness

Uniqueness Score: -1.00%

Function 00428DC2, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

#3490.MFC42U(?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00428E08
#2879.MFC42U(?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00428E10
GetFocus.USER32(?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00428E1C
#2859.MFC42U(00000000,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00428E23

Strings

CSplitWnd::GetActivePane, xrefs: 00428DF3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2859#2879#3490Focus
String ID: CSplitWnd::GetActivePane
API String ID: 761702272-4210924447
Opcode ID: 6b208c60d7888f780862d73819cd6ab7dedfa579faca3c872cdedacdb69e60c1
Instruction ID: efb0f286506daca9da443c06d4a0f6f299e7a9cd93dd87e032527851cd47072d
Opcode Fuzzy Hash: 6b208c60d7888f780862d73819cd6ab7dedfa579faca3c872cdedacdb69e60c1
Instruction Fuzzy Hash: 8111A532645611ABC7219F25DC09B6A77A4EB94731F04073FF815D33D0EF789C048699

Uniqueness

Uniqueness Score: -1.00%

Function 0048412E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00484135

Part of subcall function 00484FF4: __EH_prolog3.LIBCMT ref: 00484FFB

GetFocus.USER32(00000000,CViewMgr::TabViewFocus,00000000,0000000C,0042D2AE), ref: 00484170
IsChild.USER32(?,00000000), ref: 0048417F
#5977.MFC42U(00000000,CViewMgr::TabViewFocus,00000000,0000000C,0042D2AE), ref: 004841A8

Part of subcall function 0048407D: __EH_prolog3.LIBCMT ref: 00484084

Strings

CViewMgr::TabViewFocus, xrefs: 00484144

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#5977ChildFocus
String ID: CViewMgr::TabViewFocus
API String ID: 3825061664-3335622545
Opcode ID: 2c90110b366b98a9a1d546022381e485f0d8bda6a09d7ac94dec4f93107e408c
Instruction ID: 951d0090bf45d2f0ca40314fc2bcbe70afe903ac4397f80a85f6611cf869a779
Opcode Fuzzy Hash: 2c90110b366b98a9a1d546022381e485f0d8bda6a09d7ac94dec4f93107e408c
Instruction Fuzzy Hash: B401A1306101179BDF11BBA18C4D6BE7765AFA0708F54093FE911A6290DFBC8C45D7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00445E38, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00445E3F
lstrlenW.KERNEL32(00000000), ref: 00445E6D

Part of subcall function 004796DC: __EH_prolog3.LIBCMT ref: 004796E3
Part of subcall function 004796DC: #1165.MFC42U(W_SetWaitMode,00000000,0000000C,00445E7F), ref: 004796FD

SHPathPrepareForWriteW.SHELL32(00000000,00000000,00000000,00000004), ref: 00445E84
GetFileAttributesW.KERNEL32(00000000), ref: 00445E8F

Strings

CNotebookDoc::IsNameWriteable, xrefs: 00445E4C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165AttributesFilePathPrepareWritelstrlen
String ID: CNotebookDoc::IsNameWriteable
API String ID: 1365689620-3339433355
Opcode ID: 97e8ddef23503e484c2b8cd4532b382f00205b5834675a6392f975c811692ee2
Instruction ID: 7383245ffa61c54e6147412b436aebd74608c9a79b653984f9ca1e0abc609157
Opcode Fuzzy Hash: 97e8ddef23503e484c2b8cd4532b382f00205b5834675a6392f975c811692ee2
Instruction Fuzzy Hash: 4401DB312016115BDF28AB328C09ABF3B649F82714B50016FF516D6292CF2CCD02876C

Uniqueness

Uniqueness Score: -1.00%

Function 004AAED0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004AAED7
DestroyCursor.USER32(?), ref: 004AAF37
#609.MFC42U(CJournalNotificationWnd::~CJournalNotificationWnd,00000000,0000000C,004AAE05,CJournalNotification::~CJournalNotification,00000000,00000000,0E0227DC,?), ref: 004AAF52
#818.MFC42U ref: 004AAF6F

Strings

CJournalNotificationWnd::~CJournalNotificationWnd, xrefs: 004AAEED

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #609#818CursorDestroyH_prolog3
String ID: CJournalNotificationWnd::~CJournalNotificationWnd
API String ID: 222181282-2338938467
Opcode ID: 970a252397d9ed92e692c70ff5bf33908cc36bf63ad974d513d18e07289f9b02
Instruction ID: e47952c307bb9bc15671a2527421e59d0ef92b8b81641f3e84a720a74d3c6f31
Opcode Fuzzy Hash: 970a252397d9ed92e692c70ff5bf33908cc36bf63ad974d513d18e07289f9b02
Instruction Fuzzy Hash: 3B118F70A05301DED710EF76C885BDEBBA4AF15304F10456FE05A93282DB799A05CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0044D313, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044D31A
#1165.MFC42U(CNotebookView::OnOpenNewFile,?,00000014,004456A8,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044D340

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

Part of subcall function 004291E6: __EH_prolog3.LIBCMT ref: 004291ED

Part of subcall function 0044D3AE: __EH_prolog3.LIBCMT ref: 0044D3B5
Part of subcall function 0044D3AE: #1165.MFC42U(CNotebookView::LoadZoomSettings,00000000,0000001C,0044D360,00000000,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001), ref: 0044D3DB
Part of subcall function 0044D3AE: #1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044D3DD
Part of subcall function 0044D3AE: #1165.MFC42U(?,?,?,0000000C,00000000,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001), ref: 0044D441
Part of subcall function 0044D3AE: GetFocus.USER32(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044D45B
Part of subcall function 0044D3AE: #1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044D46C

#1165.MFC42U(00000000,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044D360
#1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044D377

Part of subcall function 0049232D: __EH_prolog3_GS.LIBCMT ref: 00492337
Part of subcall function 0049232D: lstrlenW.KERNEL32(00000000,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00492382

Strings

CNotebookView::OnOpenNewFile, xrefs: 0044D327

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$FocusH_prolog3_lstrlen
String ID: CNotebookView::OnOpenNewFile
API String ID: 1034574612-2975040335
Opcode ID: feb03f71894a6493ce49b9337544cf733e9d0ee9a5eca0327d5c697d3dc392d9
Instruction ID: b38232973541222e1b991ba68b6d67e732b3d56ac9134b9982e23829d47914a7
Opcode Fuzzy Hash: feb03f71894a6493ce49b9337544cf733e9d0ee9a5eca0327d5c697d3dc392d9
Instruction Fuzzy Hash: 43012D30A001159FDB04FB66CD859FE77B1AF18708F05406AF905AB292DE38AE05DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0046E9AC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046E9B3
#2634.MFC42U(00000000,CSimpleFindDialog::_UpdateNextPrevButtons,00000000,00000014,0046E4B1,000003FD,?,CSimpleFindDialog::_UpdateAction1Button,00000000,?,00000000,00000000,0E0227DC), ref: 0046EA27
#2634.MFC42U(00000000,?,00000000,00000000,0E0227DC), ref: 0046EA30

Strings

CSimpleFindDialog::_UpdateNextPrevButtons, xrefs: 0046E9C3
CSrchView::HasClosedResults, xrefs: 0046E9F0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2634$H_prolog3
String ID: CSimpleFindDialog::_UpdateNextPrevButtons$CSrchView::HasClosedResults
API String ID: 3779469043-1599556649
Opcode ID: 3456dcbd06a479ef1463734e222914bc56e6b21c2fc7b2aadecdcbf9bec303bb
Instruction ID: b67e451d10b737389db029011e8cbd22eb51ee91168a4ba28cbf366f6af95591
Opcode Fuzzy Hash: 3456dcbd06a479ef1463734e222914bc56e6b21c2fc7b2aadecdcbf9bec303bb
Instruction Fuzzy Hash: EB01D2329012594BCB20EBA3DC45BEE77B0BF96710F04006FA906772A1EE792C45CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00462B76, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

#361.MFC42U(00000000,00000101,00000000,00000000,6DEDD6D0,00000000,00000001,?,?,0042CC4D,0E0227DC), ref: 00462B8D
memset.MSVCRT ref: 00462BB4
memset.MSVCRT ref: 00462BC9

Strings

k+F, xrefs: 00462B9C
CTextBoxFontDlg::CTextBoxFontDlg, xrefs: 00462B94

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$#361
String ID: CTextBoxFontDlg::CTextBoxFontDlg$k+F
API String ID: 2045655648-1024191823
Opcode ID: a5b1b3aeca19ad2af407dfb6061df74fe92342988d5ff016bffed511447c31c9
Instruction ID: fb72e1ecdd2205561223fa6a83dd9136703b2e7c164509fe66577d6d35d9822d
Opcode Fuzzy Hash: a5b1b3aeca19ad2af407dfb6061df74fe92342988d5ff016bffed511447c31c9
Instruction Fuzzy Hash: A3F0C8B2B002087FE310AAA69C86FDBB72CEB40314F50003BF618561C1EBB5695987A9

Uniqueness

Uniqueness Score: -1.00%

Function 0044D52B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044D532

Part of subcall function 0044DC11: __EH_prolog3.LIBCMT ref: 0044DC18
Part of subcall function 0044DC11: #6211.MFC42U(00000005,CNotebookView::ShowViewer,00000000,00000008,0044D554,00000000,CNotebookView::OnCloseDocument,00000000,0000000C,0044976C), ref: 0044DC44
Part of subcall function 0044DC11: #1165.MFC42U ref: 0044DC4A
Part of subcall function 0044DC11: #5848.MFC42U(?,00000001), ref: 0044DC59

#1165.MFC42U(00000000,CNotebookView::OnCloseDocument,00000000,0000000C,0044976C), ref: 0044D55A
#1165.MFC42U ref: 0044D56E
#1165.MFC42U ref: 0044D57C

Part of subcall function 0042A3DE: __EH_prolog3.LIBCMT ref: 0042A3E5

Part of subcall function 00492414: __EH_prolog3_GS.LIBCMT ref: 0049241E
Part of subcall function 00492414: lstrlenW.KERNEL32(00000000), ref: 00492477

Part of subcall function 0044E0AC: __EH_prolog3.LIBCMT ref: 0044E0B3
Part of subcall function 0044E0AC: #1165.MFC42U(CNBDocViewCtrl::SetActionState,?,CNotebookView::SetActionState,00000000,00000018,0044D595,00000000,?,00000000), ref: 0044E131

Part of subcall function 004291E6: __EH_prolog3.LIBCMT ref: 004291ED

Strings

CNotebookView::OnCloseDocument, xrefs: 0044D53F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3$#5848#6211H_prolog3_lstrlen
String ID: CNotebookView::OnCloseDocument
API String ID: 2954318905-1716305878
Opcode ID: 8aa8caffd108072733839d85832c47e33e4283c5cb92fcacb38567815c73484e
Instruction ID: cc52346fdd5b6f9fcff852f685bcb4ec8441d528682f63d621460a68d111b7a4
Opcode Fuzzy Hash: 8aa8caffd108072733839d85832c47e33e4283c5cb92fcacb38567815c73484e
Instruction Fuzzy Hash: C9015A306011219BE604EB668D86EAEB7A5AF48704F8500AAA50597293DE6CDD019AAD

Uniqueness

Uniqueness Score: -1.00%

Function 0047966C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00479673
PathFindFileNameW.SHLWAPI(?,G_PathFindShellName,00000000,0000000C,0048C69A), ref: 004796BF

Part of subcall function 0047B8DC: __EH_prolog3.LIBCMT ref: 0047B8E6
Part of subcall function 0047B8DC: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,004D7968,_GetMyDocsPathName,00000000,00000124,0047BB75,G_ReplaceMyDocsPath,00000000,00000008,00481CB6,00000105), ref: 0047B911

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,004D7968,000000FF,G_PathFindShellName,00000000,0000000C,0048C69A), ref: 004796A8

Strings

G_PathFindShellName, xrefs: 0047967C
XwM, xrefs: 004796B5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3Path$CompareFileFindFolderNameString
String ID: G_PathFindShellName$XwM
API String ID: 3949939450-357404132
Opcode ID: 3ae4e12705063900f03238a6d4d3ab22359f3336a9652995fe70ffb7a325cd5e
Instruction ID: c00cd7c95aabfc2f8fe041f35c4419136f087f58a8b58581e45ff66a3be7d4ad
Opcode Fuzzy Hash: 3ae4e12705063900f03238a6d4d3ab22359f3336a9652995fe70ffb7a325cd5e
Instruction Fuzzy Hash: 9DF0E23094411027DB2163218C4ABFF22209B52B30F70477BF629E23D0FFAC6C4586AD

Uniqueness

Uniqueness Score: -1.00%

Function 0047CB78, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047CB7F
#483.MFC42U(CPrintNotify::CPrintNotify,00000000,0000000C,0047CDDC,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047CBB3
#540.MFC42U ref: 0047CBC0

Strings

CPrintNotify::CPrintNotify, xrefs: 0047CB92
CNotebookDocPrint::CNotebookDocPrint, xrefs: 0047CBC7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #483#540H_prolog3
String ID: CNotebookDocPrint::CNotebookDocPrint$CPrintNotify::CPrintNotify
API String ID: 3366176207-1287394798
Opcode ID: 966310c36c8212659a6b5b40a7eb0b2e5001fd498f7a0c35a2f189f6a9c70549
Instruction ID: f2046657c49424da0b44e77ce8395f84ecad038cd6891b55763a6246c7ed78fd
Opcode Fuzzy Hash: 966310c36c8212659a6b5b40a7eb0b2e5001fd498f7a0c35a2f189f6a9c70549
Instruction Fuzzy Hash: E3012C708006459EC720EF66C8459EEFBF4AFA0704F40445FE5A293261DFB86685CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00461563, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046156A
#1008.MFC42U(?,CInkSettingsPropSheet::DoModal,00000000,0000000C,00430F88), ref: 00461593
#1008.MFC42U(?), ref: 0046159E
#2520.MFC42U ref: 004615B0

Strings

CInkSettingsPropSheet::DoModal, xrefs: 00461573

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1008$#2520H_prolog3
String ID: CInkSettingsPropSheet::DoModal
API String ID: 803550650-897319696
Opcode ID: e3ceaf801141c14d73d1bed6392766cef766c6f85c678c859749ce1039867e00
Instruction ID: 3beebf39f448d0df0f65d9d50592316f349b8187a32466f9a74830e10b91f38f
Opcode Fuzzy Hash: e3ceaf801141c14d73d1bed6392766cef766c6f85c678c859749ce1039867e00
Instruction Fuzzy Hash: 36F08934B00206ABDB1CE7A1CC4ABEDB729BB84714F44417BD51697381DF786904CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044CBAA, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0044CBB1
#268.MFC42U(00000014,00457F15,CNBToolbar::SetImageLists,00000000,0000001C,0042B130,00000088,?,0000008B,0000000B), ref: 0044CBC8
#2406.MFC42U(?,0000008B,0000000B), ref: 0044CBD4
#1560.MFC42U(?,0000008B,0000000B), ref: 0044CC07

Strings

|e@, xrefs: 0044CBC5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1560#2406#268H_prolog3_catch
String ID: |e@
API String ID: 62062967-3439105620
Opcode ID: 3772f309652e4f78cecec950548e671e7c3473f10ba55c9321e08011542f6729
Instruction ID: f41a9cff3b2c45bfb7e8b5f7ebd49eca0c5f9108dbc9d1101694adda99120825
Opcode Fuzzy Hash: 3772f309652e4f78cecec950548e671e7c3473f10ba55c9321e08011542f6729
Instruction Fuzzy Hash: CAE0E574915254DBDB00DF95D9083DCBBB4AB14305F6444AFE445A32A1CFB80A45DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0045E59A, Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

#6928.MFC42U(?,00000000,?,?,004AE20E,?,?), ref: 0045E5AB
memset.MSVCRT ref: 0045E5EF
memset.MSVCRT ref: 0045E622
memcpy.MSVCRT ref: 0045E68C
memset.MSVCRT ref: 0045E6A3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$#6928memcpy
String ID:
API String ID: 2130233291-0
Opcode ID: 8e5c519c9680052f63f9c2256e2db663976e21fe4c89e111d8dfec86e42cb401
Instruction ID: cabd32273e1626130b64df768dde77ed31e69684d2c911807865552ecd14b19e
Opcode Fuzzy Hash: 8e5c519c9680052f63f9c2256e2db663976e21fe4c89e111d8dfec86e42cb401
Instruction Fuzzy Hash: C431D5F1A00502BBD7189F1BCD81A15F698BB2435AB50C12FE819C7A43E739E654C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0047D4BD, Relevance: 7.5, APIs: 5, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047D4C4
#800.MFC42U(00000004,0047D4A3,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000), ref: 0047D4DE
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D4E7
#800.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D4F0
#641.MFC42U(?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324,00000000,00000000,?), ref: 0047D4F8

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #800$#641H_prolog3
String ID:
API String ID: 4091001960-0
Opcode ID: 7aece4786fa4aa4f13780013593e08267282f685fc8e2b2e5eb29d84e661e510
Instruction ID: 2f6c553fe4a71de17561f68b52be047f3c80df8578331c987dbd1eee820d274d
Opcode Fuzzy Hash: 7aece4786fa4aa4f13780013593e08267282f685fc8e2b2e5eb29d84e661e510
Instruction Fuzzy Hash: 63E06D74801349EBCB04EB64DD057ACBB60BF55310F50419ED406932D1CF742B05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004A83A4, Relevance: 7.5, APIs: 5, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A83AB
#802.MFC42U(00000004,004A828A,00000000,00406594,?,?,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A83C2
#795.MFC42U(?,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A83D2
#692.MFC42U(?,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A83DF
#641.MFC42U(?,?,CNotebookApp::_PrimaryInstanceRecovery,00000000,0000075C,0044035A,?,?,?), ref: 004A83EB

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #641#692#795#802H_prolog3
String ID:
API String ID: 608345653-0
Opcode ID: 2e703909fc73da7fd72b82ac60344fa7de5a5249ebea990705d6921a119b679e
Instruction ID: ed50560de9408d734039c170c7dc8ad78ede33eb81adc8434aa0afad3f232991
Opcode Fuzzy Hash: 2e703909fc73da7fd72b82ac60344fa7de5a5249ebea990705d6921a119b679e
Instruction Fuzzy Hash: 4FF08530401288DFCB10EBA0E8093ACBBA0BB05304F9045AEE4AAA3290CF741B04CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00435600, Relevance: 7.5, APIs: 5, Instructions: 14COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00435607
#268.MFC42U(00000010,0042BC79), ref: 0043560F
#1165.MFC42U ref: 0043561D
#2644.MFC42U ref: 00435626
#1560.MFC42U ref: 00435630

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#1560#2644#268H_prolog3_catch
String ID:
API String ID: 1535197084-0
Opcode ID: 6c257471b49b46c1b2db59e78d441c3fbeeb8aadb095205c17982a3416658337
Instruction ID: 3a61a49c0a932928f15acf1f48d984c82acb6f5a8b0eb342b4a73ae3d186f394
Opcode Fuzzy Hash: 6c257471b49b46c1b2db59e78d441c3fbeeb8aadb095205c17982a3416658337
Instruction Fuzzy Hash: 6CE0B630502244EBD700ABA5ED2E7AD7B70AB04315FA081AEE096961F2DF780A45DA29

Uniqueness

Uniqueness Score: -1.00%

Function 00496A56, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 295COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00496A5D

Part of subcall function 00497525: __EH_prolog3.LIBCMT ref: 0049752C

memset.MSVCRT ref: 00496B5C
PropVariantClear.OLE32(00000000,?,?,?,?,?,?,?,?,CNBCacheMgr::_ReadObject,00000000), ref: 00496D28

Part of subcall function 0042A2C9: TraceMessage.ADVAPI32(00000000,0000EF51,0000002B,0041E910,00000064,00969CB0,00000004,00000000,?,004B04F0,00969CB0,0000EF51,00000000,?,?), ref: 0042A2E0

Strings

CNBCacheMgr::_ReadPropertySet, xrefs: 00496A70

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$ClearMessagePropTraceVariantmemset
String ID: CNBCacheMgr::_ReadPropertySet
API String ID: 2368939834-2971893229
Opcode ID: e721ac572ce792a04dff109739f64bf0b7ecefb1310019e192ae667f17edb803
Instruction ID: 459c65e9ca9cf3f5efdaa28bf534dd343d12d98e7080c4af88028f810f0f6e9d
Opcode Fuzzy Hash: e721ac572ce792a04dff109739f64bf0b7ecefb1310019e192ae667f17edb803
Instruction Fuzzy Hash: DFB1AC71E002259BDF14CFA4C944BAEBBB0EF44714F16856EF911AB391D779AC01CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0049682B, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00496832

Part of subcall function 0049746F: __EH_prolog3.LIBCMT ref: 00497476

memset.MSVCRT ref: 004968F4

Part of subcall function 0042A2C9: TraceMessage.ADVAPI32(00000000,0000EF51,0000002B,0041E910,00000064,00969CB0,00000004,00000000,?,004B04F0,00969CB0,0000EF51,00000000,?,?), ref: 0042A2E0

PropVariantClear.OLE32(00000000,?,004C531A,00000000,CNBCacheMgr::_WritePropertySet,00000000,00000024,0049717D), ref: 00496A17

Strings

CNBCacheMgr::_WritePropertySet, xrefs: 00496843

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$ClearMessagePropTraceVariantmemset
String ID: CNBCacheMgr::_WritePropertySet
API String ID: 2368939834-2383195534
Opcode ID: 6bedddf7cc3d95f0159df2afbd1f76dbfd8d407ce44aae67ec0ecbdbe6d20223
Instruction ID: 299f864ed7144881ba30551026c9a138ffe08b5730262c24515c863e23b1d363
Opcode Fuzzy Hash: 6bedddf7cc3d95f0159df2afbd1f76dbfd8d407ce44aae67ec0ecbdbe6d20223
Instruction Fuzzy Hash: 8571A371E012159BCF15CBA4C945BBFBBB0AF48714F16416EE901BB351D7399D01CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0049502A, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00495031
GetPrivateProfileSectionNamesW.KERNEL32 ref: 004950B0

Strings

CNBFileSettings::CreateSectionEnumerator, xrefs: 00495043
CNBFileSettingsEnum::CNBFileSettingsEnum, xrefs: 0049513E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3NamesPrivateProfileSection
String ID: CNBFileSettings::CreateSectionEnumerator$CNBFileSettingsEnum::CNBFileSettingsEnum
API String ID: 2390585464-2052856953
Opcode ID: 865e1674229c65b52651bd855d6ce919d5baa0edecd8bf0759c970d042abcaeb
Instruction ID: a0e32f9d8b21fc5751f016239c55529ea704e1e278c608f71f4e37d06f80cbc2
Opcode Fuzzy Hash: 865e1674229c65b52651bd855d6ce919d5baa0edecd8bf0759c970d042abcaeb
Instruction Fuzzy Hash: 2D41B032E016259FDF16DB55C842BBEBBB0AF44714F25416FE911AB390CB789D018BE8

Uniqueness

Uniqueness Score: -1.00%

Function 0048EDA7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0048EDAE
GetFileAttributesExW.KERNEL32(?,00000000,00000000,CNBFolder::_InitializeFromFolder,00000001,00000044,0048E8A1,?,00100000,00000010,00000000,?,00000001,001B0003), ref: 0048EE13
GetLastError.KERNEL32 ref: 0048EE1D

Strings

CNBFolder::_InitializeFromFolder, xrefs: 0048EDCA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesErrorFileH_prolog3_Last
String ID: CNBFolder::_InitializeFromFolder
API String ID: 4163435318-1661360629
Opcode ID: 0daf8450f5e8ab072b43cc5e95a3994d24041fe73e4704e2a2843a7881f5b253
Instruction ID: 76259cd0fbcb124fa611cbb2484f8441e4e0a2c43a6396fa1917e56b75f55970
Opcode Fuzzy Hash: 0daf8450f5e8ab072b43cc5e95a3994d24041fe73e4704e2a2843a7881f5b253
Instruction Fuzzy Hash: 5B413175D01229EBCB15AF56D940AAE7B71AF04B14F01482BFE10BB361DB78DC058F98

Uniqueness

Uniqueness Score: -1.00%

Function 004802F8, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00480302
GetLastError.KERNEL32(0000104C,00000000,?,?,00000000,00000000,CMetaListView::_UpdateSubitems,00000000,00000088,004806D4,00000000,00000000,CMetaListView::_UpdateItemData,00000000,00000074,00480791), ref: 00480443
SysFreeString.OLEAUT32(00000000), ref: 0048046B

Strings

CMetaListView::_UpdateSubitems, xrefs: 00480311

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFreeH_prolog3LastString
String ID: CMetaListView::_UpdateSubitems
API String ID: 1624186346-997207620
Opcode ID: 02270c1498d53100c12fb385d6490ce4f634a677603667dd563459ef43f0123b
Instruction ID: c3cbc25a7f9ef26da702382f0df0cbdb8c4e41643b5d5a9ac8525d8105b62d31
Opcode Fuzzy Hash: 02270c1498d53100c12fb385d6490ce4f634a677603667dd563459ef43f0123b
Instruction Fuzzy Hash: BA51DE32D102298BDF51EF98C941BEEBBB1BF04714F11446BEA04BB251D7789E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00480C38, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00480C3F

Part of subcall function 0047EAC4: SendMessageW.USER32(?,00000000,?,00000000), ref: 0047EAEA

Strings

+, xrefs: 00480CFC
CMetaListView::_RefreshLVColumns, xrefs: 00480C4E
CMetaListColumnArray::LookupPropertyName, xrefs: 00480CDF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3MessageSend
String ID: +$CMetaListColumnArray::LookupPropertyName$CMetaListView::_RefreshLVColumns
API String ID: 936991600-3656234072
Opcode ID: 3b1298bff4329b90b293f47a376aa9ac21d4862c17e700b2ad9c834e929d8c8c
Instruction ID: 9b996549094f4cb4e2914c95ccf1efd13a84b23db18747300efb73f5a050e895
Opcode Fuzzy Hash: 3b1298bff4329b90b293f47a376aa9ac21d4862c17e700b2ad9c834e929d8c8c
Instruction Fuzzy Hash: 1A515771E0075A9BCF14DF99C991AEDB7B0BF08314F54012AD915BB381C778AD05CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00464CBC, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 119registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00464CC3

Part of subcall function 004650C0: __EH_prolog3.LIBCMT ref: 004650C7
Part of subcall function 004650C0: lstrlenW.KERNEL32(?,CNBSettingsMgr::GetSettingKey,0E0227DC,00000010,00465274,00000000,00000000,?,00000000), ref: 00465102
Part of subcall function 004650C0: #1165.MFC42U(00000061), ref: 0046511E
Part of subcall function 004650C0: #2885.MFC42U ref: 00465127

RegCloseKey.ADVAPI32(00000000,?,00000001,80070057,CNBSettingsMgr::CacheFlushItem), ref: 00464E0A

Part of subcall function 004AFC50: RegQueryValueExW.ADVAPI32(80070057,00000000,00000000,00000020,80070057,?,Helpers::RegQueryValueExW,00000000,?,00000000,CNBSettingsMgr::CacheFlushItem,80070057,00000020), ref: 004AFC80

Strings

W, xrefs: 00464CD0
CNBSettingsMgr::CacheFlushItem, xrefs: 00464CD8

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165#2885CloseQueryValuelstrlen
String ID: CNBSettingsMgr::CacheFlushItem$W
API String ID: 1129592109-1189670456
Opcode ID: d2b2bfff92c391d34a51367de147048db1fb96674b0ae312d2f48241caf83194
Instruction ID: f3dcc1cc15165e426b2cb60b470dcf566a2f9a2e3f839c5edc6e934bb2633e84
Opcode Fuzzy Hash: d2b2bfff92c391d34a51367de147048db1fb96674b0ae312d2f48241caf83194
Instruction Fuzzy Hash: BC419371D001259BCF14DFA5C841AAEBBB4BF48714F15412AE804BB740E7399D50CBFA

Uniqueness

Uniqueness Score: -1.00%

Function 004479A5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004479AC
#1165.MFC42U(CNotebookDoc::CopySelectionToClipBoard,?,00000020,0042D304,00000000), ref: 00447A06
#1165.MFC42U(00000001), ref: 00447AD5

Strings

CNotebookDoc::CopySelectionToClipBoard, xrefs: 004479BE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CNotebookDoc::CopySelectionToClipBoard
API String ID: 3111753120-3362319583
Opcode ID: 0697829e7c2fd7c8419bfaff84e41f4e7ecf94c2ef11098a4448e7491475c9bd
Instruction ID: 78acd8e8289662e3117f0db7f945ebbe676f5964889dd95aa362bc76c1c71710
Opcode Fuzzy Hash: 0697829e7c2fd7c8419bfaff84e41f4e7ecf94c2ef11098a4448e7491475c9bd
Instruction Fuzzy Hash: 75418370A002059FEB04DFA5C895BEE77B4EF44308F14806EE405BB291DB79DE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00496D77, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00496D81
_ltow.MSVCRT(00000000,?,0000000A,?,?,CNBCacheMgr::_WriteChildren,00000000), ref: 00496E0C
#30.ATL(?,00000000,?,?,00001012,00000000,00000000,?,00000000,00000000,00000105,00000000,004C531A,000000FF,?,0049650C), ref: 00496E8F

Strings

CNBCacheMgr::_WriteChildren, xrefs: 00496D98

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3__ltow
String ID: CNBCacheMgr::_WriteChildren
API String ID: 1352961913-85973136
Opcode ID: 88b85124ae4210457e9f0e97220c3e54165854fa264ee7d7d32cacc855b244f9
Instruction ID: 21f8479f28f055591061c093a9ddee729b7af12ff9b8dc73e8d0b41f126a68a4
Opcode Fuzzy Hash: 88b85124ae4210457e9f0e97220c3e54165854fa264ee7d7d32cacc855b244f9
Instruction Fuzzy Hash: EE416074A10218DFDF24CB25CC45BAABB74AF45304F1040EAE549AB282DB799E85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00431A8C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00431A96
memset.MSVCRT ref: 00431AEC

Part of subcall function 0042AE91: __EH_prolog3.LIBCMT ref: 0042AE98
Part of subcall function 0042AE91: #1165.MFC42U(CMainFrame::GetCurrentHighlightPenIndex,00000000,0000000C,0042B2EF,?,00000000,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0), ref: 0042AEB0

Part of subcall function 004515A8: __EH_prolog3.LIBCMT ref: 004515AF
Part of subcall function 004515A8: InvalidateRect.USER32(?,00000000,00000000), ref: 004515EA

_ftol2_sse.MSVCRT ref: 00431BBD

Strings

CMainFrame::UpdateHighlightPenVisuals, xrefs: 00431AA6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165H_prolog3_InvalidateRect_ftol2_ssememset
String ID: CMainFrame::UpdateHighlightPenVisuals
API String ID: 34516692-1107405682
Opcode ID: c7ea2481783a5064ba2e64c278a59144ceb4c9334434eda336abc7cc8cfc2e87
Instruction ID: 5a5fd3c98d4c21181c7fe1dad2de51a7e4e1b2ab5629ee45867e5cd48b7ef268
Opcode Fuzzy Hash: c7ea2481783a5064ba2e64c278a59144ceb4c9334434eda336abc7cc8cfc2e87
Instruction Fuzzy Hash: 8D410171E012289ADF609F658C81FDDB2B9AF48304F4040EFE54DA7252DB785E898F69

Uniqueness

Uniqueness Score: -1.00%

Function 00467BED, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00467BF4
#616.MFC42U(CLineSetupPage::~CLineSetupPage,00000000,0000000C,00467256,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00467D1B
#768.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00467D32

Strings

CLineSetupPage::~CLineSetupPage, xrefs: 00467C0A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #616#768H_prolog3
String ID: CLineSetupPage::~CLineSetupPage
API String ID: 441646596-2927576826
Opcode ID: f774d138754bf1c9a235a05086167f21c0fc3d951cade59ecfd1ec1953610fef
Instruction ID: 1be6c42ee67e45ff58d987835307a322f9690ea51d048e4cdd3782cce214a954
Opcode Fuzzy Hash: f774d138754bf1c9a235a05086167f21c0fc3d951cade59ecfd1ec1953610fef
Instruction Fuzzy Hash: 0F418334206705DFDB28DF75C498BAEBBB4AF19309F14489DE4678B392DB386A04CB15

Uniqueness

Uniqueness Score: -1.00%

Function 0045867C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000419,?,00000000), ref: 0045875C
SendMessageW.USER32(?,0000041D,00000000,?), ref: 00458771
InvalidateRect.USER32(?,?,00000001,?,6DEDD6D0,00008010,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0045877B

Strings

CNBToolbar::AdjustPaintRect, xrefs: 00458698

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$InvalidateRect
String ID: CNBToolbar::AdjustPaintRect
API String ID: 2778011698-282490719
Opcode ID: 180c125f69b94e0b5ceb9f0b3da754000da572713e7f85c9f82377cffd358919
Instruction ID: f38c952f225707f88299f4b388474b774e2d022d1ddacc0dac716f8131398498
Opcode Fuzzy Hash: 180c125f69b94e0b5ceb9f0b3da754000da572713e7f85c9f82377cffd358919
Instruction Fuzzy Hash: C3315C767001149FDB24CF59DC81BAA77A1FB98701F19407EED46AB352CE34AC45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00431801, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043180B
memset.MSVCRT ref: 00431861

Part of subcall function 0042AE3C: __EH_prolog3.LIBCMT ref: 0042AE43
Part of subcall function 0042AE3C: #1165.MFC42U(CMainFrame::GetCurrentWritingPenIndex,00000000,0000000C,0042B2E0,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0,00000005,00009C7C), ref: 0042AE5B

Part of subcall function 004515A8: __EH_prolog3.LIBCMT ref: 004515AF
Part of subcall function 004515A8: InvalidateRect.USER32(?,00000000,00000000), ref: 004515EA

_ftol2_sse.MSVCRT ref: 00431900

Strings

CMainFrame::UpdateWritingPenVisuals, xrefs: 0043181B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165H_prolog3_InvalidateRect_ftol2_ssememset
String ID: CMainFrame::UpdateWritingPenVisuals
API String ID: 34516692-629734147
Opcode ID: 037fe01a106b10ea2641f7a3d166a7fe35633db72cd5be80a8bb26c6cbd96f43
Instruction ID: 03dc9b0e1216a886af60c42c0c90839ef0a3d2e69d22e8019972e3133dac5ea5
Opcode Fuzzy Hash: 037fe01a106b10ea2641f7a3d166a7fe35633db72cd5be80a8bb26c6cbd96f43
Instruction Fuzzy Hash: 12316A71E012286ADF21EB618C41FEE7279AF48304F4040EFF54DA7152DF789E898B59

Uniqueness

Uniqueness Score: -1.00%

Function 004A7454, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

PathIsNetworkPathW.SHLWAPI(?), ref: 004A74B6
GetFileAttributesExW.KERNEL32(?,00000000,?), ref: 004A74CC
GetFileAttributesExW.KERNEL32(?,00000000,?), ref: 004A7512

Strings

_CheckRecoveryState, xrefs: 004A7472

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFilePath$Network
String ID: _CheckRecoveryState
API String ID: 764297526-158876497
Opcode ID: 0678fa6d2f4b0376fea85797c351ac39ececc341c1c4b1e6ae33b47140f2078c
Instruction ID: 8d727adf4c7aa4807c700c6277427d7ab4d530c2f8b6d0f9a6ba76bb760c68c2
Opcode Fuzzy Hash: 0678fa6d2f4b0376fea85797c351ac39ececc341c1c4b1e6ae33b47140f2078c
Instruction Fuzzy Hash: FA315071E01218ABDB24CF69DD95EAFBBB8FF55710F04806AE9059B340C734E841CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0048710E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00487118

Part of subcall function 00486D7B: __EH_prolog3.LIBCMT ref: 00486D82

#1165.MFC42U(CTOCView::_PopulateFolderListFromScope,?,00000224,0048727F,CTOCView::_Repopulate,00000000,0000000C,004855EE), ref: 00487163

Part of subcall function 0048FDFC: __EH_prolog3.LIBCMT ref: 0048FE03

memset.MSVCRT ref: 004871A2

Strings

CTOCView::_PopulateFolderListFromScope, xrefs: 00487128

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165H_prolog3_memset
String ID: CTOCView::_PopulateFolderListFromScope
API String ID: 1876609708-542143210
Opcode ID: f43bb22b35cebdb05e96df9acc11bfcfe1c535162f5093c039e7f2cc8665ccde
Instruction ID: 4067b665be20c63addea2662f9c09d2ecc298273b530102c2d0dfd94d661e698
Opcode Fuzzy Hash: f43bb22b35cebdb05e96df9acc11bfcfe1c535162f5093c039e7f2cc8665ccde
Instruction Fuzzy Hash: 4B313D70A01218AFDB14EFA5DC98BDE77B4AF18304F5044EEE40997251DB749E85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004311E1, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004311E8
#1165.MFC42U(CMainFrame::SetCurrentEraser,?,0000000C,0042C87E,00000000,00000001,00000008), ref: 00431230
#1165.MFC42U(00008012,0000000D), ref: 004312AD

Strings

CMainFrame::SetCurrentEraser, xrefs: 004311F5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CMainFrame::SetCurrentEraser
API String ID: 3111753120-2362481883
Opcode ID: c0ddf7132b4ea175b7cc31a59ba9775b8f5334f5399032da88675b2e5f258f43
Instruction ID: b4c460acf0bb0e07e17462e0b864882650b6c39010b9291c72aa1cf15ded8b4b
Opcode Fuzzy Hash: c0ddf7132b4ea175b7cc31a59ba9775b8f5334f5399032da88675b2e5f258f43
Instruction Fuzzy Hash: 1021D630A045059BDB14AB56DC05FBF3651EF8C710F1490ABA505EB2E1DEBC9902CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0044C5F6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C5FD
#1165.MFC42U(CNotebookDoc::GetDocumentZoomType,00000000,0000001C,0044D3E7,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044C615
#1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044C634

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

Strings

CNotebookDoc::GetDocumentZoomType, xrefs: 0044C604

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CNotebookDoc::GetDocumentZoomType
API String ID: 3111753120-2459757556
Opcode ID: 3652d243b61292cfcdca3988df8227686bc7a9db92b96c1706d9b3bb6e9be54b
Instruction ID: f9c4254b21dac7c73c92a4dad732e5c682c1bb5692dd440b1cd21dfbe63c8ec7
Opcode Fuzzy Hash: 3652d243b61292cfcdca3988df8227686bc7a9db92b96c1706d9b3bb6e9be54b
Instruction Fuzzy Hash: D031A0316412098FEB00DFA9C9C4BAE77B4AF49300F5A517EE806E7251DB38E909CA25

Uniqueness

Uniqueness Score: -1.00%

Function 004940E9, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,_INIUnescapeInPlace,00000000,00000000,00000800,00000000), ref: 00494126
wcstoul.MSVCRT ref: 00494160

Strings

_INIUnescapeInPlace, xrefs: 0049410B
|BI, xrefs: 004941A6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlenwcstoul
String ID: _INIUnescapeInPlace$|BI
API String ID: 1101440756-4089073464
Opcode ID: 4a0e94e6ef04d25e0573bac8f9230ca2229994ac8dc51f891e8682ae379bfc3b
Instruction ID: 20e9a0f74fff66a2b40392ec48d1be01c4b91b67ed6995a591c0b6d4e7a06620
Opcode Fuzzy Hash: 4a0e94e6ef04d25e0573bac8f9230ca2229994ac8dc51f891e8682ae379bfc3b
Instruction Fuzzy Hash: 5C219532E101199BCB20DFA4DC46ABEB7B8EFA4720F51043BE945D7240EB795986C798

Uniqueness

Uniqueness Score: -1.00%

Function 0044FA2C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044FA33
#521.MFC42U(00000000,CPgIpc::Unregister,00000000,0000001C,0042B85D), ref: 0044FA5E

Part of subcall function 0043549E: #1172.MFC42U(00442724), ref: 0043549E

memmove.MSVCRT ref: 0044FAD3

Strings

CPgIpc::Unregister, xrefs: 0044FA42

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1172#521H_prolog3memmove
String ID: CPgIpc::Unregister
API String ID: 1204444333-2583480137
Opcode ID: 42fd133d518de3ff1465d034eecc393aa5b58839bddd1f35556f38ac4a3ffaee
Instruction ID: 2cca7df0d2b604f4d819b1776d60a45516863073e0683f3c48c62936466cad0b
Opcode Fuzzy Hash: 42fd133d518de3ff1465d034eecc393aa5b58839bddd1f35556f38ac4a3ffaee
Instruction Fuzzy Hash: 01218131A012159FEB04DBA8C841BEE77B5AF44304F54057ED806E7282DF78DA09CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004466EC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004466F3
SysStringLen.OLEAUT32(00000000), ref: 00446769
SysFreeString.OLEAUT32(00000000), ref: 0044678A

Strings

CNotebookDoc::CanUndo, xrefs: 00446700

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: String$FreeH_prolog3
String ID: CNotebookDoc::CanUndo
API String ID: 315669285-2206433394
Opcode ID: 82beb8e997b72f5458c05e193d907abde22f8a7f5ade615be3b3c290ab52e098
Instruction ID: ee861b29103408034ff3bf83fb37ca8e039da8ee7e7afcf939a9535ecc34753f
Opcode Fuzzy Hash: 82beb8e997b72f5458c05e193d907abde22f8a7f5ade615be3b3c290ab52e098
Instruction Fuzzy Hash: 56218E74A01206AFEB10DFA5C884BAF77A4AF46749F15846EA805DB380DB38DD04CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00446884, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044688B
#1165.MFC42U(CNotebookDoc::Undo,?,00000014,0042D54E), ref: 004468CD
#1662.MFC42U ref: 004468D6

Part of subcall function 00435657: memset.MSVCRT ref: 0043566C
Part of subcall function 00435657: TraceEvent.ADVAPI32(0E0227DC,00000000,?,00000002,?,00000000), ref: 004356A5

Strings

CNotebookDoc::Undo, xrefs: 0044689D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#1662EventH_prolog3Tracememset
String ID: CNotebookDoc::Undo
API String ID: 451215350-3663246166
Opcode ID: 3807176a4e37434d75be8941e7d9b4461260dd86bf8f43ac7db7ac07c3b2158d
Instruction ID: 4f0da69fb1927af16cbde671baf4b57288720178b7c23e590255b51693a463db
Opcode Fuzzy Hash: 3807176a4e37434d75be8941e7d9b4461260dd86bf8f43ac7db7ac07c3b2158d
Instruction Fuzzy Hash: 4C21B274601205DFEB04DBA5C945EAE7770EF49314F5440AEE801A73A1CB789E04CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0042A186, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004AFAB3: RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\TabletPC,00000000,?,?,Helpers::RegOpenKeyExW,00000000,?,00000000,?,?,00000000), ref: 004AFAE0

Part of subcall function 004AFC50: RegQueryValueExW.ADVAPI32(80070057,00000000,00000000,00000020,80070057,?,Helpers::RegQueryValueExW,00000000,?,00000000,CNBSettingsMgr::CacheFlushItem,80070057,00000020), ref: 004AFC80

RegCloseKey.ADVAPI32(?,?,00000004,?,00000004,?,?,?,?,?,?,?,0002001F,?,?,PromptForNoteWriterInstall), ref: 0042A22E

Strings

FirstRunNoteWriterPrompt, xrefs: 0042A1E9, 0042A221
PromptForNoteWriterInstall, xrefs: 0042A19C
SOFTWARE\Microsoft\Journal, xrefs: 0042A1B3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: FirstRunNoteWriterPrompt$PromptForNoteWriterInstall$SOFTWARE\Microsoft\Journal
API String ID: 3677997916-2726454245
Opcode ID: 01955f044c12ae0d127b26cabddb28b5d14697638af029c081d6b0aaa98e74e1
Instruction ID: 86efd97fed7ee9a50d1507e6821dc3b1a49c75a0ae5c4024202f03b5184c437c
Opcode Fuzzy Hash: 01955f044c12ae0d127b26cabddb28b5d14697638af029c081d6b0aaa98e74e1
Instruction Fuzzy Hash: 242137B5D0020CFBCB11DB96D984CEEBBBCEB84314F2081ABA815B3241DA795F45CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00465C01, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00465C08

Part of subcall function 00465EED: __EH_prolog3.LIBCMT ref: 00465EF4

Part of subcall function 0046584A: __EH_prolog3.LIBCMT ref: 00465851
Part of subcall function 0046584A: memset.MSVCRT ref: 004658B1

memcpy.MSVCRT ref: 00465C96

Strings

CNBSettingsMgr::Set, xrefs: 00465C1B
W, xrefs: 00465C13

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$memcpymemset
String ID: CNBSettingsMgr::Set$W
API String ID: 3769204024-2027055386
Opcode ID: 677b542c56e2c71a89f1e76f776364922c3e4fc58e3a716d6496fea282a4dfbb
Instruction ID: 2734b4dee6f40789dc6841e034ab136dcaf9f1061e847a200d13db7575ba7a8c
Opcode Fuzzy Hash: 677b542c56e2c71a89f1e76f776364922c3e4fc58e3a716d6496fea282a4dfbb
Instruction Fuzzy Hash: 812135B190071ADBCF15DF95C881AEE7BB4AB14314F01442FE8057B350E739AE41CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0048A5D0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0048A612
CharLowerW.USER32(00000000,00000000,00000104,00000000,?,00000000), ref: 0048A662
PathRemoveBackslashW.SHLWAPI(00000000,?,00000000), ref: 0048A671

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

CNBObject::_HashString, xrefs: 0048A5EC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: BackslashCharLowerMessagePathRemoveTracememset
String ID: CNBObject::_HashString
API String ID: 2924494411-2441320059
Opcode ID: afd2827b7d8ab8d588b4c06027c2a775a612947e8494bfcaf3b87a219f59f420
Instruction ID: 92a38fcf0bd6ec027527001ade74545ba0e8c5ed61fd44f7eabd9099ecadddf1
Opcode Fuzzy Hash: afd2827b7d8ab8d588b4c06027c2a775a612947e8494bfcaf3b87a219f59f420
Instruction Fuzzy Hash: 741138326001189AD720EB55DC48BEF7778DF50314F0505ABE94493291EFB8CD81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004425EB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004425F2
GetDeviceCaps.GDI32(00000000,00000008), ref: 0044266E
MulDiv.KERNEL32(00000000,?,00000064), ref: 00442686

Strings

CNotebookApp::GetInkTitleSize, xrefs: 004425FF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDeviceH_prolog3
String ID: CNotebookApp::GetInkTitleSize
API String ID: 1216718216-343232612
Opcode ID: b7875eb1cff80c75d652d1598b81870bf15d02f5981226eed5a17115cb867284
Instruction ID: a166a037e182082ee2f4b4a046bf1392c8b59f48474ae467113c4968c50f6e76
Opcode Fuzzy Hash: b7875eb1cff80c75d652d1598b81870bf15d02f5981226eed5a17115cb867284
Instruction Fuzzy Hash: 12216271A002159BDB14DFA5C941AEEB7B4AF08710F14447FFD05FB245DAB85A40CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004A09E6, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A09ED
#641.MFC42U(CCorrectionUI::~CCorrectionUI,00000000,0000000C,00447DEC,?), ref: 004A0AC3

Strings

CCorrectionUI::~CCorrectionUI, xrefs: 004A0A03
|K, xrefs: 004A0AB2

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #641H_prolog3
String ID: CCorrectionUI::~CCorrectionUI$|K
API String ID: 451782429-637860822
Opcode ID: 434b8712845e6b2d98e3f7d549e91b5016c549d4e73f1e5cad80e65dce1eb951
Instruction ID: 3d55f3278cd1fe3322a6fa12c39bbd555055c6ce88672059eb344defef415e2e
Opcode Fuzzy Hash: 434b8712845e6b2d98e3f7d549e91b5016c549d4e73f1e5cad80e65dce1eb951
Instruction Fuzzy Hash: F921F430501305DFD710EF75D885BEEBBA0AF25304F5085AEE45697282DB786A05CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00435237, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

#2371.MFC42U(CMainFrame::OnSizing,00000000,0E0227DC), ref: 00435289
GetClientRect.USER32 ref: 0043529A
InvalidateRect.USER32(?,?,00000000), ref: 004352D6

Strings

CMainFrame::OnSizing, xrefs: 00435279

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$#2371ClientInvalidate
String ID: CMainFrame::OnSizing
API String ID: 3666969870-3512435340
Opcode ID: 4202e967496162e71b067829febe750f780ca0ea9afb1b77eb7655837fb0b89d
Instruction ID: 2b3d766246177ffa6a5a1193b72d07f48b404a0058ca9867bcc997f2107e1e95
Opcode Fuzzy Hash: 4202e967496162e71b067829febe750f780ca0ea9afb1b77eb7655837fb0b89d
Instruction Fuzzy Hash: 0C2153726187459FD315DF25DC81A6BBBE8FB94324F10092FF46283290DB34A905CF56

Uniqueness

Uniqueness Score: -1.00%

Function 004312DE, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004312E5
#1165.MFC42U(CMainFrame::SetCurrentFlag,00000000,0000000C,0042D181,00000004,00000001), ref: 0043130C

Part of subcall function 0044E0AC: __EH_prolog3.LIBCMT ref: 0044E0B3
Part of subcall function 0044E0AC: #1165.MFC42U(CNBDocViewCtrl::SetActionState,?,CNotebookView::SetActionState,00000000,00000018,0044D595,00000000,?,00000000), ref: 0044E131

#1165.MFC42U(00009CEB,?,000000A8,?,?,CMainFrame::SetCurrentFlag,00000000,0000000C,0042D181,00000004,00000001), ref: 00431384

Strings

CMainFrame::SetCurrentFlag, xrefs: 004312F4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CMainFrame::SetCurrentFlag
API String ID: 3111753120-771667809
Opcode ID: 77d7b5272eb1bc48995a6429633da66d56dda2e126ff4ed3367d6f98b5108d86
Instruction ID: a9bc71dd425513154dcadbcefbe5de5aeb31949a39f4a12caeeac84a8988301b
Opcode Fuzzy Hash: 77d7b5272eb1bc48995a6429633da66d56dda2e126ff4ed3367d6f98b5108d86
Instruction Fuzzy Hash: 5A11D2316005059BF714E751CC0AFFEB260AB48709F58402FA91A5B6E1DE7CAD06CF2E

Uniqueness

Uniqueness Score: -1.00%

Function 0049232D, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00492337
lstrlenW.KERNEL32(00000000,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00492382

Part of subcall function 004943BA: __EH_prolog3.LIBCMT ref: 004943C1

Part of subcall function 00494CA5: memset.MSVCRT ref: 00494CF6

Strings

CNBNotebook::GetLastOpenedPage, xrefs: 00492348
LastOpenedPage, xrefs: 004923A9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3H_prolog3_lstrlenmemset
String ID: CNBNotebook::GetLastOpenedPage$LastOpenedPage
API String ID: 1133043591-1229501487
Opcode ID: d34c5433580bde84b6588417902b15f317d4a8c17b4650feb10bcc24cb369b45
Instruction ID: f66ac005220f3f8df6e9caade96d9c99430c14ddd19698478efa2d80cc050f5b
Opcode Fuzzy Hash: d34c5433580bde84b6588417902b15f317d4a8c17b4650feb10bcc24cb369b45
Instruction Fuzzy Hash: 9C218030A02115ABDB25EB65CA99E9E7B60AF10304F1540FEEC0497251CBBCDF85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00494CA5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00494CF6
lstrlenW.KERNEL32(?,?,?,00000040,?,00000000), ref: 00494D36
_wtoi.MSVCRT ref: 00494D47

Strings

CNBFileSettings::ReadValueLong, xrefs: 00494CD3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: _wtoilstrlenmemset
String ID: CNBFileSettings::ReadValueLong
API String ID: 3383256295-4248094910
Opcode ID: 387a9afe9718b3c7e1aabdc48259a39a204674b17eaf4aa5d16d22d726259b8e
Instruction ID: 7e06a28a5c1eee1e5e68ce5d42d50fb8f88e145ca55a424b2c5e15c0c4e7ba86
Opcode Fuzzy Hash: 387a9afe9718b3c7e1aabdc48259a39a204674b17eaf4aa5d16d22d726259b8e
Instruction Fuzzy Hash: 7E216F729001289BDF20DB65DC45FDAB7B8FB44710F4080AAE948E3241DF789E458FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00443AFC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00443B03
SHGetMalloc.SHELL32(00000000), ref: 00443B2B
memcpy.MSVCRT ref: 00443B82

Strings

CNotebookApp::SetLastBrowsePIDL, xrefs: 00443B0C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3Mallocmemcpy
String ID: CNotebookApp::SetLastBrowsePIDL
API String ID: 2128166838-229866520
Opcode ID: 343af3d0f7ed673259997156150b0ee115501ba9fce2ccd258c545d0ede7ab93
Instruction ID: 296ba60e5cdcbbfc1197b6c62cafda2764da9a982a38bf55ca135015ae2c55db
Opcode Fuzzy Hash: 343af3d0f7ed673259997156150b0ee115501ba9fce2ccd258c545d0ede7ab93
Instruction Fuzzy Hash: AC216270A00249AFDB04DFA5CC48BEFB775FF44309F14886EA4159B281DB79EA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00446017, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00446021
memset.MSVCRT ref: 00446060

Part of subcall function 004796DC: __EH_prolog3.LIBCMT ref: 004796E3
Part of subcall function 004796DC: #1165.MFC42U(W_SetWaitMode,00000000,0000000C,00445E7F), ref: 004796FD

Part of subcall function 0047B674: PathFileExistsW.SHLWAPI(00000000,G_IsFileAvailable,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0047B6A0
Part of subcall function 0047B674: GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 0047B6AA

#1165.MFC42U ref: 004460CE

Strings

CNotebookDoc::VerifySourceFileAvailableWithUI, xrefs: 00446031

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$ErrorExistsFileH_prolog3H_prolog3_LastPathmemset
String ID: CNotebookDoc::VerifySourceFileAvailableWithUI
API String ID: 4068676798-3767479376
Opcode ID: 13b7e83a046492a0fba64c7123dd2cd72f47b60856212016cc954ae528c0a203
Instruction ID: a89b5e7940780a96c249161778701ab2e497fd112e4ff57dcd20797a3a7fc0f4
Opcode Fuzzy Hash: 13b7e83a046492a0fba64c7123dd2cd72f47b60856212016cc954ae528c0a203
Instruction Fuzzy Hash: 7621A170A00218ABDF64EBA1DC49BEE7374AF49314F0101EFA109A7191DE789E85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00457379, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00457383
SendMessageW.USER32(?,0000040B,?,00000064), ref: 00457433

Strings

CNBReBar::SetDefaultBandInfo, xrefs: 0045739A
d, xrefs: 004573B0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_MessageSend
String ID: CNBReBar::SetDefaultBandInfo$d
API String ID: 591282594-1492739077
Opcode ID: e1b167052a874b702fb4150db9728b2ed4720d689934a554347f5964ce204db8
Instruction ID: e446963397ed3cef812177f54b606634162ad1b5326624547b07103c862ae6bc
Opcode Fuzzy Hash: e1b167052a874b702fb4150db9728b2ed4720d689934a554347f5964ce204db8
Instruction Fuzzy Hash: 8921B771900229DFDF10DFA9C985ADDBBB4FF08304F0080AAE949E7251DB34A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004A8083, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004A808D

Part of subcall function 00495315: memset.MSVCRT ref: 00495337

memset.MSVCRT ref: 004A80F3

Part of subcall function 004A75DA: __EH_prolog3_GS.LIBCMT ref: 004A75E4
Part of subcall function 004A75DA: memset.MSVCRT ref: 004A762F

Part of subcall function 00442CAC: __EH_prolog3_GS.LIBCMT ref: 00442CB6
Part of subcall function 00442CAC: memset.MSVCRT ref: 00442CF8
Part of subcall function 00442CAC: memset.MSVCRT ref: 00442D16
Part of subcall function 00442CAC: GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 00442D2B
Part of subcall function 00442CAC: memset.MSVCRT ref: 00442D75
Part of subcall function 00442CAC: lstrlenW.KERNEL32(?), ref: 00442DC2

Strings

CNotebookApp::_CreateRecoveryInstanceIfNeeded, xrefs: 004A80A6
,TD, xrefs: 004A80CF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$H_prolog3_$FileModuleNamelstrlen
String ID: ,TD$CNotebookApp::_CreateRecoveryInstanceIfNeeded
API String ID: 678446266-2746328581
Opcode ID: 539f51a33dcaac408ee8f87193fa9114ffbeee838465177253917ff4dd5f89a9
Instruction ID: 3aeffee1b50a9ed70b6b7b64be42459ee167662e2544a8d8a712f976f018c875
Opcode Fuzzy Hash: 539f51a33dcaac408ee8f87193fa9114ffbeee838465177253917ff4dd5f89a9
Instruction Fuzzy Hash: 0B219FB1D001299ACB20EF65CC81BCD77B4AF14708F5001EEA64D67142EF389E85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00449152, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00449159
memset.MSVCRT ref: 00449186

Strings

CNotebookDoc::GetInkSelectionFormat, xrefs: 00449166
P, xrefs: 004491AF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3memset
String ID: CNotebookDoc::GetInkSelectionFormat$P
API String ID: 747782440-531333927
Opcode ID: 01d79010f7061a6232074249dcfb8e66725bae04722618cc87002aca082d575d
Instruction ID: 8d9131840c60e5cdb412845e631015389716c3a9135fd535f64e30585c4d3a91
Opcode Fuzzy Hash: 01d79010f7061a6232074249dcfb8e66725bae04722618cc87002aca082d575d
Instruction Fuzzy Hash: 23112C70D0122A9FEB10DF91C945AAFBBB8AF04748F14416AEC05BB341DB789E05DBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00464995, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,Version,00000000,00020019,?,CNBSettingsMgr::IsCorrectVersion,00000000,?,00000000,00000000,?,CNBSettingsMgr::Get,0E0227DC), ref: 004649CB
RegCloseKey.ADVAPI32(00000000,?,CNBSettingsMgr::Get,0E0227DC), ref: 00464A16

Part of subcall function 00435542: RegQueryValueExW.ADVAPI32(?,004649F1,00000000,00000000,?,?,?,?,?,004649F1), ref: 00435566

Strings

CNBSettingsMgr::IsCorrectVersion, xrefs: 004649A6
Version, xrefs: 004649BD

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: CNBSettingsMgr::IsCorrectVersion$Version
API String ID: 3677997916-1649224580
Opcode ID: d2a9ae5b0a223ee8a1053cb9af9a1aa260fc5b9f4616b4320157b2a11bda027e
Instruction ID: eb0be86f0748d78c62f4e9e0bbc3d3813b27ab9f9b925f0bd6ddf81874cb8b50
Opcode Fuzzy Hash: d2a9ae5b0a223ee8a1053cb9af9a1aa260fc5b9f4616b4320157b2a11bda027e
Instruction Fuzzy Hash: DF11423190122AFF8F10DF95D8848AFBB78EF44758B11412BF915A7201D734DA45DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 004B045B, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 004B049E
GetLastError.KERNEL32(?,?,00000000), ref: 004B04AA

Strings

Helpers::CreateWindowExW, xrefs: 004B0471
SCROLLBAR, xrefs: 004B049C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastWindow
String ID: Helpers::CreateWindowExW$SCROLLBAR
API String ID: 3732789607-1676729247
Opcode ID: 758b8344aa94045dfc45a97a59a551708fc8870b492df30589fe14154d0c2953
Instruction ID: 2db7ee6f00cdb5c71f1ff51e1f1ca39c7f2346b76900a9e452a920eb6add0177
Opcode Fuzzy Hash: 758b8344aa94045dfc45a97a59a551708fc8870b492df30589fe14154d0c2953
Instruction Fuzzy Hash: 62118232500119ABCF169F95DD04EEF3FA5EF48319F15415AFF0896260CB3AD861DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004BD9A6, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

PathAddBackslashW.SHLWAPI(?,InstallJNW,00000000,00000000,7519F5E0,00000000,?,?,00477966), ref: 004BD9C4

Part of subcall function 004BD7EF: LoadLibraryW.KERNEL32(?,jnwdui.dll,?,LoadPrinterNameString,00000000,?,7519F5E0,00000000), ref: 004BD8FC
Part of subcall function 004BD7EF: FreeLibrary.KERNEL32(00000000,004D6440,00000104,00000000), ref: 004BD93F

Part of subcall function 004BD730: GetLastError.KERNEL32 ref: 004BD791

Part of subcall function 004BCB73: memset.MSVCRT ref: 004BCBB2
Part of subcall function 004BCB73: memset.MSVCRT ref: 004BCBC3
Part of subcall function 004BCB73: memset.MSVCRT ref: 004BCBD4
Part of subcall function 004BCB73: memset.MSVCRT ref: 004BCBE5
Part of subcall function 004BCB73: memset.MSVCRT ref: 004BCBF6
Part of subcall function 004BCB73: memset.MSVCRT ref: 004BCC07
Part of subcall function 004BCB73: ExpandEnvironmentStringsW.KERNEL32(?,?,00000208), ref: 004BCC29
Part of subcall function 004BCB73: GetLastError.KERNEL32(?,?,00000208), ref: 004BCC6A
Part of subcall function 004BCB73: DeleteFileW.KERNEL32(?), ref: 004BCEEA

Part of subcall function 004BCF21: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 004BCF99
Part of subcall function 004BCF21: CopyFileW.KERNEL32(?,?,00000000,jnwmon.dll,004011BC), ref: 004BCFEB
Part of subcall function 004BCF21: GetLastError.KERNEL32 ref: 004BD004
Part of subcall function 004BCF21: GetLastError.KERNEL32 ref: 004BD0AD

Part of subcall function 004BD245: GetComputerNameW.KERNEL32 ref: 004BD27C

Part of subcall function 004BD103: GetComputerNameW.KERNEL32 ref: 004BD13A
Part of subcall function 004BD103: GetLastError.KERNEL32 ref: 004BD1FA

Part of subcall function 004BD580: CopyFileW.KERNEL32(?,?,00000000,jnwppr.dll,004011BC,?,jnwppr.dll,?), ref: 004BD664
Part of subcall function 004BD580: GetLastError.KERNEL32 ref: 004BD680

Part of subcall function 004BD346: memset.MSVCRT ref: 004BD36D
Part of subcall function 004BD346: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(O:BAG:DUD:(D;;LCSWSDRCWDWO;;;NU)(D;OIIO;RPSDRCWDWO;;;NU)(A;OI;LCSWSDRCWDWO;;;BA)(A;CIIO;RC;;;CO)(A;OIIO;RPSDRCWDWO;;;CO)(A;OI;SWRC,00000001,004BDA2D,00000000), ref: 004BD3A0
Part of subcall function 004BD346: GetLastError.KERNEL32 ref: 004BD3D0
Part of subcall function 004BD346: GetLastError.KERNEL32 ref: 004BD472

Strings

JournalPrint, xrefs: 004BDA0E
InstallJNW, xrefs: 004BD9B6
Journal Note Port, xrefs: 004BD9E4

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$memset$File$ComputerCopyDescriptorLibraryNameSecurity$BackslashConvertDeleteDirectoryEnvironmentExpandFreeLoadPathStringStringsSystem
String ID: InstallJNW$Journal Note Port$JournalPrint
API String ID: 2231457659-4075269659
Opcode ID: c00c067c4b8ab4dce1f4f17adf5ee9020bda03db609b22e4b70eea3f5e3d46e0
Instruction ID: e37071ff988f96cf91ec6ea65ac10de3dfe39c815e11e6923bd209a9eabf5d83
Opcode Fuzzy Hash: c00c067c4b8ab4dce1f4f17adf5ee9020bda03db609b22e4b70eea3f5e3d46e0
Instruction Fuzzy Hash: 8B017172E061242746227B7B5C96AFFB65D9A8879830501BFBD01A7241FE5C8C0141FE

Uniqueness

Uniqueness Score: -1.00%

Function 00492414, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0049241E
lstrlenW.KERNEL32(00000000), ref: 00492477

Part of subcall function 004943BA: __EH_prolog3.LIBCMT ref: 004943C1

Strings

LastOpenedPage, xrefs: 004924A5, 004924B2
CNBNotebook::SetLastOpenedPage, xrefs: 00492435

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3H_prolog3_lstrlen
String ID: CNBNotebook::SetLastOpenedPage$LastOpenedPage
API String ID: 850430076-630964460
Opcode ID: 47e68881e0ed8f099ba117b402bffc5618eabfa00852c300c95fdd5fc57502b6
Instruction ID: 6ddb7c5998ea2913d38eaa6f5856759667805c415d0c34511d5d65d75522ddb9
Opcode Fuzzy Hash: 47e68881e0ed8f099ba117b402bffc5618eabfa00852c300c95fdd5fc57502b6
Instruction Fuzzy Hash: 0F111231902229ABCF21EF65C985ADD7B64AF10304F1441EAF80567151DB7C9F85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0046584A, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00465851
memset.MSVCRT ref: 004658B1

Strings

CNBSettingsMgr::CacheCreateItem, xrefs: 00465863
W, xrefs: 0046585B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3memset
String ID: CNBSettingsMgr::CacheCreateItem$W
API String ID: 747782440-3060949296
Opcode ID: 107bf82823203b1c4f7d8353ef3569b5a41c81c87f339f2ddc591db8cdc093a7
Instruction ID: e1927ce740e159a4a8814b2cc2193ef6fd1ed8d7567d989d3ba6e9e8b564340d
Opcode Fuzzy Hash: 107bf82823203b1c4f7d8353ef3569b5a41c81c87f339f2ddc591db8cdc093a7
Instruction Fuzzy Hash: E211D2B0900206DFDB10DF51D940BAAB7B0AF14318F20843BE505AB6A1D77DDE58CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0044FDBB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044FDC2
#521.MFC42U(00000000,CPgIpc::GetFirstEmptyProcess,00000000,0000001C,00441D6E,CNotebookApp::NewNote,?,00000010,0042D258,?), ref: 0044FDEC

Part of subcall function 0043549E: #1172.MFC42U(00442724), ref: 0043549E

IsWindowEnabled.USER32(00000000), ref: 0044FE39

Strings

CPgIpc::GetFirstEmptyProcess, xrefs: 0044FDD2

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1172#521EnabledH_prolog3Window
String ID: CPgIpc::GetFirstEmptyProcess
API String ID: 4165790496-3746810984
Opcode ID: 2db64605756b7c339386a0306af452bdc74df0b85426772062c4572f12ad4ddd
Instruction ID: 00bc91d0bfc975dd569fb924aaf27eb05d1b2e73a2ed545fbad7de52c584797a
Opcode Fuzzy Hash: 2db64605756b7c339386a0306af452bdc74df0b85426772062c4572f12ad4ddd
Instruction Fuzzy Hash: 4A11D330900115DFEB11EBA5C946BEE77B0AF15305F1400BFE411A31A2DF3C9A49C769

Uniqueness

Uniqueness Score: -1.00%

Function 0044FE6E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044FE78
memset.MSVCRT ref: 0044FED2
SendMessageW.USER32(00000000,0000004A,00000000,00000001), ref: 0044FF2A

Strings

CPgIpc::OpenInProcess, xrefs: 0044FE91

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_MessageSendmemset
String ID: CPgIpc::OpenInProcess
API String ID: 2681937981-3976986572
Opcode ID: cd6eb56c11db79f18dae0600dd828a13959be51f17dd1555fd251a1c7174b830
Instruction ID: b41bc9d4f9deeec271d54da0c6ad5aba7711ae53927a8c3762642f16a85db67c
Opcode Fuzzy Hash: cd6eb56c11db79f18dae0600dd828a13959be51f17dd1555fd251a1c7174b830
Instruction Fuzzy Hash: A7213375901129ABDB21EF55DC89ADEB774EF08314F1040EAF808A7251DB789F85CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00483502, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

ImageList_Destroy.COMCTL32(?), ref: 00483578
ImageList_Remove.COMCTL32(?,000000FF), ref: 00483586

Strings

CImageCache::_EmptyTable, xrefs: 00483543
CImageCache::EmptyCache, xrefs: 00483538

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ImageList_$DestroyRemove
String ID: CImageCache::EmptyCache$CImageCache::_EmptyTable
API String ID: 3032186281-275607284
Opcode ID: d31b7e30b805cc06b4a130b50cf3994f671ca651a9b569a1b77f70acf1038511
Instruction ID: bbb6d9676dc0914b08ec1145d45d69f6d420e8cca81312af5779d45391ff683e
Opcode Fuzzy Hash: d31b7e30b805cc06b4a130b50cf3994f671ca651a9b569a1b77f70acf1038511
Instruction Fuzzy Hash: E1115471108741ABC720EF26D845E5BB7E8EB95B24F144B2FB466932C0DB789504CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00433E61, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00433E68
#1165.MFC42U(CMainFrame::CancelInProgressInkStroke,?,00000014,0042D999,?,?,?,?,?,?,?,?,?,?,?,004BFB86), ref: 00433E8C
#1165.MFC42U(?,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00433E99

Part of subcall function 0042985B: __EH_prolog3.LIBCMT ref: 00429862

Strings

CMainFrame::CancelInProgressInkStroke, xrefs: 00433E73

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CMainFrame::CancelInProgressInkStroke
API String ID: 2221090558-2870672254
Opcode ID: b512dbdba3b58b5dabf7bc2c7c07dbeece781a9a6ef4bb0ce2fcb49a9dd0791a
Instruction ID: 5c434e15215b2dd4dbc04cf9e034628dccb575d070dc6cf83ae9f46cc1a2b1c8
Opcode Fuzzy Hash: b512dbdba3b58b5dabf7bc2c7c07dbeece781a9a6ef4bb0ce2fcb49a9dd0791a
Instruction Fuzzy Hash: B7113D70E01219CFCB00DFA5C995AAE7BB4AF08305F1400AEE805EB351DB38AE05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00446966, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044696D
#1165.MFC42U(CNotebookDoc::Redo,?,00000014,0042D53C), ref: 00446990
#1662.MFC42U ref: 00446999

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

Strings

CNotebookDoc::Redo, xrefs: 0044697F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#1662H_prolog3
String ID: CNotebookDoc::Redo
API String ID: 280062859-1272603662
Opcode ID: 10c847d075f8187427a53a6aa0453ac3540ecb617214cf6fddc7419e422e4efe
Instruction ID: fa9a435dbdfebfd2b0ac703a2559fdc668f243c8da9bd94b08e7cc571e7c51c0
Opcode Fuzzy Hash: 10c847d075f8187427a53a6aa0453ac3540ecb617214cf6fddc7419e422e4efe
Instruction Fuzzy Hash: 511182B4A01216DFEB04DBA5C955ABE7B74AF0A315F1440AEE402A7391CB789E04CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00465B59, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00465B60
lstrlenW.KERNEL32(?,CNBSettingsMgr::Get,00000000,0000000C,00464A66,80070057,00000061,CNBSettingsMgr::GetAppRegistryKey,00000000,0000000C,0046516D), ref: 00465BA5

Part of subcall function 00464F8C: __EH_prolog3.LIBCMT ref: 00464F93
Part of subcall function 00464F8C: #1165.MFC42U(CNBSettingsMgr::OpenAppRegKey,80070057,00000010,00465BB7,00000000), ref: 00464FE2
Part of subcall function 00464F8C: #2885.MFC42U ref: 00464FEB
Part of subcall function 00464F8C: SHDeleteKeyW.SHLWAPI(00000000,?,00000000,-0040CB30), ref: 0046501C
Part of subcall function 00464F8C: #1165.MFC42U ref: 00465030
Part of subcall function 00464F8C: #2885.MFC42U ref: 00465039

Strings

CNBSettingsMgr::Get, xrefs: 00465B72
W, xrefs: 00465B6A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#2885H_prolog3$Deletelstrlen
String ID: CNBSettingsMgr::Get$W
API String ID: 2215388424-3987888216
Opcode ID: e99e6bc8ff9fa513b7c419d178b851b7cba48409bbbe17b07caaf27d3c31aea7
Instruction ID: 1ae4bef4289882d8020c1c64156b48cdf8cddad4575a99d8033c1be7cce437ae
Opcode Fuzzy Hash: e99e6bc8ff9fa513b7c419d178b851b7cba48409bbbe17b07caaf27d3c31aea7
Instruction Fuzzy Hash: A611BF31900626CFCB009F54C855ABEB7B4FF04B50F05856BE805AF250E778AE05CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 00434461, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

#1165.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,004BFA0E,000000FF), ref: 004344A5

Part of subcall function 0047CD98: __EH_prolog3.LIBCMT ref: 0047CD9F

SysFreeString.OLEAUT32(00000000), ref: 004344CA
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 004344DF

Strings

CMainFrame::OnAppPrintDirect, xrefs: 00434492

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165FreeH_prolog3MessagePostString
String ID: CMainFrame::OnAppPrintDirect
API String ID: 2824454508-533896815
Opcode ID: 96cdf1c0e37cef087f21de63115dfa1fc27c92e02a91ff99b12b983ddaa009ff
Instruction ID: 49325e93e49ff66d0f3e8fc4b3a381e8632f418d5b3cf28a26eaba18cc088061
Opcode Fuzzy Hash: 96cdf1c0e37cef087f21de63115dfa1fc27c92e02a91ff99b12b983ddaa009ff
Instruction Fuzzy Hash: 4711E531204204AFD710DF15DD46F56B7A4FB54725F10823EF515972E1EB79B804CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00459D87, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00459D91
memset.MSVCRT ref: 00459DE0
#3870.MFC42U(?,00000040), ref: 00459DF3

Part of subcall function 00459E2E: iswspace.MSVCRT ref: 00459E89

Strings

CNBToolbar::GetReplacementCtrlValue, xrefs: 00459DA4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #3870H_prolog3_iswspacememset
String ID: CNBToolbar::GetReplacementCtrlValue
API String ID: 1187468222-899282505
Opcode ID: 2d0d624ba031b470fae93d9f53ee89d8e1d974b7ed480b971cdc4ad234957ee0
Instruction ID: f335e8b56a1fd58664e2c8f69b8173f48af2247e21b095a844794ff162c0e261
Opcode Fuzzy Hash: 2d0d624ba031b470fae93d9f53ee89d8e1d974b7ed480b971cdc4ad234957ee0
Instruction Fuzzy Hash: 6C018871901124DBDB20DB75CC46FAB77689F14714F0441AFA90CAB383EA389D49CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 004659D3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004659DA
lstrlenW.KERNEL32(00000003,00000010,0047A43B,?,00000104,00000064,?,?,?,?,?,?,?,?,00465982,?), ref: 00465A35

Strings

W, xrefs: 004659E4
CNBSettingsMgr::Get, xrefs: 004659EC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3lstrlen
String ID: CNBSettingsMgr::Get$W
API String ID: 3073243474-3987888216
Opcode ID: edac6af523ca6acad2f721580592c261ea0b3fb8faff7113d9b6eaa95ef209ce
Instruction ID: 95c831cd547d0181995bb27e6bd1fc7debc9436fb99311f58815719dbf9783e7
Opcode Fuzzy Hash: edac6af523ca6acad2f721580592c261ea0b3fb8faff7113d9b6eaa95ef209ce
Instruction Fuzzy Hash: A2118F31901626DBCB15DB90C985ABE7761AF10714F24426FE8167B280EB3C5F4587EA

Uniqueness

Uniqueness Score: -1.00%

Function 0044E23C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044E243
#1165.MFC42U(CNotebookView::AutoShowPageBar,00000000,0000000C,0044134C), ref: 0044E266
#1165.MFC42U(00000003,00000003), ref: 0044E288

Part of subcall function 004292F7: __EH_prolog3.LIBCMT ref: 004292FE

Part of subcall function 0042994E: __EH_prolog3.LIBCMT ref: 00429955

Strings

CNotebookView::AutoShowPageBar, xrefs: 0044E250

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165
String ID: CNotebookView::AutoShowPageBar
API String ID: 2986221888-1409127747
Opcode ID: 09a403e089267bfa65c4722f6d3903aa2f691988c0ac5096bf4c5e37c2b17bdb
Instruction ID: 66f779c4a4c38e82116842981045dbb42ee0cf9bde7356cf55b4d400ce824128
Opcode Fuzzy Hash: 09a403e089267bfa65c4722f6d3903aa2f691988c0ac5096bf4c5e37c2b17bdb
Instruction Fuzzy Hash: 3D111F71A0021AABEB04EFE3CC91AAEB768BB04314F40057FD61656181DBB9A545C769

Uniqueness

Uniqueness Score: -1.00%

Function 0044E0AC, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044E0B3
#1165.MFC42U(CNBDocViewCtrl::SetActionState,?,CNotebookView::SetActionState,00000000,00000018,0044D595,00000000,?,00000000), ref: 0044E131

Part of subcall function 00435657: memset.MSVCRT ref: 0043566C
Part of subcall function 00435657: TraceEvent.ADVAPI32(0E0227DC,00000000,?,00000002,?,00000000), ref: 004356A5

Strings

CNotebookView::SetActionState, xrefs: 0044E0C0
CNBDocViewCtrl::SetActionState, xrefs: 0044E0FC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165EventH_prolog3Tracememset
String ID: CNBDocViewCtrl::SetActionState$CNotebookView::SetActionState
API String ID: 2757574617-3020980919
Opcode ID: ab46aff14909009f9ed362a5ba417d9342b14f7675432a572c5aaeca486e24bc
Instruction ID: dfd073215b6c4d1348035a02d2cfa0ba557a74f137371a88a78645d756bb5139
Opcode Fuzzy Hash: ab46aff14909009f9ed362a5ba417d9342b14f7675432a572c5aaeca486e24bc
Instruction Fuzzy Hash: BE115174601205AFDB14EBA2C981EEE7774EF14308F10806EF91567292DB79AE04CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0047B3A4, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0047B3E6
PathStripToRootW.SHLWAPI(?,?,00000104,00000000,00000000,00000000), ref: 0047B407
GetDriveTypeW.KERNEL32(?), ref: 0047B419

Strings

G_IsFileOnLocalDrive, xrefs: 0047B3C0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: DrivePathRootStripTypememset
String ID: G_IsFileOnLocalDrive
API String ID: 2317698278-1798284575
Opcode ID: c41c30cb4efa45c48d8a395edcb6c93ca3f9c82fbbfc104a4fb106ef52b68f1a
Instruction ID: 5ea9908575d7e3eb089dbd06a7c3a0a104bcb73f8b3430eca63183d0ab2d86d9
Opcode Fuzzy Hash: c41c30cb4efa45c48d8a395edcb6c93ca3f9c82fbbfc104a4fb106ef52b68f1a
Instruction Fuzzy Hash: 3C01D27190011C5BDB20EB62DC8DAEE7378EBA1310F0004AEE819D3191DF789E898A98

Uniqueness

Uniqueness Score: -1.00%

Function 0048A3F7, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49timeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0048A3FE
FileTimeToSystemTime.KERNEL32(00100000,?,CNBObject::_AddPropertyDate,?,00000024,0048C7A2,000A0007,00000014,001C0003,?,001A0003,00000000,CNBFileObject::_SetFileAttributeProps,00000000,00000010,0048EE8C), ref: 0048A434
GetLastError.KERNEL32 ref: 0048A43E

Strings

CNBObject::_AddPropertyDate, xrefs: 0048A413

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$ErrorFileH_prolog3_LastSystem
String ID: CNBObject::_AddPropertyDate
API String ID: 2410112924-1773226987
Opcode ID: 7876cfe6013567247fe48ba0dc161e56d8b2494d860b69c7b1e47c2488614ab5
Instruction ID: 3e2e115d1cb6fa8f7b6616e6e40110a28924b0d36cfd4cf23d5a429e430fb799
Opcode Fuzzy Hash: 7876cfe6013567247fe48ba0dc161e56d8b2494d860b69c7b1e47c2488614ab5
Instruction Fuzzy Hash: 7B016D36D01528AFEF00EBA4C844AEDB7B4AF08B24F15006BE905F7200D7AC9D0587AE

Uniqueness

Uniqueness Score: -1.00%

Function 004671B2, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004671B9
#609.MFC42U(CPageSettingsPropSheet::~CPageSettingsPropSheet,00000000,0000000C,00432F5F,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00467224

Strings

CPageSettingsPropSheet::~CPageSettingsPropSheet, xrefs: 004671CF
nF, xrefs: 004671C3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #609H_prolog3
String ID: nF$CPageSettingsPropSheet::~CPageSettingsPropSheet
API String ID: 3118699627-1869408708
Opcode ID: 7b2dd34e4593f03ab391a65abb864617f54ad9050649e88a400c168b095f28b2
Instruction ID: 446e8b59e2e96aa0cee12cad6ff2ebdde9c5de3efecf76a7b57c92895a0ac1a8
Opcode Fuzzy Hash: 7b2dd34e4593f03ab391a65abb864617f54ad9050649e88a400c168b095f28b2
Instruction Fuzzy Hash: D511AF30505345DADB24DFB5C455BADFBE0BF10308F10849EA09697291DF785A08CB26

Uniqueness

Uniqueness Score: -1.00%

Function 004AFA28, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,0000800D,00000000,?), ref: 004AFA53
GetLastError.KERNEL32(?,00464EE4,?), ref: 004AFA5F

Strings

NF, xrefs: 004AFA43, 004AFA9C
Helpers::PostMessageW, xrefs: 004AFA3E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMessagePost
String ID: Helpers::PostMessageW$NF
API String ID: 4052957616-3576235974
Opcode ID: cb808137884b9fec833f434e5279f3fb2a6aa2387835bc04ab71c088ffc40b71
Instruction ID: 08aabb4e90ee37e89686d39a5dc6c7ee187bf2d6e80d25b0af7efa9c6a52d959
Opcode Fuzzy Hash: cb808137884b9fec833f434e5279f3fb2a6aa2387835bc04ab71c088ffc40b71
Instruction Fuzzy Hash: 6A01F535500115ABC7259B96CC44FFF7BA8AB51314F20407FF908D6261CB3AC951C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00444D8B, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

#4817.MFC42U(CNotebookDoc::OnNewDocument,00000000,0E0227DC), ref: 00444DD1
#1165.MFC42U ref: 00444DE1
#1165.MFC42U ref: 00444DEC

Part of subcall function 0042C541: __EH_prolog3_GS.LIBCMT ref: 0042C54B
Part of subcall function 0042C541: #540.MFC42U(CMainFrame::OnDocTitleChange,00000000,000002CC,00444F91,?,00000104,?,?,?,?,?,?), ref: 0042C56E
Part of subcall function 0042C541: #1165.MFC42U(?,?,?,?,?,?), ref: 0042C57A
Part of subcall function 0042C541: #4155.MFC42U(0000EF20,?,?,?,?,?,?), ref: 0042C5BA
Part of subcall function 0042C541: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 0042C5DF
Part of subcall function 0042C541: #6868.MFC42U(004048FC,?,?,?,?,?,?,?), ref: 0042C5FE
Part of subcall function 0042C541: #6195.MFC42U(?,?,?,?,?,?,?), ref: 0042C60C
Part of subcall function 0042C541: #800.MFC42U(?,?,?,?,?,?), ref: 0042C61C

Strings

CNotebookDoc::OnNewDocument, xrefs: 00444DC1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#4155#4817#540#6195#6868#800FileH_prolog3_Info
String ID: CNotebookDoc::OnNewDocument
API String ID: 3825914346-823229372
Opcode ID: 52a8ebb09001548b602a8e55e7040f5c49633e8038845cd593c6f8ffb1428c2d
Instruction ID: 02c40371aeb4b151b257b2d1285f92e625af755915a7ff98e9ab08c4b416a283
Opcode Fuzzy Hash: 52a8ebb09001548b602a8e55e7040f5c49633e8038845cd593c6f8ffb1428c2d
Instruction Fuzzy Hash: FF0192726086609FC314DF19DD45A57BBE8FB94620F14423FF815C32A1DF78A800CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043226D, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00432274
#1165.MFC42U(CMainFrame::LoadCustomTBColors,00000000,00000028,0042B3BC,00000000,00009CEC,00000016,004D2300,0000008A,?,000000AA,00000013), ref: 00432294

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

RedrawWindow.USER32(?,00000000,00000000,00000105,?,00000014,0000003E,?,000000AA,00000013,?,?,?,?,00009CEB,00009CFF), ref: 004322EF

Strings

CMainFrame::LoadCustomTBColors, xrefs: 00432283

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3_RedrawWindowmemcpy
String ID: CMainFrame::LoadCustomTBColors
API String ID: 618963311-3221776281
Opcode ID: bc7a10aea9ff3667d99e2a974e16da5de5014d44de4eebe0575cdbe73fca83a1
Instruction ID: 2d6cebf38c289c0672882ce49cd059d54bcc00905b4f462cd982b4c587827545
Opcode Fuzzy Hash: bc7a10aea9ff3667d99e2a974e16da5de5014d44de4eebe0575cdbe73fca83a1
Instruction Fuzzy Hash: 8B112131D00119ABDB00EBA5CC05FCEB7B5AF08719F01802AF915B71D0CFB86905CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004936F8, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004936FF
lstrlenW.KERNEL32(?,CNBMRUList::Remove,00000000,00000010,00490BE5,?,?,?,?,?,?,?,?,?,?), ref: 00493731
lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00493749

Strings

CNBMRUList::Remove, xrefs: 0049370C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3lstrcmpilstrlen
String ID: CNBMRUList::Remove
API String ID: 1309841002-245914645
Opcode ID: 165f513bc110742b8688839a96152d690eb2af38135aca79ee002c9c99cd6417
Instruction ID: 88bfca009934f64e38259e7fc117449ef92becfea6f189dcfd4a467faf701cfb
Opcode Fuzzy Hash: 165f513bc110742b8688839a96152d690eb2af38135aca79ee002c9c99cd6417
Instruction Fuzzy Hash: 6A0161F5900116AB8F11EFA5C9449AEBB21BB16745B10C0BBE41567200CB38AF51CBEA

Uniqueness

Uniqueness Score: -1.00%

Function 00443A5A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00443A64
memset.MSVCRT ref: 00443AB0
SHPathPrepareForWriteW.SHELL32(00000000,00000000,?,00000000,00000000,0000021C,00443181), ref: 00443AD4

Part of subcall function 004435AD: __EH_prolog3_GS.LIBCMT ref: 004435B7
Part of subcall function 004435AD: SHGetMalloc.SHELL32(?), ref: 004435EC
Part of subcall function 004435AD: SHGetFolderLocation.SHELL32(00000000,00000005,00000000,00000000,?), ref: 0044360E
Part of subcall function 004435AD: memset.MSVCRT ref: 00443630
Part of subcall function 004435AD: SHGetFolderLocation.SHELL32(00000000,00000000,00000000,00000000,?), ref: 004436A7

Strings

CNotebookApp::PeekLastBrowsePIDL, xrefs: 00443A74

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: FolderH_prolog3_Locationmemset$MallocPathPrepareWrite
String ID: CNotebookApp::PeekLastBrowsePIDL
API String ID: 1552948523-716507034
Opcode ID: 196d801d7e209e6840759eda0cd3841c04ee52f2e03b8bd1bbe16feca46a80fa
Instruction ID: 0432725caf98c7db58b6ca4a8030064118b530b068c71ef758fa45eb62c0935f
Opcode Fuzzy Hash: 196d801d7e209e6840759eda0cd3841c04ee52f2e03b8bd1bbe16feca46a80fa
Instruction Fuzzy Hash: 4101D831A4026867DF24EFA1CC45AEFB228BF14714F0005ABE418A7142DB789F54CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00441B78, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

#1662.MFC42U ref: 00441BC9
#1165.MFC42U ref: 00441BE1
#2644.MFC42U ref: 00441BEA

Strings

CNotebookApp::SetWaitMode, xrefs: 00441BA8

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#1662#2644
String ID: CNotebookApp::SetWaitMode
API String ID: 986466618-2192864484
Opcode ID: 16c02d0b23e3758aa59cfc824457e8e8c44bdb9f20bfaa16b61b34e217b0f518
Instruction ID: fe17fe1b12312dfd399d3ec13bb651ff048147172261f2f2a6c9c2ac3c41c7ed
Opcode Fuzzy Hash: 16c02d0b23e3758aa59cfc824457e8e8c44bdb9f20bfaa16b61b34e217b0f518
Instruction Fuzzy Hash: D401DE311487409BD328EF24DD46B6AB7A4EB54721F10462FE566822E1EB78A800CA9E

Uniqueness

Uniqueness Score: -1.00%

Function 0048A48B, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048A492
SystemTimeToVariantTime.OLEAUT32(00100000,?), ref: 0048A4BE
GetLastError.KERNEL32 ref: 0048A4C8

Strings

CNBObject::_AddPropertyDate, xrefs: 0048A4A1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$ErrorH_prolog3LastSystemVariant
String ID: CNBObject::_AddPropertyDate
API String ID: 3167222584-1773226987
Opcode ID: 384ce4e262e51a9bcc407bd570d664a6d6946e0588addb03ceaaa7cd919b44c6
Instruction ID: 5a1b0157add77a0cec75cae5e6a4d2b52fca8d0a1c5a3f835e4d59b42f8c1ca6
Opcode Fuzzy Hash: 384ce4e262e51a9bcc407bd570d664a6d6946e0588addb03ceaaa7cd919b44c6
Instruction Fuzzy Hash: CF019E72D000299BDF10EB91CC05AFEBB74BB04B24F00046BE901A7251DBBC5A24C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0044D054, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044D05B

Part of subcall function 0042973F: __EH_prolog3.LIBCMT ref: 00429746

Part of subcall function 0042929C: __EH_prolog3.LIBCMT ref: 004292A3

Part of subcall function 00429798: __EH_prolog3.LIBCMT ref: 0042979F

#1165.MFC42U(CNotebookView::CommitViewerProps,00000000,00000000,CNotebookView::SetCurPage,00000000,00000018,0044D21F,00000000,00000000), ref: 0044D0B5

Strings

CNotebookView::CommitViewerProps, xrefs: 0044D09A
CNotebookView::SetCurPage, xrefs: 0044D06A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165
String ID: CNotebookView::CommitViewerProps$CNotebookView::SetCurPage
API String ID: 2986221888-1979030562
Opcode ID: 78e06bee2737e8688e5af875568fc61c2284ed8ac248ea858825e0e1643f35c2
Instruction ID: d65d410213103a8f20d998dbc299fbbf4a9ecebd18f96dd766c6f1b040efc586
Opcode Fuzzy Hash: 78e06bee2737e8688e5af875568fc61c2284ed8ac248ea858825e0e1643f35c2
Instruction Fuzzy Hash: 8F01C031A011158BDB00EB92C902BEDB7719F50308F60006EE40277282CF7C5E06C77A

Uniqueness

Uniqueness Score: -1.00%

Function 00434509, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 0043452A
SendMessageW.USER32(?,0000004A,00000000,00000003), ref: 00434555
SysFreeString.OLEAUT32(?), ref: 00434560

Strings

CMainFrame::OnAppCopyDataPrintDirect, xrefs: 00434519

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: String$FreeMessageSend
String ID: CMainFrame::OnAppCopyDataPrintDirect
API String ID: 3634984327-3830528379
Opcode ID: 961f8be97291d8b185472d7a4b449eb4f08ded442acd0efd173b64199439d971
Instruction ID: 34204eacef1e9d9898427ac41bba176c9354326472ea3481f52153bc803f1a0b
Opcode Fuzzy Hash: 961f8be97291d8b185472d7a4b449eb4f08ded442acd0efd173b64199439d971
Instruction Fuzzy Hash: 030162719011197BDB10EF56DC499AFBB78FB95710F00006BB905A7150DB74AA05CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0044D4A7, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0044D4AE

Part of subcall function 0044CD38: __EH_prolog3.LIBCMT ref: 0044CD3F

Part of subcall function 0044CCDE: __EH_prolog3.LIBCMT ref: 0044CCE5

Part of subcall function 0044EFAA: __EH_prolog3.LIBCMT ref: 0044EFB1
Part of subcall function 0044EFAA: _ftol2_sse.MSVCRT ref: 0044EFEA

#1165.MFC42U(CNotebookView::SaveZoomSettings,00000000,0000001C,0044F326), ref: 0044D4F3
#1165.MFC42U ref: 0044D4F5

Part of subcall function 0044C5F6: __EH_prolog3.LIBCMT ref: 0044C5FD
Part of subcall function 0044C5F6: #1165.MFC42U(CNotebookDoc::GetDocumentZoomType,00000000,0000001C,0044D3E7,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044C615
Part of subcall function 0044C5F6: #1165.MFC42U(?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044C634

Strings

CNotebookView::SaveZoomSettings, xrefs: 0044D4BD

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3$H_prolog3__ftol2_sse
String ID: CNotebookView::SaveZoomSettings
API String ID: 3377130086-3833914098
Opcode ID: 7c73f4ea7ae3ed986efa3a451054403903639f1fe3ad861d1b061cfcd312153a
Instruction ID: 68d1b8e0766f009efddf055ae9d929e8379f0cbc5d3ab76a80eb2b9cbb3bf521
Opcode Fuzzy Hash: 7c73f4ea7ae3ed986efa3a451054403903639f1fe3ad861d1b061cfcd312153a
Instruction Fuzzy Hash: 93016271D012288BDF00EBA2C852AEE77B4AF04714F44002FE501B7181DF7C5A058BED

Uniqueness

Uniqueness Score: -1.00%

Function 00449BA2, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00449BA9
#1165.MFC42U(CNotebookDoc::KillAutoSaveTimer,?,0000000C,004497BA,00000000,CPgIpc::OnCloseDocument,00000000), ref: 00449BC7
GetLastError.KERNEL32 ref: 00449BEB

Strings

CNotebookDoc::KillAutoSaveTimer, xrefs: 00449BB4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165ErrorH_prolog3Last
String ID: CNotebookDoc::KillAutoSaveTimer
API String ID: 1234171103-1753749042
Opcode ID: 6929244d266ab8f03b06c5d4f1706fca25ed578fbe4c2f73dee8277e9c122303
Instruction ID: 169d2c4e585d3e286404b781a3b67615b4201c32ee466193178afb1b91e16a39
Opcode Fuzzy Hash: 6929244d266ab8f03b06c5d4f1706fca25ed578fbe4c2f73dee8277e9c122303
Instruction Fuzzy Hash: BC018171A001768BEB00DB958C45AAF7BB0FF08714F0542ABE805AB341DB3CED0297AD

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1F7, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042E1FE
#1165.MFC42U(CMainFrame::LoadNumMRUEntries,?,00000014,00464F4C), ref: 0042E21C

Part of subcall function 00443CF0: __EH_prolog3.LIBCMT ref: 00443CF7

#1165.MFC42U(?,00000000,?,00000000), ref: 0042E23D

Strings

CMainFrame::LoadNumMRUEntries, xrefs: 0042E209

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CMainFrame::LoadNumMRUEntries
API String ID: 2221090558-2431364658
Opcode ID: 557c2ff78ae79ce167f234f0935ac51cb9594ab4d26777c5418d8ef1e4403ffe
Instruction ID: 050882e4ece46d3c3bf14b77e34a9cf808612aa08fbca1dd1e0a6c4c1dc0837a
Opcode Fuzzy Hash: 557c2ff78ae79ce167f234f0935ac51cb9594ab4d26777c5418d8ef1e4403ffe
Instruction Fuzzy Hash: E4014B719011399FCB00EB91CD499EEBBB8BF08B04B00006AF905F7251DB785A05CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0044A98F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044A996
#1165.MFC42U(CNotebookDoc::AddCopyToMenuItems,00000000,00000010,004308F9,?), ref: 0044A9D1
#1165.MFC42U ref: 0044A9DF

Strings

CNotebookDoc::AddCopyToMenuItems, xrefs: 0044A9A3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CNotebookDoc::AddCopyToMenuItems
API String ID: 3111753120-4188266398
Opcode ID: 3a725a5d58825e398dec37a27029a5e377368b05afc6834aaa3ede7ea0da96e3
Instruction ID: e6e3d3b01261bbeac0cc64ae6c9adcf27441b8fa8de0a1eb7a7fae7ce14f01e9
Opcode Fuzzy Hash: 3a725a5d58825e398dec37a27029a5e377368b05afc6834aaa3ede7ea0da96e3
Instruction Fuzzy Hash: 13015E71D401198FDB00DB55C944BFE77B0AB04314F16446AA4087B291CB785E95CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0044AA13, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044AA1A
#1165.MFC42U(CNotebookDoc::AddMeetingInfoMenuItems,00000000,00000010,0042F9B6,?), ref: 0044AA55
#1165.MFC42U ref: 0044AA63

Strings

CNotebookDoc::AddMeetingInfoMenuItems, xrefs: 0044AA27

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CNotebookDoc::AddMeetingInfoMenuItems
API String ID: 3111753120-4124988303
Opcode ID: 1c2e62607911ab753b89a5fd23de1d2b99dfaff4b0c95db7bb7b950de367296e
Instruction ID: 37ccf8263bf8dd33f4f4d2a33b0ac5f5cb64b90403a7257caed5742cf78156fb
Opcode Fuzzy Hash: 1c2e62607911ab753b89a5fd23de1d2b99dfaff4b0c95db7bb7b950de367296e
Instruction Fuzzy Hash: AB012C31D41119CFDB00DB91CA45BEEB7B0AB14714F2540BBE40A7B291CB786E55CBEA

Uniqueness

Uniqueness Score: -1.00%

Function 00486C42, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00486C49
#1165.MFC42U(CTOCView::_RefreshView,00000000,0000000C,00485AB1,00000000,00000000), ref: 00486C69

Part of subcall function 00441B78: #1662.MFC42U ref: 00441BC9

Part of subcall function 00487251: __EH_prolog3.LIBCMT ref: 00487258

Part of subcall function 00485635: SetFocus.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004BFB86), ref: 0048568F

Part of subcall function 0047F51D: InvalidateRect.USER32(?,00000000,00000000,0000000B,00000001,00000000,CMetaListView::EnableRedraw,00000000,?,?,?,?,?,00485620), ref: 0047F549

#1165.MFC42U(00000001), ref: 00486CA5

Part of subcall function 00441B78: #1165.MFC42U ref: 00441BE1
Part of subcall function 00441B78: #2644.MFC42U ref: 00441BEA

Strings

CTOCView::_RefreshView, xrefs: 00486C58

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3$#1662#2644FocusInvalidateRect
String ID: CTOCView::_RefreshView
API String ID: 2795962123-1498936890
Opcode ID: 5670c669f877023db48cb385ffa20b48fdeed4923c7e8d448e938c72d5375384
Instruction ID: b3b55504a8d4001b1a4b0801a057e60ba36f010ffb6644a26315b67f0266e266
Opcode Fuzzy Hash: 5670c669f877023db48cb385ffa20b48fdeed4923c7e8d448e938c72d5375384
Instruction Fuzzy Hash: 9201FF307001159BDB04FBA2CC567ED7760AF44709F40447EA5166B293DF7C69458799

Uniqueness

Uniqueness Score: -1.00%

Function 00485242, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00485249
#1165.MFC42U(_LoadStringWrap,00000000,00000010,00485F62,00000104), ref: 0048526B

Part of subcall function 004AF6EC: LoadStringW.USER32(?,00009CD2,00000000,?), ref: 004AF717
Part of subcall function 004AF6EC: GetLastError.KERNEL32(?,00000000,?,0047A4AB), ref: 004AF723

GetLastError.KERNEL32(?,00000000,00000000), ref: 00485285

Strings

_LoadStringWrap, xrefs: 0048525A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$#1165H_prolog3LoadString
String ID: _LoadStringWrap
API String ID: 3622611329-660659683
Opcode ID: 9bc85df2b6d345800d169c7c50a6e345665a6539b7d57027d02945c3189b8cc3
Instruction ID: b3a7fd1cce49be00b611d8cf550ebfa28634e6d258fb3b4145fcf8143af45e95
Opcode Fuzzy Hash: 9bc85df2b6d345800d169c7c50a6e345665a6539b7d57027d02945c3189b8cc3
Instruction Fuzzy Hash: 2FF0F4369005168BDB01EBD2CD01BEEB370AF14324F20406BE804B7241DF3C9E058BAE

Uniqueness

Uniqueness Score: -1.00%

Function 0048FBF1, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048FBF8

Part of subcall function 00493447: __EH_prolog3.LIBCMT ref: 0049344E

Strings

NBFolderMRU, xrefs: 0048FC1F
NBNoteMRU, xrefs: 0048FC40
CNBNotebook::Initialize, xrefs: 0048FC07

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBNotebook::Initialize$NBFolderMRU$NBNoteMRU
API String ID: 431132790-1707207509
Opcode ID: eae9646456ab95b8a50df85313870b2f15342ebf70862529a6e7c3f7e27290f3
Instruction ID: b79172d647663b144af42a23786b30d9fff7548731cd034676f0967cffa092dd
Opcode Fuzzy Hash: eae9646456ab95b8a50df85313870b2f15342ebf70862529a6e7c3f7e27290f3
Instruction Fuzzy Hash: 6E014F3190110AABCF14EE91C911BEE7771BF04719F20443EA811B7190CB795F15D7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00431425, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043142C
#1165.MFC42U(CMainFrame::GetHighlightPen,?,0000000C,0042B2F9,?,00000000,?,00000000,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005), ref: 00431455

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

Strings

CMainFrame::GetHighlightPen, xrefs: 0043143C
W, xrefs: 00431434

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3memcpy
String ID: CMainFrame::GetHighlightPen$W
API String ID: 2146952879-4031392523
Opcode ID: 7a6879fb6bbaa1c9cb34cd92c797b2e44972c4ec0db2d2a6eac149f986d7f10c
Instruction ID: 35a967d0e808a511bb9b9cceddb10e54684a8ac8ceb1cd6d040b81472f581652
Opcode Fuzzy Hash: 7a6879fb6bbaa1c9cb34cd92c797b2e44972c4ec0db2d2a6eac149f986d7f10c
Instruction Fuzzy Hash: 5DF0C831940119AFDB00EB91CC05BFE77B4FF1C724F04452AF619AB291DB78AA058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00447D6F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00447D79
#1165.MFC42U(CNotebookDoc::ConvertHandwriting,?,0000026C,0042D153), ref: 00447DA9

Part of subcall function 0042D824: #1165.MFC42U(CMainFrame::IsRecognitionEnabled,00000000,0E0227DC,00000001,0E0227DC), ref: 0042D869
Part of subcall function 0042D824: #1165.MFC42U(?,00000004,0000000F), ref: 0042D891

#1165.MFC42U ref: 00447DB5

Part of subcall function 004A0766: __EH_prolog3.LIBCMT ref: 004A076D
Part of subcall function 004A0766: #324.MFC42U(0000009F,?,00000010,00447DC8,?), ref: 004A077F
Part of subcall function 004A0766: #1165.MFC42U(CCorrectionUI::CCorrectionUI,00000000), ref: 004A08DD
Part of subcall function 004A0766: LoadAcceleratorsW.USER32 ref: 004A08EC
Part of subcall function 004A0766: SetRectEmpty.USER32(?), ref: 004A0924
Part of subcall function 004A0766: SetRectEmpty.USER32(?), ref: 004A092D
Part of subcall function 004A0766: SetRectEmpty.USER32(?), ref: 004A0936

Part of subcall function 004A2041: #2506.MFC42U ref: 004A209D

Part of subcall function 004A09E6: __EH_prolog3.LIBCMT ref: 004A09ED
Part of subcall function 004A09E6: #641.MFC42U(CCorrectionUI::~CCorrectionUI,00000000,0000000C,00447DEC,?), ref: 004A0AC3

Strings

CNotebookDoc::ConvertHandwriting, xrefs: 00447D8F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$EmptyRect$H_prolog3$#2506#324#641AcceleratorsH_prolog3_Load
String ID: CNotebookDoc::ConvertHandwriting
API String ID: 537806758-3040217971
Opcode ID: fba6d250d2430022cc98ff59c8b7e276a27afe20a19bcced43607c7e5b68a226
Instruction ID: 264475c433983f9fe93f6261e47473738f5409e33acdb4a5e987cf5c4128aec4
Opcode Fuzzy Hash: fba6d250d2430022cc98ff59c8b7e276a27afe20a19bcced43607c7e5b68a226
Instruction Fuzzy Hash: 4D015A709092289ADB10FB25CD49BEDB774AF21304F4040DAA80C63152DB385E89CE69

Uniqueness

Uniqueness Score: -1.00%

Function 0047546A, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00475471
SendMessageW.USER32(?,0000014E,?,00000000), ref: 004754B5

Part of subcall function 0046F89F: __EH_prolog3_catch_GS.LIBCMT ref: 0046F8A9
Part of subcall function 0046F89F: SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0046F8E8
Part of subcall function 0046F89F: #1165.MFC42U(?,?), ref: 0046F94F
Part of subcall function 0046F89F: #6697.MFC42U(?,?,?), ref: 0046FA30

Strings

CSimpleFindDialog::SetScopeSelection, xrefs: 00475489
CSrchView::SetScopeSelection, xrefs: 0047547E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$#1165#6697H_prolog3H_prolog3_catch_
String ID: CSimpleFindDialog::SetScopeSelection$CSrchView::SetScopeSelection
API String ID: 2895245438-2052064311
Opcode ID: 3b5443e9fbf9e2a8ecc145444bdb74353dd6f47972fe81b7567fcafa560f14bd
Instruction ID: f2e23c82f7003678dd5db7ace1789a1487a121ff904050a0d2b5b52ce628ad19
Opcode Fuzzy Hash: 3b5443e9fbf9e2a8ecc145444bdb74353dd6f47972fe81b7567fcafa560f14bd
Instruction Fuzzy Hash: E9F06830901209ABD714EF62CC85AEDB724AF21758F10447FB51567191DF7C6E48CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004A960D, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A9614
#1165.MFC42U(CNBMetaListView::SelectOpenDocument,00000000,0000000C,00485683), ref: 004A962E
#1165.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 004A963F

Part of subcall function 0047EF28: __EH_prolog3.LIBCMT ref: 0047EF2F

Strings

CNBMetaListView::SelectOpenDocument, xrefs: 004A9621

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CNBMetaListView::SelectOpenDocument
API String ID: 2221090558-2290978170
Opcode ID: a9b7f152f18c9a0d7d3ccbea85fb84335039e764132e64110ec32575ec5803f9
Instruction ID: 8455a131a834b9e9b6345147953fd99f040d6ee3b1f251da2ae4edb1812f748e
Opcode Fuzzy Hash: a9b7f152f18c9a0d7d3ccbea85fb84335039e764132e64110ec32575ec5803f9
Instruction Fuzzy Hash: 41F0F030601211CFC309EB568D49CAE7BA5AF25B04F4400ABF6068B292DF3CDC42CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004313B7, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004313BE
#1165.MFC42U(CMainFrame::GetWritingPen,?,0000000C,0042B2EA,?,00000000,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0), ref: 004313E7

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

Strings

W, xrefs: 004313C6
CMainFrame::GetWritingPen, xrefs: 004313CE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3memcpy
String ID: CMainFrame::GetWritingPen$W
API String ID: 2146952879-3384257843
Opcode ID: 4d42fa8ca690fce102f1a54d0cdb9449285df01d2cae2b2c0f6d0355dfa2b578
Instruction ID: e79747c4a4f71f585ce36486c0cd172f95ae880d0ca6cc6bd8e33f9ebee91400
Opcode Fuzzy Hash: 4d42fa8ca690fce102f1a54d0cdb9449285df01d2cae2b2c0f6d0355dfa2b578
Instruction Fuzzy Hash: D7F0303190012A9FDB00EB91CC45BFEB770FF18718F01456AE61577291DB78AE168BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0047E0EF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047E0F6
#1165.MFC42U(CNotebookDocPrint::ReportPrintError,00000000,0000000C,0047D6D4), ref: 0047E11B
#1165.MFC42U ref: 0047E126

Strings

CNotebookDocPrint::ReportPrintError, xrefs: 0047E103

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CNotebookDocPrint::ReportPrintError
API String ID: 3111753120-1327208013
Opcode ID: 42a3739454471f51bdfd91e0229eb173619e86f9e7658121e3dbe6a67a28e47e
Instruction ID: 01c29addbcaca55e87797e33d1837323e25c4344ff1093cf731bbc2617b57b2f
Opcode Fuzzy Hash: 42a3739454471f51bdfd91e0229eb173619e86f9e7658121e3dbe6a67a28e47e
Instruction Fuzzy Hash: F6F036315001159FDB10EF62CC46BD97BA4AF18714F4040ABA5185B192CA78A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0042D9BA, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042D9C1
#1165.MFC42U(CMainFrame::UpdateCommandState,00000000,00000014,0042C68A,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 0042D9E3

Strings

CNotebookView::UpdateFrameUI, xrefs: 0042D9EA
CMainFrame::UpdateCommandState, xrefs: 0042D9CE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CMainFrame::UpdateCommandState$CNotebookView::UpdateFrameUI
API String ID: 2221090558-3560229468
Opcode ID: b7f9bdc9b0ff87412628292c5f204719f261ea76c08aa5c4302d16d8740eeb20
Instruction ID: d939eb3b8a5ac7bd111655891304d014c62103ba4f126be439f90c003da068b6
Opcode Fuzzy Hash: b7f9bdc9b0ff87412628292c5f204719f261ea76c08aa5c4302d16d8740eeb20
Instruction Fuzzy Hash: 4CE030316011189ACF14F7A3DC46EEE7670AF95B04F80017FA11662191DF7D1546C779

Uniqueness

Uniqueness Score: -1.00%

Function 0044AA97, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044AA9E
#1165.MFC42U(CNotebookDoc::ReplaceEmailPlaceholder,00000000,00000008,0042FBAC,?), ref: 0044AABB
#1165.MFC42U ref: 0044AACC

Part of subcall function 00498139: memset.MSVCRT ref: 00498166
Part of subcall function 00498139: SetMenuItemInfoW.USER32 ref: 0049818C

Strings

CNotebookDoc::ReplaceEmailPlaceholder, xrefs: 0044AAA9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3InfoItemMenumemset
String ID: CNotebookDoc::ReplaceEmailPlaceholder
API String ID: 3121651196-2480814275
Opcode ID: 5852a4b5eb872b482df3c14e0733cb8bafafded0b93c8d0c0ec5d5654b9b7bb0
Instruction ID: 4391db7e3be43191126bd269290c0300e2cbb9a75094b66274a6ed5a1a06a25e
Opcode Fuzzy Hash: 5852a4b5eb872b482df3c14e0733cb8bafafded0b93c8d0c0ec5d5654b9b7bb0
Instruction Fuzzy Hash: 25F082315011659FCB40EB92DE499EF7BA0AF04700B1580BFF9056B252CF388E51CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043284F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00432856
#2992.MFC42U(?,CMainFrame::IsToolbarVisible,00000000,00000008,00432826,00000072), ref: 00432875
#3792.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,004BFA0E,000000FF), ref: 00432881

Strings

CMainFrame::IsToolbarVisible, xrefs: 00432863

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2992#3792H_prolog3
String ID: CMainFrame::IsToolbarVisible
API String ID: 2456838771-3370704060
Opcode ID: 15934e55f504892e3ffe19f22914778313f12a50660cc61fd962afed22ffc49e
Instruction ID: 38e6cc71dd87416e41f86f187fa612eb4f62009f59d6187e6e44dbe779af0281
Opcode Fuzzy Hash: 15934e55f504892e3ffe19f22914778313f12a50660cc61fd962afed22ffc49e
Instruction Fuzzy Hash: 26E09236B001016BCB04BB768C199BE3A62ABD8740B55807FF806E7380DE388E04D779

Uniqueness

Uniqueness Score: -1.00%

Function 0043410C, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00434113
#1165.MFC42U(CMainFrame::OnInsertPictureOOUI,00000000,00000014,0042D137), ref: 0043412B
#1165.MFC42U ref: 0043414C

Part of subcall function 00448886: __EH_prolog3_GS.LIBCMT ref: 00448890
Part of subcall function 00448886: #1165.MFC42U(CNotebookDoc::InsertPicture,?,00000218,00434164,?), ref: 004488E7
Part of subcall function 00448886: SysAllocString.OLEAUT32(?), ref: 00448912
Part of subcall function 00448886: SysFreeString.OLEAUT32(00000000), ref: 00448955

Strings

CMainFrame::OnInsertPictureOOUI, xrefs: 0043411A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$String$AllocFreeH_prolog3H_prolog3_
String ID: CMainFrame::OnInsertPictureOOUI
API String ID: 1678376504-3735672770
Opcode ID: df2fef192e32ace3ea3524681e47bccf7386d4777c8ab7355e98d9f875d79693
Instruction ID: 72e52e5470c7504de97ff107ba74b306961a84b2d993d35c47530c61552f6362
Opcode Fuzzy Hash: df2fef192e32ace3ea3524681e47bccf7386d4777c8ab7355e98d9f875d79693
Instruction Fuzzy Hash: B2F01D346012058FDB04EB65CC89FED77B0BF08319F5440BEE509AB2A2DB399906CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0042ECF0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042ECF7
#1165.MFC42U(CMainFrame::OnLowBattery,00000000,0000000C,0042EB03,CMainFrame::OnPowerBroadCast,00000000), ref: 0042ED0F
#1165.MFC42U ref: 0042ED28

Part of subcall function 00449931: __EH_prolog3_GS.LIBCMT ref: 0044993B

Strings

CMainFrame::OnLowBattery, xrefs: 0042ECFE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3H_prolog3_
String ID: CMainFrame::OnLowBattery
API String ID: 3204532249-2003179423
Opcode ID: aa4f5570f6dba259123e9b95077f2c4185af54d39cc1dc3206c38b21a977c82b
Instruction ID: 9ceeb3a9d5a14f083cb16c3e8dc880dec6f47e6b1e55dfc340d8da507204d0fa
Opcode Fuzzy Hash: aa4f5570f6dba259123e9b95077f2c4185af54d39cc1dc3206c38b21a977c82b
Instruction Fuzzy Hash: C3F01C302012018FE714EB52CD5AFAA77B0AF14716F4440BEE505972E2DF7C9885CA29

Uniqueness

Uniqueness Score: -1.00%

Function 00477A58, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00477A5F
GetParent.USER32(?), ref: 00477A7F
#2859.MFC42U(00000000), ref: 00477A86

Strings

CNBFileDialog::GetParent, xrefs: 00477A68

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2859H_prolog3Parent
String ID: CNBFileDialog::GetParent
API String ID: 997800461-1783568319
Opcode ID: ff1b1d46ae97e32bcf841591678497f6265486cc1b244db690e7321ac2a29285
Instruction ID: 698e47b6808791b71f8251540d1db5860d4ee56f5bf78a0b05849cd7008289ea
Opcode Fuzzy Hash: ff1b1d46ae97e32bcf841591678497f6265486cc1b244db690e7321ac2a29285
Instruction Fuzzy Hash: 5FE04F309002019BEB10A7A2DC0ABED37209B14715F50016EF216A7190DE7C69488B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00494219, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,_INIUnescapeList,00000000,00000000,00000000,00000800), ref: 0049426B
lstrlenW.KERNEL32(00000000), ref: 00494284
memmove.MSVCRT ref: 00494291

Strings

_INIUnescapeList, xrefs: 00494230

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$memmove
String ID: _INIUnescapeList
API String ID: 1832346882-315264226
Opcode ID: 0aa4d50c736894f3d42bb310bd0e6f43f3bac054e987c8481a239121af5cd0f4
Instruction ID: 430818bf8013ad54d77073f7448a195ee992e3ff11b3fc2f3bc73cb059a2d9d1
Opcode Fuzzy Hash: 0aa4d50c736894f3d42bb310bd0e6f43f3bac054e987c8481a239121af5cd0f4
Instruction Fuzzy Hash: 9111B131A00115ABCB019BA5DC48EAEBBB9FFD0394F1100BBE815E3240DA389E038799

Uniqueness

Uniqueness Score: -1.00%

Function 0044CC4A, Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0044CC68
LoadStringW.USER32(?,?,?,00000200), ref: 0044CC81
LoadStringW.USER32(?,?,?,00000201), ref: 0044CCA6
SysAllocString.OLEAUT32(?), ref: 0044CCBA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Load$AllocFree
String ID:
API String ID: 1561515232-0
Opcode ID: b6179a235f0f61542beb31bd4f05c74a8a5cd5ecbfc70c63c3a4fcccf202d826
Instruction ID: 8c523c3369edc3f02bc541433248e53616735709bd80b18b80652bf508c0783d
Opcode Fuzzy Hash: b6179a235f0f61542beb31bd4f05c74a8a5cd5ecbfc70c63c3a4fcccf202d826
Instruction Fuzzy Hash: 8B01DE72501208EFEB108F61DD89AFA77B8EB44310F10006FFA44E3190DB389A42DB6C

Uniqueness

Uniqueness Score: -1.00%

Function 0047C511, Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047C518
#535.MFC42U(?,00000004,00442A5F), ref: 0047C525
#2820.MFC42U(?,0000F000,?,?,?,00000004,00442A5F), ref: 0047C53A
#800.MFC42U ref: 0047C54A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2820#535#800H_prolog3
String ID:
API String ID: 3543400630-0
Opcode ID: 91d7c7f34036965d762b9862ea8ad1a151308de5edd68469d6ae8d36ae9f381d
Instruction ID: 3775c1d19976baf99b0fbf1d784af5e71522684daf9ab240346c13e45ba62296
Opcode Fuzzy Hash: 91d7c7f34036965d762b9862ea8ad1a151308de5edd68469d6ae8d36ae9f381d
Instruction Fuzzy Hash: 09E09A30800101EBDB10AB95DC0ABBDB7B0FF00310FA005BEE422A20E1EF741A00DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004266C8, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00426702
InflateRect.USER32(?,?,?), ref: 00426719

Strings

CSplitWnd::GetHitRect, xrefs: 004266EC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$ClientInflate
String ID: CSplitWnd::GetHitRect
API String ID: 256450704-2797476749
Opcode ID: ad69c09638ddcca9240d146d77e28427609e3100f269ff07b8c0bdd321c061b1
Instruction ID: 5bdc20eaf742b901b14dd3374edca40388a92bc768960d4252af76d4a6117774
Opcode Fuzzy Hash: ad69c09638ddcca9240d146d77e28427609e3100f269ff07b8c0bdd321c061b1
Instruction Fuzzy Hash: 3F8154716057018FC314CF29D980A6AB7E1FF88318F19892EE99AC7352D734F845CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00492136, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049213D

Strings

CNBNotebook::_ProcessAllFolderNotes, xrefs: 0049214B
YB, xrefs: 00492145, 00492313, 004922DC, 004922C5, 0049224B, 0049214A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBNotebook::_ProcessAllFolderNotes$YB
API String ID: 431132790-403123195
Opcode ID: 1dc1ec207c82d847e1575a36a163266553979b0fc353e315fb0c354bde4def15
Instruction ID: c3cdf4665be486c1bccfc52201f4eee141f715854697838e12422c6e177cbde0
Opcode Fuzzy Hash: 1dc1ec207c82d847e1575a36a163266553979b0fc353e315fb0c354bde4def15
Instruction Fuzzy Hash: 97615174A0121AAFDF14DFA5C644AAFBFB5BF48704F14806AE805AB350D778DE41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00483D6A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00483D71
#1165.MFC42U(CViewMgr::LoadViewSettings,?,0000001C,00483F9D,CViewMgr::CreateViews,00000000,00000008,0042B796,?,00000000,0E0227DC), ref: 00483DCD

Part of subcall function 004841CF: __EH_prolog3.LIBCMT ref: 004841D6

Strings

CViewMgr::LoadViewSettings, xrefs: 00483D83

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165
String ID: CViewMgr::LoadViewSettings
API String ID: 2986221888-509154222
Opcode ID: bcd9bc4e1368725112136ebbc11a6163460d1796588bebcf5a46da0165d1b043
Instruction ID: 07fc1e91b04325e48ba192bc060eafebeba6e1d581d42191888ea647d7715236
Opcode Fuzzy Hash: bcd9bc4e1368725112136ebbc11a6163460d1796588bebcf5a46da0165d1b043
Instruction Fuzzy Hash: 4E5183B1E005179BCB14FFA5C8917FEB6B4BF44B05F04052BE915B7281D738AE418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004651CA, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0046584A: __EH_prolog3.LIBCMT ref: 00465851
Part of subcall function 0046584A: memset.MSVCRT ref: 004658B1

Part of subcall function 004650C0: __EH_prolog3.LIBCMT ref: 004650C7
Part of subcall function 004650C0: lstrlenW.KERNEL32(?,CNBSettingsMgr::GetSettingKey,0E0227DC,00000010,00465274,00000000,00000000,?,00000000), ref: 00465102
Part of subcall function 004650C0: #1165.MFC42U(00000061), ref: 0046511E
Part of subcall function 004650C0: #2885.MFC42U ref: 00465127

RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,?,00000000), ref: 00465345

Part of subcall function 00464995: RegOpenKeyExW.ADVAPI32(?,Version,00000000,00020019,?,CNBSettingsMgr::IsCorrectVersion,00000000,?,00000000,00000000,?,CNBSettingsMgr::Get,0E0227DC), ref: 004649CB
Part of subcall function 00464995: RegCloseKey.ADVAPI32(00000000,?,CNBSettingsMgr::Get,0E0227DC), ref: 00464A16

Part of subcall function 004AFC50: RegQueryValueExW.ADVAPI32(80070057,00000000,00000000,00000020,80070057,?,Helpers::RegQueryValueExW,00000000,?,00000000,CNBSettingsMgr::CacheFlushItem,80070057,00000020), ref: 004AFC80

Part of subcall function 00465EED: __EH_prolog3.LIBCMT ref: 00465EF4

Strings

W, xrefs: 004651FE
CNBSettingsMgr::Get, xrefs: 00465207

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$Close$#1165#2885OpenQueryValuelstrlenmemset
String ID: CNBSettingsMgr::Get$W
API String ID: 910042529-3987888216
Opcode ID: 708366ad1b682cd64b69db24157103806e9dab37097ed5a90fb6dd8b0b8bdfb3
Instruction ID: 9808dd7ec9895752ef8912876a3612fc68b15eafd3b0a9fefaf213525effbea6
Opcode Fuzzy Hash: 708366ad1b682cd64b69db24157103806e9dab37097ed5a90fb6dd8b0b8bdfb3
Instruction Fuzzy Hash: 8741B1712087019FC700DF25C890A2BB7E9EB88758F040A2FF95197350E7B8D985CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00490A53, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00490A5D
memset.MSVCRT ref: 00490AA5

Strings

CNBNotebook::DeleteNoteDocument, xrefs: 00490A76

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_memset
String ID: CNBNotebook::DeleteNoteDocument
API String ID: 2828583354-556607413
Opcode ID: 3e9ed75e336157ea15e4a5ec29e655ecc92fcb1f9eaf2e87952a93dca8765f61
Instruction ID: 0939d1489310575df04c452cda501ba388991c9424ca90ddd2bbdd2892e6a356
Opcode Fuzzy Hash: 3e9ed75e336157ea15e4a5ec29e655ecc92fcb1f9eaf2e87952a93dca8765f61
Instruction Fuzzy Hash: 5B515471902225AFCF64DF94D898F9EBB74AF08714F1001E9E909A7251D738EE81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0048427E, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00484285

Part of subcall function 00483AF9: __EH_prolog3_GS.LIBCMT ref: 00483B00
Part of subcall function 00483AF9: #1165.MFC42U(CViewInfo::GetShowSize,00000000,00000024,004842CB,?,00000000,00000000,CViewMgr::SizeView,00000000,00000028,004845F1,00000001,00000000,00000000,00000001,00000001), ref: 00483B26
Part of subcall function 00483AF9: GetClientRect.USER32 ref: 00483B4F

Part of subcall function 00425432: #3087.MFC42U(00000000,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00425483

SendMessageW.USER32(?,0000800A,00000000,00000000), ref: 00484303

Strings

CViewMgr::SizeView, xrefs: 00484294

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_$#1165#3087ClientMessageRectSend
String ID: CViewMgr::SizeView
API String ID: 194851027-1168015234
Opcode ID: f9c08735c704582108d1fc5e0fffbd216546091f9917354e10e3b4350e0eb3d0
Instruction ID: 91c836672b9cacb3fcd7a1456c9b4d9672347e30b80e1caab85a799a7b5a22b2
Opcode Fuzzy Hash: f9c08735c704582108d1fc5e0fffbd216546091f9917354e10e3b4350e0eb3d0
Instruction Fuzzy Hash: 81415F31B00616DFEB15EBA9C885FBEB7B5EF44305F00491EE81596240CB79AD45CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00493447, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049344E

Strings

CNBMRUList::Initialize, xrefs: 0049345D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBMRUList::Initialize
API String ID: 431132790-3342154942
Opcode ID: 38ffa52ca65e4144d90bda42423cc6aaca318fa4551d70033b399e5b22e8439e
Instruction ID: e6b259a9ac126a013b07d6fc9c50cb5267e037d6d3f72e5d9a36b60b67f86f9f
Opcode Fuzzy Hash: 38ffa52ca65e4144d90bda42423cc6aaca318fa4551d70033b399e5b22e8439e
Instruction Fuzzy Hash: ED411370A00201ABDF19DF51C945BBE7B60AF09729F15842FE905AB290CB7CDE41CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00426C8D, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,?), ref: 00426DA1
SetCursorPos.USER32(?,?,?), ref: 00426DBB

Strings

CSplitWnd::DoKeyboardSplit, xrefs: 00426CC9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CursorOffsetRect
String ID: CSplitWnd::DoKeyboardSplit
API String ID: 3345370719-4044817097
Opcode ID: 59d3ea1d19e945666958b62fc7ba8dbf0d1d6360faf33d96ffaff15640d8808b
Instruction ID: 6dcdfce04cb094d10fda84ac209b09c9f741161773da90c78d0ee32c516498ce
Opcode Fuzzy Hash: 59d3ea1d19e945666958b62fc7ba8dbf0d1d6360faf33d96ffaff15640d8808b
Instruction Fuzzy Hash: 5B41A630718B16CFD724CF29E945B67B7E0EF84310F614A2FA59683291DB78A845CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00491E59, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00491E60
PropVariantClear.OLE32(?,CNBNotebook::_GetLastOpenedNote,00000000,00000028,00491B63,00000000,?,00000000), ref: 00491F59

Strings

CNBNotebook::_GetLastOpenedNote, xrefs: 00491E6B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ClearH_prolog3PropVariant
String ID: CNBNotebook::_GetLastOpenedNote
API String ID: 2985067408-2096673147
Opcode ID: e338450ee2559a42633aab6566ddd085e247e8d34acb961c549296157ea929b4
Instruction ID: 86acea4c2ef04e024681fb7e27e0a6b3f0ad19904e3fa9bf15b14c6f700de380
Opcode Fuzzy Hash: e338450ee2559a42633aab6566ddd085e247e8d34acb961c549296157ea929b4
Instruction Fuzzy Hash: 14411C7090121BABDF11DFA5C948AAFBFB4EF49740F10016AF911AB264DB38DA40CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00486DF7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00486DFE

Part of subcall function 0047ED9F: __EH_prolog3.LIBCMT ref: 0047EDA6

Strings

CTOCView::_PopulateViewFromFolderList, xrefs: 00486E0D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CTOCView::_PopulateViewFromFolderList
API String ID: 431132790-875963539
Opcode ID: 8e66460f6b45077bff83645edbcc7438dcf68739608f4d0756a565b3a75c009c
Instruction ID: df3a72117f9c09c9d8db7f5fd56bbc5fdc5d65f4ac5d3ab370377e2cc230e650
Opcode Fuzzy Hash: 8e66460f6b45077bff83645edbcc7438dcf68739608f4d0756a565b3a75c009c
Instruction Fuzzy Hash: E6414E74A0020ADFEF00DBA5C845BFEBBB8AF44304F14485EE505EB281DB79EA45CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00459E2E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00459E89
wcschr.MSVCRT ref: 00459EB2

Strings

CNBToolbar::GetValueFromString, xrefs: 00459E3F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: iswspacewcschr
String ID: CNBToolbar::GetValueFromString
API String ID: 287713880-3645190698
Opcode ID: a6822575016de9dccbb87970cf95e6d0f269f89ac8879e61ae39d7d9c90f0686
Instruction ID: 3fb17832d8e72b22285d46f6a20f60d5dc596bd0be50cac24fbdd46c7f739cb5
Opcode Fuzzy Hash: a6822575016de9dccbb87970cf95e6d0f269f89ac8879e61ae39d7d9c90f0686
Instruction Fuzzy Hash: 81316172900215EADB28CF69D4456BA77E4EB59322B24813BEC06C72C1E73C8D45DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004290BC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004290C3
#1165.MFC42U(CNBDocViewCtrl::InitViewCtrl,?,00000014,0042908E), ref: 004290E6

Part of subcall function 00429D25: __EH_prolog3.LIBCMT ref: 00429D2C

Part of subcall function 00429DE1: __EH_prolog3.LIBCMT ref: 00429DE8

Part of subcall function 00429E3F: __EH_prolog3.LIBCMT ref: 00429E46

Part of subcall function 004AF88E: GetSystemMetrics.USER32 ref: 004AF8B3

Part of subcall function 0042994E: __EH_prolog3.LIBCMT ref: 00429955

Strings

CNBDocViewCtrl::InitViewCtrl, xrefs: 004290D5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165MetricsSystem
String ID: CNBDocViewCtrl::InitViewCtrl
API String ID: 1912380869-2015093875
Opcode ID: ca735e7197bf84ef55c5f8bc873db2977c9207a7d7b852bd36cb224d74a5da72
Instruction ID: 9564bd343345cf9f2fbbaee958fc8188f13fc23733dd805f792b4de62cf6a498
Opcode Fuzzy Hash: ca735e7197bf84ef55c5f8bc873db2977c9207a7d7b852bd36cb224d74a5da72
Instruction Fuzzy Hash: 3F31A271F0223A8BDF18DBA18945ABEBA719F48B60F45012EED05F7341DA384E0587F9

Uniqueness

Uniqueness Score: -1.00%

Function 0048C497, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048C49E

Strings

CNBFileObject::_InitSelf, xrefs: 0048C4AB
CNBObject::_SetNonModifiablePropTags, xrefs: 0048C56A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBFileObject::_InitSelf$CNBObject::_SetNonModifiablePropTags
API String ID: 431132790-2214737655
Opcode ID: f91361bb8c0eccfa48927e35fd7371a0b80c97b55b767ca1b42cccb86871ca80
Instruction ID: 4b412f7980c8d8619312c79da318a31203e6dcf507b9d58d6176fe6846402210
Opcode Fuzzy Hash: f91361bb8c0eccfa48927e35fd7371a0b80c97b55b767ca1b42cccb86871ca80
Instruction Fuzzy Hash: 6F31B231E02229AFCB05FB52C981AFE7A75AF08B54B04041FF905BB241DB78AE4087B5

Uniqueness

Uniqueness Score: -1.00%

Function 00446CD8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00446CDF

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

Part of subcall function 004481E2: __EH_prolog3_GS.LIBCMT ref: 004481E9
Part of subcall function 004481E2: SetRectEmpty.USER32(?), ref: 0044825C
Part of subcall function 004481E2: #1165.MFC42U(?,00000001), ref: 00448262
Part of subcall function 004481E2: #1165.MFC42U(?,00000001), ref: 00448279

#1165.MFC42U(?,?,8000FFFF,CNotebookDoc::_GetTextboxPosition,00000000,00000024,00446E70,?,00000000,?,00000000,?,004B9CAB,00000001,CNotebookDoc::InsertTextBox,?), ref: 00446D61

Strings

CNotebookDoc::_GetTextboxPosition, xrefs: 00446CEE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$EmptyH_prolog3H_prolog3_Rect
String ID: CNotebookDoc::_GetTextboxPosition
API String ID: 3320693903-1527504006
Opcode ID: e0b1cf4f9bf3ca3f4e9a7a9bbf8ce8633fa9a8e93f1a15125b008876d5bda3cf
Instruction ID: a62142371b6d767916a3bccea82968a157765730afcb48838579620dbc282196
Opcode Fuzzy Hash: e0b1cf4f9bf3ca3f4e9a7a9bbf8ce8633fa9a8e93f1a15125b008876d5bda3cf
Instruction Fuzzy Hash: AC3160B1E0121A9FDB10DF95C844AEEBBB4FF49714F15406AE905E7341C7389D01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004491FF, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00449206

Part of subcall function 0049E743: __EH_prolog3.LIBCMT ref: 0049E74A

#1165.MFC42U(?,00000001,?,CNotebookDoc::SetInkSelectionFormat,?,0000001C,004496EE,00000002,?), ref: 0044927A

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

Strings

CNotebookDoc::SetInkSelectionFormat, xrefs: 00449213

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CNotebookDoc::SetInkSelectionFormat
API String ID: 2221090558-2368896600
Opcode ID: 2c4863ec2a1b9fe9f6d914b90ba092b8574fe761e601aed7cfc78556eb2412c9
Instruction ID: a17827fa4a1949ba1c07eb353e19f8f3a64a983b8a6d5bf0f53ad0ff1fd30eba
Opcode Fuzzy Hash: 2c4863ec2a1b9fe9f6d914b90ba092b8574fe761e601aed7cfc78556eb2412c9
Instruction Fuzzy Hash: 88317374A0020AEFDF04DFA5C854AEEBBB4BF05304F1444AEE815AB381DB789E05DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0044B92E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044B935

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

PropVariantClear.OLE32(?,CNotebookDoc::_LoadFlagData,?,00000024,0044572A,CNotebookDoc::_LoadDocumentMetadata,00000000,?,?,?,00000000,?,?,?,?,CMainFrame::ShowPageSettings), ref: 0044B9F5

Strings

CNotebookDoc::_LoadFlagData, xrefs: 0044B942

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165ClearH_prolog3PropVariant
String ID: CNotebookDoc::_LoadFlagData
API String ID: 1424904713-2303604873
Opcode ID: 607adc7b972fd9242be73f7bfda35424484bfdcc82a6f5ecac79e3d2c8561e0e
Instruction ID: 83440168b6e75ce50d81e1ee0ead7fb2cd6ce9aa1e94a737f8b8ea8f2ef43138
Opcode Fuzzy Hash: 607adc7b972fd9242be73f7bfda35424484bfdcc82a6f5ecac79e3d2c8561e0e
Instruction Fuzzy Hash: AF316CB0A0062A9FEF04DFA9C854AAEB7B5FF48304B10056EE605EB250D778DE05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0047BDC9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 0047BE0E
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0047BE5C

Strings

G_GetFirstLine, xrefs: 0047BDE4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocStringiswspace
String ID: G_GetFirstLine
API String ID: 1735721833-2310175486
Opcode ID: fe01aeaa3d6ab913c64730bf11b72d6316c1db8e6a1fc2cf420f5ac0f3614dea
Instruction ID: 25494430915b8a484443716af5ba38061c5de456b7e4697c8198e41dd1c8f05c
Opcode Fuzzy Hash: fe01aeaa3d6ab913c64730bf11b72d6316c1db8e6a1fc2cf420f5ac0f3614dea
Instruction Fuzzy Hash: 3F213772A00225DBCB218B919944BFB7764EB40710F2580ABEE49AB380D77CCE41C7E9

Uniqueness

Uniqueness Score: -1.00%

Function 004BCA9C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89windowCOMMON

Download Yara Rule

APIs

TraceMessage.ADVAPI32(?,?,0000002B,0041EF0C,?,NULL,0000000A,NULL,0000000A,004BD034,00000004,00000000,75144D40,00000104,004D200C,0000000E), ref: 004BCB5C

Strings

NULL, xrefs: 004BCAF7, 004BCB3C, 004BCB49, 004BCB4B
<NULL>, xrefs: 004BCAE5

Memory Dump Source

Source File: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: 7cb815dfbc328b93ffeca667fb9a02d08a68b7ffc49014ddd7d4a940ee004dd6
Instruction ID: a34303f64a2fd97df8f5ebb8721442c307b20117d159653d739aa455ac84dc5c
Opcode Fuzzy Hash: 7cb815dfbc328b93ffeca667fb9a02d08a68b7ffc49014ddd7d4a940ee004dd6
Instruction Fuzzy Hash: 5921EA36604209A7DF24DF58A8C6BFB7765EB84710F24802BED059B280E675AD52C3B9

Uniqueness

Uniqueness Score: -1.00%

Function 0048ECC6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048ECCD
PropVariantClear.OLE32(00000000,?,00000000,CNBFolder::_GenerateCheckSumFromObject,00000000,0000002C,0048F861,CNBFolder::_SaveToCache,00000000,00000018,0048EEED,?,?,?,00080000,00000000), ref: 0048ED69

Strings

CNBFolder::_GenerateCheckSumFromObject, xrefs: 0048ECDA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ClearH_prolog3PropVariant
String ID: CNBFolder::_GenerateCheckSumFromObject
API String ID: 2985067408-3734650075
Opcode ID: 1406fd74c78238e419dac9e9f0535e0a3af684800fa6a388d32dcc4bfac3fdac
Instruction ID: 7fd4adfe917d4b7e50a5f44db519cad29aa4d80a04a90343809807b02ad74509
Opcode Fuzzy Hash: 1406fd74c78238e419dac9e9f0535e0a3af684800fa6a388d32dcc4bfac3fdac
Instruction Fuzzy Hash: 1D319175A00216AFCB14EFA6C884EEFBBF5BF88700B14495DE501AB210DB75DD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00480911, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000120B,00000000,?), ref: 004809AA
SendMessageW.USER32(00000000,0000120C,00000000,00000004), ref: 004809F1

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

CMetaListView::_SetSortIndicator, xrefs: 00480921

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$Trace
String ID: CMetaListView::_SetSortIndicator
API String ID: 4174725161-2797432723
Opcode ID: bfc9e7782174091553500a7467325a1d1cbdc936cbd9b3f0d3968d9e8d915c5c
Instruction ID: d3420a0a6df4d31998bcf0d91f1eb149ef5447dd50b19b2065941741e0f5dd05
Opcode Fuzzy Hash: bfc9e7782174091553500a7467325a1d1cbdc936cbd9b3f0d3968d9e8d915c5c
Instruction Fuzzy Hash: 77213A72610204ABE721EE19C985EAEBB65FB04314F148557EA0497392CB7CCC49DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00441C11, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00441C1B
lstrlenW.KERNEL32(?,CNotebookApp::OpenFile,00000000,0000021C,0042C992,00000003,00000000), ref: 00441C56

Part of subcall function 00441DFD: __EH_prolog3_GS.LIBCMT ref: 00441E07
Part of subcall function 00441DFD: memset.MSVCRT ref: 00441E53
Part of subcall function 00441DFD: memset.MSVCRT ref: 00441E6D
Part of subcall function 00441DFD: #540.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00441E97
Part of subcall function 00441DFD: #540.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00441EA3
Part of subcall function 00441DFD: PathFindExtensionW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00441EDD
Part of subcall function 00441DFD: #540.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00441F17
Part of subcall function 00441DFD: #540.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 00441F23

Strings

CNotebookApp::OpenFile, xrefs: 00441C2D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #540$H_prolog3_memset$ExtensionFindPathlstrlen
String ID: CNotebookApp::OpenFile
API String ID: 3737381993-1772500670
Opcode ID: bef187ad2b83b8ea3ff25f154364129ab88a56f7ab03921e141ac4c80b718b15
Instruction ID: 4cda08594bfa347c1b84c30000b0bce358d018580dfae52fa0a440a5980ecbeb
Opcode Fuzzy Hash: bef187ad2b83b8ea3ff25f154364129ab88a56f7ab03921e141ac4c80b718b15
Instruction Fuzzy Hash: A3210B316D01196AEB20FA75CC8DFAF7278AB95708F10406EB50BC71D0DE789A85CB1C

Uniqueness

Uniqueness Score: -1.00%

Function 0048D281, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048D288

Part of subcall function 0048C497: __EH_prolog3.LIBCMT ref: 0048C49E

Strings

CNBNote::CNBNote, xrefs: 0048D2E3
CNBNote::CreateNoteInstance, xrefs: 0048D299

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBNote::CNBNote$CNBNote::CreateNoteInstance
API String ID: 431132790-4001972650
Opcode ID: 52ddb3895af4b57e2777c08c2a6bb9c311cf393c43d298792631865b19d4056f
Instruction ID: b828e54beeab79f63aafc3752649a2e9d94f08f3f81a77224546171bebfea49c
Opcode Fuzzy Hash: 52ddb3895af4b57e2777c08c2a6bb9c311cf393c43d298792631865b19d4056f
Instruction Fuzzy Hash: CA31FF30D012148FDB11EF91C844BAEBBB0AF14708F24485FE901AB291CBBC8945CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0048E552, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048E559

Part of subcall function 0048C497: __EH_prolog3.LIBCMT ref: 0048C49E

Strings

CNBFolder::CNBFolder, xrefs: 0048E5B4
CNBFolder::CreateFolderInstance, xrefs: 0048E56A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBFolder::CNBFolder$CNBFolder::CreateFolderInstance
API String ID: 431132790-451561213
Opcode ID: 5e8bee7aa50417484e69164e23642fa655c459118a78bea3be9b962fd8de4b19
Instruction ID: 70509d0d523dfa53100df41c64e9436b4605015102b7efa16e6447095b8f3527
Opcode Fuzzy Hash: 5e8bee7aa50417484e69164e23642fa655c459118a78bea3be9b962fd8de4b19
Instruction Fuzzy Hash: 9431D7319002249BDB15EB86C845BEE77B0AF60718F54485FE9007B291DBBCD946CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00495353, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0049535D

Part of subcall function 00495315: memset.MSVCRT ref: 00495337

lstrlenW.KERNEL32(?,CActiveFileList::Add,?,00000434,00445C79,?,00000000,?,00000000), ref: 004953A3

Strings

CActiveFileList::Add, xrefs: 0049537B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_lstrlenmemset
String ID: CActiveFileList::Add
API String ID: 1545918636-3972973533
Opcode ID: 2ba74d62f492dc65ce39dd5edfaf33d9c0ef6e2f0c7c7d4ec6f44116852334e4
Instruction ID: 6b27baa37b73a06ce1f9a1775ed72a384dca82f95e68436f24ad83f162857342
Opcode Fuzzy Hash: 2ba74d62f492dc65ce39dd5edfaf33d9c0ef6e2f0c7c7d4ec6f44116852334e4
Instruction Fuzzy Hash: 2831A7B1D006248BCF61DB15C885BEDFB74AF44715F6040AEEA09A7241DB789E85CFAC

Uniqueness

Uniqueness Score: -1.00%

Function 00442BC7, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

#4692.MFC42U(?,CNotebookApp::OnIdle,00000000,0E0227DC), ref: 00442C2F

Part of subcall function 00435657: memset.MSVCRT ref: 0043566C
Part of subcall function 00435657: TraceEvent.ADVAPI32(0E0227DC,00000000,?,00000002,?,00000000), ref: 004356A5

Strings

CNotebookApp::OnIdle, xrefs: 00442BFE
CIdleTaskMgr::Run, xrefs: 00442C52

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #4692EventTracememset
String ID: CIdleTaskMgr::Run$CNotebookApp::OnIdle
API String ID: 3206137483-4169463019
Opcode ID: b6e464ed24d482ab47391c5bfb0d2715666dbcccc2b352b6ec9a610cf130af98
Instruction ID: a9ff8fe274a677dbb1d2748a12572342100e205ec028e801215eba4f266f049a
Opcode Fuzzy Hash: b6e464ed24d482ab47391c5bfb0d2715666dbcccc2b352b6ec9a610cf130af98
Instruction Fuzzy Hash: 612125312087419FD314DF1AC981E6BB7A4EBE5324F50463FF85283291EFB8A805CA69

Uniqueness

Uniqueness Score: -1.00%

Function 00471945, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047194C

Part of subcall function 004847D6: __EH_prolog3.LIBCMT ref: 004847DD

Strings

CSrchView::_UpdatePaneHeight, xrefs: 00471959
CViewMgr::GetViewEncroachment, xrefs: 004719A2

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CSrchView::_UpdatePaneHeight$CViewMgr::GetViewEncroachment
API String ID: 431132790-671538957
Opcode ID: 6c42f1a641f56c44233a00428f51cc93d1d8aa7b7ac6826cef4c4d048e58e24b
Instruction ID: 3693c1e00b09f972ec2788ac07cfb08b4730811c42a0b14461f232187feb3255
Opcode Fuzzy Hash: 6c42f1a641f56c44233a00428f51cc93d1d8aa7b7ac6826cef4c4d048e58e24b
Instruction Fuzzy Hash: B421867190011AAFCF04EF96C891DEEB775BF54304B00842FE60567651DB39AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0048DA34, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048DA3B
CoCreateInstance.OLE32(00404B1C,00000000,00000001,004021C0,?,CNBNote::_InternalCreateDocInstance,?,0000000C,0048CE7E,CNBNote::CreateDocInstance,?,0000007C,0049037B,?,?), ref: 0048DAAA

Strings

CNBNote::_InternalCreateDocInstance, xrefs: 0048DA4F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateH_prolog3Instance
String ID: CNBNote::_InternalCreateDocInstance
API String ID: 1068211243-173988718
Opcode ID: 3ae36b4fe31bc75e596a2ed36a840af09a66e4d49c52e8cf45b9ea1567501ff1
Instruction ID: e3bc73e9c495ae24822432062a086adb90fb247c56d0dc52026343490c1d4ee9
Opcode Fuzzy Hash: 3ae36b4fe31bc75e596a2ed36a840af09a66e4d49c52e8cf45b9ea1567501ff1
Instruction Fuzzy Hash: 5321A731D462259FDB199F558944B6F7B70AF04714F25496BEE006B3D0D7B89C40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00492573, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0049257A

Part of subcall function 004BDF43: malloc.MSVCRT ref: 004BDF5B

#1105.MFC42U(00492654,00000000,00000000,00000000,00000000,00000000,CNBNotebook::_BackgroundLoadMRUFolders,00000000,00000010,00490262,00100000,?,?,00000000,00000000), ref: 004925FD

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

CNBNotebook::_BackgroundLoadMRUFolders, xrefs: 00492587

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1105H_prolog3MessageTracemalloc
String ID: CNBNotebook::_BackgroundLoadMRUFolders
API String ID: 3355613519-2900259601
Opcode ID: ceb4a1cb30cfeeb5c683062fa5f53dc2fe8ad3a1661681a57bbc7d2c00d64028
Instruction ID: e28ea8c999b7171d107715e4b35e67ec312a35d18e427d5efca749d770e564fa
Opcode Fuzzy Hash: ceb4a1cb30cfeeb5c683062fa5f53dc2fe8ad3a1661681a57bbc7d2c00d64028
Instruction Fuzzy Hash: FF21B071A01205BBDB15DF518A44BAB7B60AF24318F15807FE900AB291CBBDDD42CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 004828EE, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004828F5

Strings

d, xrefs: 00482984
CMetaListColumnArray::SetColumns, xrefs: 00482902

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CMetaListColumnArray::SetColumns$d
API String ID: 431132790-1285501440
Opcode ID: 5a5a2f00a5d3c70b9ccbddc2d55fc80d7781b2eee8199239ca22573e2d3849ab
Instruction ID: a7e306047f62cc6e83ddb1f08533c166ecbaa73ca7c6574155024dcfdf09fdbe
Opcode Fuzzy Hash: 5a5a2f00a5d3c70b9ccbddc2d55fc80d7781b2eee8199239ca22573e2d3849ab
Instruction Fuzzy Hash: 67215CB0E002299BCB14EF95C9446AEB7B4BF44718F10481FD815BB341D7B96A05CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0047ECD1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047ECD8

Part of subcall function 004807BF: __EH_prolog3.LIBCMT ref: 004807C6

InvalidateRect.USER32(00000000,00000000,00000000,00000000,?,?,00000000,?,CMetaListView::RefreshObject,?,00000010,004857E8,00000000,CTOCView::SavedDocNotify,00000000,00000008), ref: 0047ED7F

Part of subcall function 0047E42D: TraceMessage.ADVAPI32(?,?,0000002B,00413C64,0000000E,?,00000004,00000000,?,0047ED30,00969CB0,0000EF51,00000000,00000000,?,CMetaListView::RefreshObject), ref: 0047E448

Strings

CMetaListView::RefreshObject, xrefs: 0047ECE5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$InvalidateMessageRectTrace
String ID: CMetaListView::RefreshObject
API String ID: 2407978738-1725707653
Opcode ID: eed4ea7b0e7f54f41bac425b766422854ff8c184339c9e2d10359837baee1b6e
Instruction ID: bfffbf600b5abc1edba6adb3bbd64ff0556f7b84475041806de098e803ebfebb
Opcode Fuzzy Hash: eed4ea7b0e7f54f41bac425b766422854ff8c184339c9e2d10359837baee1b6e
Instruction Fuzzy Hash: BA21A47190021AEFDB15DF52CC40AEEBB75BF18718B00896FE9156B251C779AD01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004A75DA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004A75E4
memset.MSVCRT ref: 004A762F

Part of subcall function 00495704: __EH_prolog3.LIBCMT ref: 0049570B

Part of subcall function 004951C8: memset.MSVCRT ref: 004951F9

Strings

_FindNextCrashedNote, xrefs: 004A75FA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$H_prolog3H_prolog3_
String ID: _FindNextCrashedNote
API String ID: 3244368517-1214038176
Opcode ID: dbefb2cde67dddb637eec278d33e7b07a3681e074e6814d1ffad51e201e46a13
Instruction ID: 159fecd63fb7fca84787540c6b7a69a48bbcaafd4dfe5a50ccddae9f6ea3c2a5
Opcode Fuzzy Hash: dbefb2cde67dddb637eec278d33e7b07a3681e074e6814d1ffad51e201e46a13
Instruction Fuzzy Hash: 272198B1D045296ACB30EBA59C89BDE76B89F59314F1001DBE409A7241DB389E85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00432669, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

#1165.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,004BFA0E,000000FF), ref: 004326B2
#1165.MFC42U(?,?,?,?,?,?,?,?,?,?,?,?,004BFA0E,000000FF), ref: 004326C4

Part of subcall function 004298F0: __EH_prolog3.LIBCMT ref: 004298F7

Strings

CMainFrame::OnUpdateRiffleMenu, xrefs: 00432699

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3
String ID: CMainFrame::OnUpdateRiffleMenu
API String ID: 3111753120-458515852
Opcode ID: 790644f4974fef47f99adc0569bbebb67adddef7694a4b916b39a54084f6df46
Instruction ID: da003ddad47bbfe6e7aaecb737f272ecff832e6450b4a6e9baf6f5e91996c4ce
Opcode Fuzzy Hash: 790644f4974fef47f99adc0569bbebb67adddef7694a4b916b39a54084f6df46
Instruction Fuzzy Hash: 302179322042419FD300DF29C985F6ABBE8FB98B25F14452EF9558B291EB79AC04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00483C97, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00483C9E

Part of subcall function 004841CF: __EH_prolog3.LIBCMT ref: 004841D6

Strings

CViewMgr::FlushViewSettings, xrefs: 00483CC6
CViewMgr::SaveViewSettings, xrefs: 00483CB0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CViewMgr::FlushViewSettings$CViewMgr::SaveViewSettings
API String ID: 431132790-1395909
Opcode ID: 84d8323e4b9968fcdfbfe7bb126f260304b4f0f050a3dbc979edefd5d323667f
Instruction ID: acd18ca6df3d0cdbbde32c194ce886564191b1a05a4acfe204964afc543fb2ee
Opcode Fuzzy Hash: 84d8323e4b9968fcdfbfe7bb126f260304b4f0f050a3dbc979edefd5d323667f
Instruction Fuzzy Hash: D011D671B5021596CB14FBB6CC927EE66A56F68B09F04092FE517E3281EF7C9B04C368

Uniqueness

Uniqueness Score: -1.00%

Function 0043438A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

#1165.MFC42U(CMainFrame::OnGlobalSettingChange,00000000,0E0227DC), ref: 004343CD

Part of subcall function 00464750: __EH_prolog3.LIBCMT ref: 00464757

Strings

CNBSettingsMgr::OnGlobalSettingChange, xrefs: 004343D4
CMainFrame::OnGlobalSettingChange, xrefs: 004343BF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CMainFrame::OnGlobalSettingChange$CNBSettingsMgr::OnGlobalSettingChange
API String ID: 2221090558-3814621361
Opcode ID: 301273dabd1927548da794f29750a6305165d4bcbaea701b8de0e53654c66402
Instruction ID: 1a75d5950b1c114435e3c4e99854bc9edd134964f3d5447f1b9d13c38d6c7bba
Opcode Fuzzy Hash: 301273dabd1927548da794f29750a6305165d4bcbaea701b8de0e53654c66402
Instruction Fuzzy Hash: BB21D132105200DBC714EF15DC81B9BB7A4EFA5B20F14463BF82543191EB38AA04CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00493D9F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00493DA9
memset.MSVCRT ref: 00493E23

Strings

CNBMRUList::_Load, xrefs: 00493DBE

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_memset
String ID: CNBMRUList::_Load
API String ID: 2828583354-933952486
Opcode ID: f02c8dee01f910b1fee2eb52d86c26d87993751076d02c81c6d131c59b06b14a
Instruction ID: 1b73c5e3c917ec44b9ef9b40d1644fb89954b603297524847999b0ec07d95af3
Opcode Fuzzy Hash: f02c8dee01f910b1fee2eb52d86c26d87993751076d02c81c6d131c59b06b14a
Instruction Fuzzy Hash: 45219070D002199BDF50EFA5C989BDCB774BF14319F5042BAE418A7181DB785F88CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004431D3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004431DA

Part of subcall function 00479D1E: GetFullPathNameW.KERNEL32(?,00000105,?,?,FNetFile,00000000,?,00000000), ref: 00479D5E
Part of subcall function 00479D1E: GetDriveTypeW.KERNEL32(?), ref: 00479D94

#1165.MFC42U(CNotebookApp::IsInstanceNeeded,00000000,00000008,0044026E,?,?,00000000,?,00000000), ref: 00443207

Part of subcall function 0042DA1A: __EH_prolog3.LIBCMT ref: 0042DA21
Part of subcall function 0042DA1A: #1165.MFC42U(CMainFrame::FindProcessByFileName,00000000,00000018,004432FE,00000003), ref: 0042DA3B
Part of subcall function 0042DA1A: #4166.MFC42U(?,00000000,00000000,?,?,?,00000000), ref: 0042DA98
Part of subcall function 0042DA1A: lstrcmpiW.KERNEL32(00000003,00000000,?,?,?,00000000), ref: 0042DAA2
Part of subcall function 0042DA1A: #6307.MFC42U(?,?,?,00000000), ref: 0042DAB2

Strings

CNotebookApp::IsInstanceNeeded, xrefs: 004431E7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3$#4166#6307DriveFullNamePathTypelstrcmpi
String ID: CNotebookApp::IsInstanceNeeded
API String ID: 1869550776-4289549011
Opcode ID: cb604ddf17d2fa08ee20825ecd44d317ee74b459d31ebdcbaa4d5c66337efa76
Instruction ID: a6d5d206c6caa09ecf82bb8fc8fa7f09736f81bdb53c92cafef6480fe0fd97a3
Opcode Fuzzy Hash: cb604ddf17d2fa08ee20825ecd44d317ee74b459d31ebdcbaa4d5c66337efa76
Instruction Fuzzy Hash: 77110671600104ABDF04AF21CC818BE7726BF48714B10456FFC1BA72D2DB788E068768

Uniqueness

Uniqueness Score: -1.00%

Function 004AC14F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004AC156

Strings

CJournalNotification::CJournalNotification, xrefs: 004AC1B2
GetJournalNotification, xrefs: 004AC167

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CJournalNotification::CJournalNotification$GetJournalNotification
API String ID: 431132790-264897539
Opcode ID: d46021f369b153a9bc4f67c96d282ec86cb739eafc9ed4dcb7b7b15e7548bc88
Instruction ID: dc4a54fd7c74c52249e410cb336c4d77d94e74481ce1bafe274294016cf0e7b1
Opcode Fuzzy Hash: d46021f369b153a9bc4f67c96d282ec86cb739eafc9ed4dcb7b7b15e7548bc88
Instruction Fuzzy Hash: 0211E472D042259BE710EB91C842BFEB2A06F25714F11009FE912B7281DBBC4E41CBEE

Uniqueness

Uniqueness Score: -1.00%

Function 0048A329, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048A330

Strings

CNBObject::_AddPropertyDate, xrefs: 0048A33D
CPropVal::InitProp, xrefs: 0048A360

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBObject::_AddPropertyDate$CPropVal::InitProp
API String ID: 431132790-860317130
Opcode ID: 611ce11d743fc88ebdc22a5162fa72eb137f9c33598012c0e161fab72caa18ee
Instruction ID: 12f0314e70d7736a22fbffd7b5705dee508732148183c263f25ae031e77dde08
Opcode Fuzzy Hash: 611ce11d743fc88ebdc22a5162fa72eb137f9c33598012c0e161fab72caa18ee
Instruction Fuzzy Hash: 58216871D0122ADACB05FB92C8819EEBB74BF18714F54045FF81177281DB786A0ACBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00479D1E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000105,?,?,FNetFile,00000000,?,00000000), ref: 00479D5E
GetDriveTypeW.KERNEL32(?), ref: 00479D94

Strings

FNetFile, xrefs: 00479D3A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: DriveFullNamePathType
String ID: FNetFile
API String ID: 462304697-3345384691
Opcode ID: b24a0c322df565879e6d7bc394463832c4c7b205daa01c7eda01b67cde7f25b0
Instruction ID: 9c825e9554ed367a047d290eadf7255a7a91fc59bf50e74ca479108658c130d5
Opcode Fuzzy Hash: b24a0c322df565879e6d7bc394463832c4c7b205daa01c7eda01b67cde7f25b0
Instruction Fuzzy Hash: 5B119431A01118AADB70DBA6DC49AEFB378EF95710F1041ABE819D3150EB349F86CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0044782F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00447836

Strings

CNotebookDoc::ClearSelection, xrefs: 00447845
CNotebookDoc::HasSelection, xrefs: 00447861

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNotebookDoc::ClearSelection$CNotebookDoc::HasSelection
API String ID: 431132790-597693304
Opcode ID: b8d4b26c6b666536624dc2aa12382a3887347f1cf972dce2c9f013ab5c22c14e
Instruction ID: ce8cfceac8c8e7b93fee3552cee0543873daad2b77a4d10de01065463d48704b
Opcode Fuzzy Hash: b8d4b26c6b666536624dc2aa12382a3887347f1cf972dce2c9f013ab5c22c14e
Instruction Fuzzy Hash: 9B215171D042199BEF10EB91C849BFEB774AF54718F14006EE905BB281DB7C5E06CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004A7D5E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004A7D68

Part of subcall function 004501B1: __EH_prolog3.LIBCMT ref: 004501B8
Part of subcall function 004501B1: #521.MFC42U(00000000,CPgIpc::GetGlobalRecoveryMode,?,00000018,004A79A8,?,CNotebookApp::_OnEndRecovery,00000000,0000000C,004A845A,?,00000001,CNotebookApp::_SecondaryInstanceRecovery,?,00000014,0044067C), ref: 004501E2

Part of subcall function 004A7726: __EH_prolog3_GS.LIBCMT ref: 004A7730
Part of subcall function 004A7726: memset.MSVCRT ref: 004A7770

Part of subcall function 004A7917: __EH_prolog3.LIBCMT ref: 004A791E

Part of subcall function 0045024E: __EH_prolog3.LIBCMT ref: 00450255
Part of subcall function 0045024E: #521.MFC42U(00000000,CPgIpc::SetInstanceRecoveryMode,?,00000018,004A8432,00000001,CNotebookApp::_SecondaryInstanceRecovery,?,00000014,0044067C), ref: 0045027F

Strings

CNotebookApp::_PreRecovery, xrefs: 004A7D77
,TD, xrefs: 004A7DA0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#521H_prolog3_$memset
String ID: ,TD$CNotebookApp::_PreRecovery
API String ID: 2074946786-3680646575
Opcode ID: e7c2427bc0c3af6735234184db1f18aefd18151a15d0dec1e884b91614d17196
Instruction ID: 696ccb2d9ad40aeb8e8d6721afb63c1ae3539a0ce98a15b9383c414cdfb6c3ce
Opcode Fuzzy Hash: e7c2427bc0c3af6735234184db1f18aefd18151a15d0dec1e884b91614d17196
Instruction Fuzzy Hash: 2B2150309052288BDF30EB25CC9979E7264AB21319F1005EFA41966291CF7C1F89CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00495A5A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?,CActiveFileList::_GetModifiedTimestamp,?,?,00000000,?), ref: 00495A9E
GetLastError.KERNEL32(?,00000000,?), ref: 00495AB8

Strings

CActiveFileList::_GetModifiedTimestamp, xrefs: 00495A7E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesErrorFileLast
String ID: CActiveFileList::_GetModifiedTimestamp
API String ID: 1799206407-140693438
Opcode ID: 062ef40ab3978b27db2c34de90376586346f87774f5f315db42a3c2f3c35c063
Instruction ID: f7a8a74164ca5633c862ee04639d966e74c51d2c16f4f12a029a7d3eca347cfb
Opcode Fuzzy Hash: 062ef40ab3978b27db2c34de90376586346f87774f5f315db42a3c2f3c35c063
Instruction Fuzzy Hash: 8D114F72D0161D9F8B11DFA9C9809AEBBB8EF54714B25813FEC52B7300D674AD05CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00447281, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00447288
#1165.MFC42U(CNotebookDoc::_GetCurrentRichInkPage,?,00000010,00447FB8,?), ref: 004472D0

Strings

CNotebookDoc::_GetCurrentRichInkPage, xrefs: 0044729A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CNotebookDoc::_GetCurrentRichInkPage
API String ID: 2221090558-1238297930
Opcode ID: 02b26655c3163f205170289ff3a1808f6d9e140e840c2840828f5acd2bb2b0a7
Instruction ID: dd9e1e8c51dbd148f0ac7ea384f989aa91e32af12dee9220fdace4484f7a1372
Opcode Fuzzy Hash: 02b26655c3163f205170289ff3a1808f6d9e140e840c2840828f5acd2bb2b0a7
Instruction Fuzzy Hash: 8321A275D0022ADFDB11DFA0C804AFEBBB4AF04704F1444AAEC05AB341DB789E06DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0048A16F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048A176

Part of subcall function 00489FD1: __EH_prolog3.LIBCMT ref: 00489FD8

Part of subcall function 00488C2A: PropVariantCopy.OLE32(?,?,CPropVal::GetValue,00000000,CPropVal::CPropVal,00000000,00000000), ref: 00488C5F

Part of subcall function 00488C7B: PropVariantClear.OLE32(?,CPropVal::~CPropVal,00000000,00000000), ref: 00488C96

Strings

CNBObject::_AddPropertyLong, xrefs: 0048A183
CPropVal::InitProp, xrefs: 0048A1A6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3PropVariant$ClearCopy
String ID: CNBObject::_AddPropertyLong$CPropVal::InitProp
API String ID: 2613138313-3092264455
Opcode ID: 287086e5673c86578edde12e7f35142726f0b1e99f6a799c51fe7787e0712211
Instruction ID: 31359a0b9ee4502f688114a6290078fee04914ed0526cbf5857df44d49e11020
Opcode Fuzzy Hash: 287086e5673c86578edde12e7f35142726f0b1e99f6a799c51fe7787e0712211
Instruction Fuzzy Hash: 6C214771D01169AACB05FB91C8819EEBB74BF14714F40045FF811B7281EB786B4ACBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00486CCD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00486CD4
#1165.MFC42U(CTOCView::_AddFolderToList,0E0227DC,00000014,0048721A,?,?,CTOCView::_PopulateFolderListFromScope,?,00000224,0048727F,CTOCView::_Repopulate,00000000,0000000C,004855EE), ref: 00486CF7

Part of subcall function 0048FE9F: __EH_prolog3_GS.LIBCMT ref: 0048FEA9
Part of subcall function 0048FE9F: memset.MSVCRT ref: 0048FEFB

Strings

CTOCView::_AddFolderToList, xrefs: 00486CE1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3H_prolog3_memset
String ID: CTOCView::_AddFolderToList
API String ID: 835806947-2971151142
Opcode ID: 8ba0b7bad3a09c44af98722631e33612b146ce781d419a01a4bbaf658932a1ad
Instruction ID: acb6d3ee0d6869d92ce8762fa4eef611fde6137a5891bb10dbd1789acaad8596
Opcode Fuzzy Hash: 8ba0b7bad3a09c44af98722631e33612b146ce781d419a01a4bbaf658932a1ad
Instruction Fuzzy Hash: CB216071A0121A9FCF04EF95C8859EEBBB0BF08710F11446EE909BB351DB349E44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0044F96E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044F975
#521.MFC42U(00000000,CPgIpc::Register,?,0000001C,004401CC,00000000), ref: 0044F99F

Part of subcall function 0044FC3B: __EH_prolog3.LIBCMT ref: 0044FC42
Part of subcall function 0044FC3B: #4162.MFC42U(CLockHolder::AcquireLock,00000000,0000000C,00450044,?,?,?,?), ref: 0044FC6A

Part of subcall function 0043549E: #1172.MFC42U(00442724), ref: 0043549E

Strings

CPgIpc::Register, xrefs: 0044F982

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1172#4162#521
String ID: CPgIpc::Register
API String ID: 1516634429-1552123806
Opcode ID: ac7179589ac914c1bb8f087d64f471e210c0b81aa11de93bc2ea33dec27fc2d0
Instruction ID: d413ae25d0c533cb2c2cb10a79f4f00c4a0c01826cfb875e2e7a18ba786246f3
Opcode Fuzzy Hash: ac7179589ac914c1bb8f087d64f471e210c0b81aa11de93bc2ea33dec27fc2d0
Instruction Fuzzy Hash: 7E218E70A01219DFD704DFA9C5809ACBBB0BF18304B4500AEE806B7742DB38EE05CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00494A7F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(?,00000000,?,?), ref: 00494AC4
GetLastError.KERNEL32 ref: 00494ACE

Strings

CNBFileSettings::WriteValueSz, xrefs: 00494A95

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastPrivateProfileStringWrite
String ID: CNBFileSettings::WriteValueSz
API String ID: 3017697783-1080475291
Opcode ID: 740a8f6cf513e91c9e42bf594dcfd7f0072ade86ec62934c5a4a80cb89df5a03
Instruction ID: bacaa90e26531c5ca0bffd5494a99cd4a842a5c3f14a1516b66a872c8f5a253e
Opcode Fuzzy Hash: 740a8f6cf513e91c9e42bf594dcfd7f0072ade86ec62934c5a4a80cb89df5a03
Instruction Fuzzy Hash: F0110436900118EBCF21DB85D908FAA7FB4AB48314F1580BBE90467264C779EE81DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004795E8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57windowCOMMON

Download Yara Rule

APIs

TraceMessage.ADVAPI32(?,0000EF51,0000002B,0041E95C,0000000A,NULL,0000000A,004BAB95,00000004,00000000,?,?,00000000,0000000A,?,004BAB95), ref: 00479655

Strings

NULL, xrefs: 0047963D
<NULL>, xrefs: 00479636, 0047964A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: c92d7f53152eba9a7641cf7355d5a27590d947026ad4fcd0be17fec18153c639
Instruction ID: 8978b924ee5657b1d9d928e608dbdbd83bff4141ad418672b4559c7d6d940425
Opcode Fuzzy Hash: c92d7f53152eba9a7641cf7355d5a27590d947026ad4fcd0be17fec18153c639
Instruction Fuzzy Hash: 11012272A00105ABDB288B18DC55FBB7368EB44710F15862BBD09AB280E6B85E4183E9

Uniqueness

Uniqueness Score: -1.00%

Function 004356C7, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57windowCOMMON

Download Yara Rule

APIs

TraceMessage.ADVAPI32(00000001,0042ECAF,0000002B,0041C8FC,0000000D,00000714,00000004,NULL,0000000A,00000000,?,6DEDD6D0,00000000,0000000D,?,004A8573), ref: 00435734

Strings

NULL, xrefs: 0043571C
<NULL>, xrefs: 00435715, 00435723

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: 5046069887f353319e72c0c9779bf95af688937fc90c88f798e9988a5af62ecd
Instruction ID: f5e925e7210e75e1e8eeca3ee8c0bb09b6dbad1c4df2da05f4987adc458a49ca
Opcode Fuzzy Hash: 5046069887f353319e72c0c9779bf95af688937fc90c88f798e9988a5af62ecd
Instruction Fuzzy Hash: C9012236600504ABDB249F58DC46F7F736CEB48710F15542BFD0AAB280E7B45D4183A9

Uniqueness

Uniqueness Score: -1.00%

Function 004254AE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32 ref: 004254D0
IsChild.USER32(?,?), ref: 004254DF

Strings

CSplitWnd::IsChildPane, xrefs: 004254C0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ChildCtrl
String ID: CSplitWnd::IsChildPane
API String ID: 2363917984-36554190
Opcode ID: a3a23d8526c02d994915aeec3a4335dd45a16c424879b3956d2e94113c2ff3fc
Instruction ID: 5c31f2a8c67b9dbe941a8ba3a7773d61ac3669c9b476c6bbd4cfb46091babb3f
Opcode Fuzzy Hash: a3a23d8526c02d994915aeec3a4335dd45a16c424879b3956d2e94113c2ff3fc
Instruction Fuzzy Hash: 5611C631701624AFCB14DF6AE844BAABB66FF41720B40467AF826CB1D0DB34ED51CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0042535F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

#1165.MFC42U(CSplitWnd::CreateScrollBarCtrl,00000000,0E0227DC), ref: 004253A3

Part of subcall function 004B045B: CreateWindowExW.USER32 ref: 004B049E
Part of subcall function 004B045B: GetLastError.KERNEL32(?,?,00000000), ref: 004B04AA

Strings

SCROLLBAR, xrefs: 004253AB
CSplitWnd::CreateScrollBarCtrl, xrefs: 00425395

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165CreateErrorLastWindow
String ID: CSplitWnd::CreateScrollBarCtrl$SCROLLBAR
API String ID: 2223060391-2788237065
Opcode ID: 02e883ef7b4add65becdeb7a1edca024f92ac3d79c938fd304191a560a7f0358
Instruction ID: e1f232e42c09ad1a33d22c3c575076478e99f9bbe4540328761440790a8fc4a2
Opcode Fuzzy Hash: 02e883ef7b4add65becdeb7a1edca024f92ac3d79c938fd304191a560a7f0358
Instruction Fuzzy Hash: F001C872204240ABC310DB19CD46F9777E8E7D5B20F00431FF555C3190DBB8A404C6A9

Uniqueness

Uniqueness Score: -1.00%

Function 00484927, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048492E

Part of subcall function 0048407D: __EH_prolog3.LIBCMT ref: 00484084

Strings

W, xrefs: 00484938
CViewMgr::SetTOCViewType, xrefs: 00484940

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CViewMgr::SetTOCViewType$W
API String ID: 431132790-1820012973
Opcode ID: 0226334db792d701f60980c473b0f73b28024560832a5a03532c7e5f88554e95
Instruction ID: dfc1aafc818216205f6f60f9ee2c03849b0426ffd48456dcf55f5b9c766e35a7
Opcode Fuzzy Hash: 0226334db792d701f60980c473b0f73b28024560832a5a03532c7e5f88554e95
Instruction Fuzzy Hash: 970108F190121757DB25FBB18C02BBF62209B40704F64042FE5067B2C4CBAC4E4187AF

Uniqueness

Uniqueness Score: -1.00%

Function 0042A24B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

TraceMessage.ADVAPI32(?,?,0000002B,0041E420,0000000A,NULL,0000000A,00000000,?,00000000,?,0000000A,?,004AE8A8,00969CB0,0000EF51), ref: 0042A2B2

Strings

NULL, xrefs: 0042A2A0
<NULL>, xrefs: 0042A299, 0042A2A7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageTrace
String ID: <NULL>$NULL
API String ID: 471583391-888386124
Opcode ID: dabe98d185293d4b185bed0c44ef9511d94c6eda7a6192d19c4ecbb046bac0b5
Instruction ID: 8f1b0b9da922a45c563beb4e8613dc2a96f17a1682d171bdcc4f1a439bfd365f
Opcode Fuzzy Hash: dabe98d185293d4b185bed0c44ef9511d94c6eda7a6192d19c4ecbb046bac0b5
Instruction Fuzzy Hash: E901F931700125EBDB244B54AC05F7B7368EB84710F5541ABFC055B380E6B65D6182BA

Uniqueness

Uniqueness Score: -1.00%

Function 00456AA0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00456AA7

Part of subcall function 0045091E: __EH_prolog3_GS.LIBCMT ref: 00450925
Part of subcall function 0045091E: #1165.MFC42U(CItemPicker::CreateSampleWnd,?,00000054,00456AF2,00000000,004570B7,?,?,00000000,?,CImagePicker::CreateImagePicker,00000000,00000010,004584F3,00000000,?), ref: 00450956
Part of subcall function 0045091E: GetWindowLongW.USER32(00000000,000000EC), ref: 00450967
Part of subcall function 0045091E: OpenThemeData.UXTHEME(00000000,COMBOBOX,?,?,?,00000003,00000003,?,?,00000001), ref: 0045097B
Part of subcall function 0045091E: GetClassInfoW.USER32 ref: 00450993
Part of subcall function 0045091E: RegisterClassW.USER32 ref: 004509CF
Part of subcall function 0045091E: GetWindow.USER32(?,00000003), ref: 004509D8
Part of subcall function 0045091E: DestroyWindow.USER32(?,?,?,?,?,00000003,00000003,?,?,00000001), ref: 004509ED
Part of subcall function 0045091E: MapWindowPoints.USER32 ref: 004509FE

Part of subcall function 00450B48: __EH_prolog3.LIBCMT ref: 00450B4F
Part of subcall function 00450B48: #1165.MFC42U(CItemPicker::CreatePickerWnd,00000000,0000003C,00456B08,004570B7,MSNB_IP_IPWC,00000000,004570B7,?,?,00000000,?,CImagePicker::CreateImagePicker,00000000,00000010,004584F3), ref: 00450B6F
Part of subcall function 00450B48: GetWindowLongW.USER32(00000000,000000EC), ref: 00450B7D
Part of subcall function 00450B48: GetClassInfoW.USER32 ref: 00450B94
Part of subcall function 00450B48: RegisterClassW.USER32 ref: 00450BC9

Part of subcall function 00456B44: __EH_prolog3.LIBCMT ref: 00456B4B
Part of subcall function 00456B44: #384.MFC42U(CImagePicker::SetUpPickerImageList,00000000,0000001C,00456B28,?,?,?,00000003,00000003,?,?,00000001), ref: 00456B8E
Part of subcall function 00456B44: #2088.MFC42U(?,?,?,00000000,?,?,?,?,00000003,00000003,?,?,00000001), ref: 00456BC7
Part of subcall function 00456B44: ImageList_AddMasked.COMCTL32(00000002,?,?,?,?,?,?,00000003,00000003,?,?,00000001), ref: 00456C1E
Part of subcall function 00456B44: #2406.MFC42U(?,?,?,00000003,00000003,?,?,00000001), ref: 00456C2C
Part of subcall function 00456B44: #2400.MFC42U(?,?,?,00000003,00000003,?,?,00000001), ref: 00456C67

Strings

CImagePicker::CreateImagePicker, xrefs: 00456AB6
MSNB_IP_IPWC, xrefs: 00456AFB

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Class$H_prolog3$#1165InfoLongRegister$#2088#2400#2406#384DataDestroyH_prolog3_ImageList_MaskedOpenPointsTheme
String ID: CImagePicker::CreateImagePicker$MSNB_IP_IPWC
API String ID: 1973759204-2520302910
Opcode ID: 8651320e474359df9cb8942c251c48ba4377154936ccacd09e83cc9eb9c51c57
Instruction ID: ee0b0e034bc0b5af4c5bf00d746c5fb50c6c42dec2421a3d605ebe716b759db4
Opcode Fuzzy Hash: 8651320e474359df9cb8942c251c48ba4377154936ccacd09e83cc9eb9c51c57
Instruction Fuzzy Hash: E211A071E022299BCB11DF518941BAEBAA1AF44B55F55002AFE04FB286CB3C5E05C7F9

Uniqueness

Uniqueness Score: -1.00%

Function 004AFAB3, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Policies\Microsoft\TabletPC,00000000,?,?,Helpers::RegOpenKeyExW,00000000,?,00000000,?,?,00000000), ref: 004AFAE0

Strings

SOFTWARE\Policies\Microsoft\TabletPC, xrefs: 004AFADE
Helpers::RegOpenKeyExW, xrefs: 004AFAC9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Open
String ID: Helpers::RegOpenKeyExW$SOFTWARE\Policies\Microsoft\TabletPC
API String ID: 71445658-3725502985
Opcode ID: a04407c14576289feb0c8ee99d087f94449508ac20ef7ec9bcaa681cc6621e82
Instruction ID: d883e150b6528f4212259f039186ff655f06e737ae777f4d7d3237f30c219825
Opcode Fuzzy Hash: a04407c14576289feb0c8ee99d087f94449508ac20ef7ec9bcaa681cc6621e82
Instruction Fuzzy Hash: 29110832600114ABC729CE8AD954FAE77B8EF55320F20416BF9059B3A1CB79DD04D7B8

Uniqueness

Uniqueness Score: -1.00%

Function 00485570, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00485577
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004855CE

Strings

CTOCView::SetViewType, xrefs: 00485580

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3MessageSend
String ID: CTOCView::SetViewType
API String ID: 936991600-3612857036
Opcode ID: 596cd24555da3c7789a4fe64d3fee5fe440a994206aa5510da3d5ef7c935c899
Instruction ID: b6291352bafb22552dcba5b13d96d50ce9729bbb8bc306b70ad8808476fb84bd
Opcode Fuzzy Hash: 596cd24555da3c7789a4fe64d3fee5fe440a994206aa5510da3d5ef7c935c899
Instruction Fuzzy Hash: E9115630300A0067DB15BB7689667FE26526F90708F50482FF95A67281DF6CAE05975D

Uniqueness

Uniqueness Score: -1.00%

Function 0046D1BA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0046D1C1
#1165.MFC42U(CPageSetupCommon::GetPageSizeFromRegistry,?,00000018,004670C0,?,?,?,?,?,?,?,00000074,00432E7A,0000EF59,?,?), ref: 0046D1F2

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

Part of subcall function 0046D25C: #1165.MFC42U(CPageSetupCommon::GetAutoPageSize,0E0227DC,0E0227DC,?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0046D2B5
Part of subcall function 0046D25C: #1165.MFC42U(?,?,00000000,00000000,?,?,?,?,?,?,CMainFrame::OnCommand,00000000,0E0227DC), ref: 0046D2D5
Part of subcall function 0046D25C: GetDC.USER32(?), ref: 0046D2E9

Strings

CPageSetupCommon::GetPageSizeFromRegistry, xrefs: 0046D1D8

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$H_prolog3memcpy
String ID: CPageSetupCommon::GetPageSizeFromRegistry
API String ID: 218315988-299033450
Opcode ID: c2f61a6f9dc5d21924b679376535af7c308e5096585f4dbbe41bed06d76867e3
Instruction ID: 6c4b9cef9367c845dd1e3b32d3533bd68c7de498d987cb88366d952913d89820
Opcode Fuzzy Hash: c2f61a6f9dc5d21924b679376535af7c308e5096585f4dbbe41bed06d76867e3
Instruction Fuzzy Hash: 55114271F011168BC710DF95C851AFEBB70AF45B00F5541AAE814BB340EB789E15C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 00444CD6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

#1165.MFC42U ref: 00444D4D

Part of subcall function 0042C541: __EH_prolog3_GS.LIBCMT ref: 0042C54B
Part of subcall function 0042C541: #540.MFC42U(CMainFrame::OnDocTitleChange,00000000,000002CC,00444F91,?,00000104,?,?,?,?,?,?), ref: 0042C56E
Part of subcall function 0042C541: #1165.MFC42U(?,?,?,?,?,?), ref: 0042C57A
Part of subcall function 0042C541: #4155.MFC42U(0000EF20,?,?,?,?,?,?), ref: 0042C5BA
Part of subcall function 0042C541: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 0042C5DF
Part of subcall function 0042C541: #6868.MFC42U(004048FC,?,?,?,?,?,?,?), ref: 0042C5FE
Part of subcall function 0042C541: #6195.MFC42U(?,?,?,?,?,?,?), ref: 0042C60C
Part of subcall function 0042C541: #800.MFC42U(?,?,?,?,?,?), ref: 0042C61C

Strings

CNotebookDoc::Init, xrefs: 00444D0C
CNotebookDoc::SetDefName, xrefs: 00444D1F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#4155#540#6195#6868#800FileH_prolog3_Info
String ID: CNotebookDoc::Init$CNotebookDoc::SetDefName
API String ID: 3806826417-12111418
Opcode ID: 1fa5c98e69d462320dac75b8bdc6fceeb21368773670728665282a2bea497b49
Instruction ID: 11f35191f6742c48e06fc2c5347123d9ffe97fcf6327c4d663525ac89ba653ed
Opcode Fuzzy Hash: 1fa5c98e69d462320dac75b8bdc6fceeb21368773670728665282a2bea497b49
Instruction Fuzzy Hash: 361182755087809FC324DF2AD945B5BBBE4EF99724F00462FE49A93290DB78A404CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 004AF6EC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,00009CD2,00000000,?), ref: 004AF717
GetLastError.KERNEL32(?,00000000,?,0047A4AB), ref: 004AF723

Strings

Helpers::LoadStringW, xrefs: 004AF702

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLoadString
String ID: Helpers::LoadStringW
API String ID: 637397188-3972921965
Opcode ID: 2a10e18a708dfc387b5fb5e9fc0b7161cd9bf8355daf41db52634ec74b7e4d38
Instruction ID: eb7921a95ab022555a21bad771eb407cf88cf0582bc1b24a86ed3243248851d1
Opcode Fuzzy Hash: 2a10e18a708dfc387b5fb5e9fc0b7161cd9bf8355daf41db52634ec74b7e4d38
Instruction Fuzzy Hash: 7511E139600114ABCB25AF96D944BBB7BB8AF61314F20406FF900D72A0CB3AC941C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00498139, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00498166
SetMenuItemInfoW.USER32 ref: 0049818C

Part of subcall function 004B01BF: RemoveMenu.USER32(?,00009D40,00000000,Helpers::RemoveMenu,00000000,00000000,?,CCopyTo::ReplaceEmailPlaceholder,00000000,?), ref: 004B01E6
Part of subcall function 004B01BF: GetLastError.KERNEL32 ref: 004B01F2

Strings

CCopyTo::ReplaceEmailPlaceholder, xrefs: 00498148

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$ErrorInfoItemLastRemovememset
String ID: CCopyTo::ReplaceEmailPlaceholder
API String ID: 2239665019-1733967200
Opcode ID: 35e40c1e4ef7aa9d429e9af95d414ec96bfe6e83864b99497d3b9e3c8a42ca9a
Instruction ID: cc84094c64ead00482d9f7f4084c4dd7ea5f0e7e13f5d8301e0084ca3e75e815
Opcode Fuzzy Hash: 35e40c1e4ef7aa9d429e9af95d414ec96bfe6e83864b99497d3b9e3c8a42ca9a
Instruction Fuzzy Hash: 8101F1B29002087BDB14AB6AEC0ADEF7B7CEBC1320F00412FF81596251DA745905CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 004AF990, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 004AF9C6
GetLastError.KERNEL32(?,00000403,?,?,0E0227DC,000003E8,?,Helpers::SendMessageTimeoutW,00000000,?,00000000,0E0227DC), ref: 004AF9D2

Strings

Helpers::SendMessageTimeoutW, xrefs: 004AF9A6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMessageSendTimeout
String ID: Helpers::SendMessageTimeoutW
API String ID: 1249123084-1975110892
Opcode ID: d3a4085edeefc362dcb8bdaa20fd2ddeec448f3a8281302aa5954982fef27363
Instruction ID: e4e4c5bbaf6cf6958235a8cebb54bd09a0500caaa39103be689a05173e5d3581
Opcode Fuzzy Hash: d3a4085edeefc362dcb8bdaa20fd2ddeec448f3a8281302aa5954982fef27363
Instruction Fuzzy Hash: 81010431601104BBDB25DF95ED04FFB3B68DB65314F2140ABFA0896291CB3ACA15D7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00487A23, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00487A2A
PropVariantClear.OLE32(?), ref: 00487A9C

Part of subcall function 00428EC5: TraceMessage.ADVAPI32(?,00000008,0000002B,00412F04,0000000E,00000000,?,00425AA2,00969CB0,0000EF51,_AfxCanSplitRowCol,00000000), ref: 00428ED6

Strings

CTOCView::_GetFlagCount, xrefs: 00487A35

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ClearH_prolog3MessagePropTraceVariant
String ID: CTOCView::_GetFlagCount
API String ID: 2510849016-2467817300
Opcode ID: 0279d5b27b7183ba49aeb225814dccf018f2851bfb1c97f2859af25673b2426f
Instruction ID: 26bfedba5ac28c6373e32b8ab077c74906d54808d4b2eea58845ad16738a37d0
Opcode Fuzzy Hash: 0279d5b27b7183ba49aeb225814dccf018f2851bfb1c97f2859af25673b2426f
Instruction Fuzzy Hash: AF110831A00204ABDB09DBA5C954EDFB770AF48304F20845BF605A71A1C778DE84C779

Uniqueness

Uniqueness Score: -1.00%

Function 004B0349, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,?,?,?,00000000,?,Helpers::SetWindowPos,00000000,?,00000000,?), ref: 004B037D
GetLastError.KERNEL32 ref: 004B0389

Strings

Helpers::SetWindowPos, xrefs: 004B035F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastWindow
String ID: Helpers::SetWindowPos
API String ID: 3412209079-4097789006
Opcode ID: 70035b12401419dd0cc39debd0e0a4884841b6f7c8693e33a50b41bbe6e70ca8
Instruction ID: 47f4ac06f26b049d66b5c2362458ea1911ce4a798537c02bdb62ba23f02044a7
Opcode Fuzzy Hash: 70035b12401419dd0cc39debd0e0a4884841b6f7c8693e33a50b41bbe6e70ca8
Instruction Fuzzy Hash: 0701C831501104ABCB25DF55DD08AFF3BA5EF54315F20419AFD1496261CB3AC961DBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0042D824, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

#1165.MFC42U(CMainFrame::IsRecognitionEnabled,00000000,0E0227DC,00000001,0E0227DC), ref: 0042D869

Part of subcall function 00465A7A: memcpy.MSVCRT ref: 00465B15

#1165.MFC42U(?,00000004,0000000F), ref: 0042D891

Part of subcall function 004426C6: __EH_prolog3_catch_GS.LIBCMT ref: 004426D0
Part of subcall function 004426C6: #540.MFC42U(CNotebookApp::DisplayMessageBox,00000000,00000478,00445F8C,0000EF6C,00000003,?), ref: 00442701
Part of subcall function 004426C6: #540.MFC42U ref: 0044270D
Part of subcall function 004426C6: #540.MFC42U ref: 00442719
Part of subcall function 004426C6: GetLastActivePopup.USER32(?), ref: 00442730
Part of subcall function 004426C6: memset.MSVCRT ref: 00442753
Part of subcall function 004426C6: memset.MSVCRT ref: 0044276D
Part of subcall function 004426C6: memset.MSVCRT ref: 00442787
Part of subcall function 004426C6: memset.MSVCRT ref: 004427A1
Part of subcall function 004426C6: PathCompactPathExW.SHLWAPI(?,?,00000082,00000000), ref: 004427D4
Part of subcall function 004426C6: lstrlenW.KERNEL32(00000000), ref: 004427EB
Part of subcall function 004426C6: lstrlenW.KERNEL32(00000000), ref: 00442817

Strings

CMainFrame::IsRecognitionEnabled, xrefs: 0042D857

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$#540$#1165Pathlstrlen$ActiveCompactH_prolog3_catch_LastPopupmemcpy
String ID: CMainFrame::IsRecognitionEnabled
API String ID: 1396176550-186204183
Opcode ID: b746b799f46dcd058cdc54c8fb6f3fa59f6940ed093860c60f365e954e7ee010
Instruction ID: d3f7b1eb35010864b8d7103faa82472cfde4fdc1ad1cf2a5438c17f04371beaf
Opcode Fuzzy Hash: b746b799f46dcd058cdc54c8fb6f3fa59f6940ed093860c60f365e954e7ee010
Instruction Fuzzy Hash: 5B010871248342AFD300EF55CD81F16B798FB94720F40463EF215471D1EB789404C72A

Uniqueness

Uniqueness Score: -1.00%

Function 004B00A7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,00000000,00000005,?,00000000,Helpers::MoveWindow,00000000,?,?,?,CSrchView::_SetState), ref: 004B00D7
GetLastError.KERNEL32(?,CSrchView::_SetState), ref: 004B00E3

Strings

Helpers::MoveWindow, xrefs: 004B00BD

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMoveWindow
String ID: Helpers::MoveWindow
API String ID: 258800392-2347968636
Opcode ID: 1fc96e8a9263d8f5786f45011fd70e89ab979e08995e9489edc20552f76a1726
Instruction ID: 9e8fd902fe7e0e568cc8caacc8d4750c6452fc40e2e2621c0db5911ad59752a2
Opcode Fuzzy Hash: 1fc96e8a9263d8f5786f45011fd70e89ab979e08995e9489edc20552f76a1726
Instruction Fuzzy Hash: ED019231600114ABCB269F5A9D04BFB7B69EF44315F20416BFA04962A1CB7AC951C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 0049564C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00495656

Part of subcall function 00495315: memset.MSVCRT ref: 00495337

lstrlenW.KERNEL32(?,CActiveFileList::UpdateTimestamp,?,00000430,00445C49,?,?,00000000), ref: 00495699

Strings

CActiveFileList::UpdateTimestamp, xrefs: 00495674

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_lstrlenmemset
String ID: CActiveFileList::UpdateTimestamp
API String ID: 1545918636-2165638075
Opcode ID: 05fe10ba751253b6d77f15d5c276fcc1f329ac554e55bebbcb0bf54294bec1cc
Instruction ID: 65ee09e0f6fd40a85ff314b1def3a9387b40f7e0af5998ac3211ff9495fb6569
Opcode Fuzzy Hash: 05fe10ba751253b6d77f15d5c276fcc1f329ac554e55bebbcb0bf54294bec1cc
Instruction Fuzzy Hash: 3D11A7B19025289BCF11EB108894BED76789F50714F9050FEEA09A7201C7385F49CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 004AF65B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 004AF68C
GetLastError.KERNEL32 ref: 004AF698

Strings

Helpers::LoadImageW, xrefs: 004AF671

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorImageLastLoad
String ID: Helpers::LoadImageW
API String ID: 2189606529-3821065122
Opcode ID: 81ed3692f67f68159f7bf4d4a888ec2043aef6e2ce7c5f15575400d4820658f5
Instruction ID: bb0702a7054434bfe4a24fb85b43414e9ff028d2d466d20829d6ba379133c1e4
Opcode Fuzzy Hash: 81ed3692f67f68159f7bf4d4a888ec2043aef6e2ce7c5f15575400d4820658f5
Instruction Fuzzy Hash: 8001C431500115ABCB159E95DD04BBB3B69EB55324F10406BFA0496261DB3AC952CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00479E0E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004AF3C0: SetTimer.USER32(00000000,00000000,00000000,?), ref: 004AF3EB
Part of subcall function 004AF3C0: GetLastError.KERNEL32 ref: 004AF3F7

MessageBoxW.USER32(?,?,?,?), ref: 00479E48

Part of subcall function 004AF33B: KillTimer.USER32(00000000,00000000,Helpers::KillTimer,00000000,00000000,00000000,TimedMessageBox,00000000,?), ref: 004AF360
Part of subcall function 004AF33B: GetLastError.KERNEL32 ref: 004AF36C

PeekMessageW.USER32 ref: 00479E66

Strings

TimedMessageBox, xrefs: 00479E1F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMessageTimer$KillPeek
String ID: TimedMessageBox
API String ID: 2626111271-1100350776
Opcode ID: b62db3b09a76713d0bb2fc637ce5d93ed5865d34ce98e6f1648c9c55bb2c8514
Instruction ID: 1de6da94584e2a872959a3105bcb47b5b512defb180f843edddaf20174769744
Opcode Fuzzy Hash: b62db3b09a76713d0bb2fc637ce5d93ed5865d34ce98e6f1648c9c55bb2c8514
Instruction Fuzzy Hash: DB01D632B4024837DB149BA69C4AFEF776ADB99B10F10412BFA05E71C1DD759C119394

Uniqueness

Uniqueness Score: -1.00%

Function 004ADA41, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004ADA48

Strings

CIdleTask::SetManager, xrefs: 004ADA7B
CIdleTaskMgr::Add, xrefs: 004ADA57

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CIdleTask::SetManager$CIdleTaskMgr::Add
API String ID: 431132790-3347018804
Opcode ID: 1e8a013e394c19467b9a11c1d7d10fc46805b428cb8988b0bb5d7fb6993c99ff
Instruction ID: cdf38ee688ab5a913b701e5865b06da7cf9424ccb6dccd76b6e1b9f449004a3e
Opcode Fuzzy Hash: 1e8a013e394c19467b9a11c1d7d10fc46805b428cb8988b0bb5d7fb6993c99ff
Instruction Fuzzy Hash: 70112571E002249BCB11DB82C941BFE77709F21728F24406BE9017B290CB7C9E05C7B9

Uniqueness

Uniqueness Score: -1.00%

Function 0045024E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00450255
#521.MFC42U(00000000,CPgIpc::SetInstanceRecoveryMode,?,00000018,004A8432,00000001,CNotebookApp::_SecondaryInstanceRecovery,?,00000014,0044067C), ref: 0045027F

Part of subcall function 0044FC3B: __EH_prolog3.LIBCMT ref: 0044FC42
Part of subcall function 0044FC3B: #4162.MFC42U(CLockHolder::AcquireLock,00000000,0000000C,00450044,?,?,?,?), ref: 0044FC6A

Part of subcall function 0044FC98: __EH_prolog3.LIBCMT ref: 0044FC9F

Strings

CPgIpc::SetInstanceRecoveryMode, xrefs: 00450262

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#4162#521
String ID: CPgIpc::SetInstanceRecoveryMode
API String ID: 1674528075-3401666477
Opcode ID: e79f3f37267bf020ddfa66ffbb469c27a96632b6a8ed56f949205b7302f9359d
Instruction ID: 58a6c81c07c12abb368a50871fc30f59b7197eb7dd473e58d40789302ba417aa
Opcode Fuzzy Hash: e79f3f37267bf020ddfa66ffbb469c27a96632b6a8ed56f949205b7302f9359d
Instruction Fuzzy Hash: E8115179901219ABDB04EF95C8855EEB7B0BF14314F5444BFE80667281DB385E09CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00429356, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042935D
#1165.MFC42U ref: 0042939E

Part of subcall function 0042AF6F: __EH_prolog3.LIBCMT ref: 0042AF76
Part of subcall function 0042AF6F: #1165.MFC42U(CMainFrame::GetNotebookDPIRatio,00000000,0000001C,004293AF), ref: 0042AF98
Part of subcall function 0042AF6F: GetDC.USER32(?), ref: 0042AFC0
Part of subcall function 0042AF6F: #2854.MFC42U(00000000), ref: 0042AFC7
Part of subcall function 0042AF6F: GetDeviceCaps.GDI32(?,00000058), ref: 0042AFED
Part of subcall function 0042AF6F: ReleaseDC.USER32 ref: 0042B00B

Strings

CNBDocViewCtrl::GetScale, xrefs: 0042936F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3$#2854CapsDeviceRelease
String ID: CNBDocViewCtrl::GetScale
API String ID: 75335821-1788728721
Opcode ID: 7941a20452445db1c96225b8017cc38a4468f0bfd209500192fb565032ffcfac
Instruction ID: e0e71eaa9f3ffa5da19afd2cbae5098a0f48c7fc7e97ba830874f51990cc847f
Opcode Fuzzy Hash: 7941a20452445db1c96225b8017cc38a4468f0bfd209500192fb565032ffcfac
Instruction Fuzzy Hash: 4F110070A00126DBCF04EF60C980AEE7B70FF08720F11449AED55AB291CB38AD11CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044FB09, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044FB10
#521.MFC42U(00000000,CPgIpc::SetFileOpen,?,00000018,004497A0,00000000,CPgIpc::OnCloseDocument,00000000), ref: 0044FB3A

Strings

CPgIpc::SetFileOpen, xrefs: 0044FB1D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #521H_prolog3
String ID: CPgIpc::SetFileOpen
API String ID: 2244394926-3023149515
Opcode ID: 88cdba8f12ac8bbb6ff21df4079ec00ee314b79d392771d2f32b6a497edb1ca7
Instruction ID: d29cba4dd0813d5c6ab9fd67fa215977be0b19d7049178e4fc12275c8d040cbd
Opcode Fuzzy Hash: 88cdba8f12ac8bbb6ff21df4079ec00ee314b79d392771d2f32b6a497edb1ca7
Instruction Fuzzy Hash: 8F11A071901259DFDB04EF95C9915FDBBB0AF19314B5004BFE802B7281DB38AE09C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0044C562, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C569

Part of subcall function 004498A3: #1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

Strings

CNotebookDoc::HaveActiveObject, xrefs: 0044C576
W, xrefs: 0044C5CC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CNotebookDoc::HaveActiveObject$W
API String ID: 2221090558-980574227
Opcode ID: 5c8a6d1c587e98bfaf700b37f0a6ee81da3bb033d2873a64f09917aa990142a4
Instruction ID: 0575d192639953ff7abe71c1e038eeb59d309001953c3ed8f55873d17a46af3a
Opcode Fuzzy Hash: 5c8a6d1c587e98bfaf700b37f0a6ee81da3bb033d2873a64f09917aa990142a4
Instruction Fuzzy Hash: 4011A5B190121A9BDB14DF95C8819FFB7B2AFC0704F18C12FA50666244DF785E04CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004AF905, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetTextExtentPoint32W.GDI32(?,?,00000000,?), ref: 004AF930
GetLastError.KERNEL32 ref: 004AF93C

Strings

Helpers::GetTextExtentPoint32W, xrefs: 004AF91B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExtentLastPoint32Text
String ID: Helpers::GetTextExtentPoint32W
API String ID: 127715581-3432910296
Opcode ID: 09df00677ad2e568361691c6a51dec6a65898f2f3a5dd384029ec65f4d2168de
Instruction ID: e78bab5aa79c8147e4150a2d3b30948e0a807428a7b6f840fc5b617b9ca57e58
Opcode Fuzzy Hash: 09df00677ad2e568361691c6a51dec6a65898f2f3a5dd384029ec65f4d2168de
Instruction Fuzzy Hash: 1701F5B1600114BBC7259BA6DD04FBF7BA8DB65324F20406FF90496250CB3AC945C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 004501B1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004501B8
#521.MFC42U(00000000,CPgIpc::GetGlobalRecoveryMode,?,00000018,004A79A8,?,CNotebookApp::_OnEndRecovery,00000000,0000000C,004A845A,?,00000001,CNotebookApp::_SecondaryInstanceRecovery,?,00000014,0044067C), ref: 004501E2

Part of subcall function 0044FC3B: __EH_prolog3.LIBCMT ref: 0044FC42
Part of subcall function 0044FC3B: #4162.MFC42U(CLockHolder::AcquireLock,00000000,0000000C,00450044,?,?,?,?), ref: 0044FC6A

Strings

CPgIpc::GetGlobalRecoveryMode, xrefs: 004501C5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#4162#521
String ID: CPgIpc::GetGlobalRecoveryMode
API String ID: 1674528075-2909528031
Opcode ID: 1dc15e06c9672157de0e28c32596c093a6b1e6aa11c695b47c7359aed366026b
Instruction ID: e9eb92bcc941b927059ef3304cbc69ca80b2e0e852c4d848d3c7625519d588ee
Opcode Fuzzy Hash: 1dc15e06c9672157de0e28c32596c093a6b1e6aa11c695b47c7359aed366026b
Instruction Fuzzy Hash: E7115479901219DFD701DFA5C8856DD77B0BF18304F4005BBED02A7241DB789E09CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004561BC, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004561C3

Part of subcall function 0045091E: __EH_prolog3_GS.LIBCMT ref: 00450925
Part of subcall function 0045091E: #1165.MFC42U(CItemPicker::CreateSampleWnd,?,00000054,00456AF2,00000000,004570B7,?,?,00000000,?,CImagePicker::CreateImagePicker,00000000,00000010,004584F3,00000000,?), ref: 00450956
Part of subcall function 0045091E: GetWindowLongW.USER32(00000000,000000EC), ref: 00450967
Part of subcall function 0045091E: OpenThemeData.UXTHEME(00000000,COMBOBOX,?,?,?,00000003,00000003,?,?,00000001), ref: 0045097B
Part of subcall function 0045091E: GetClassInfoW.USER32 ref: 00450993
Part of subcall function 0045091E: RegisterClassW.USER32 ref: 004509CF
Part of subcall function 0045091E: GetWindow.USER32(?,00000003), ref: 004509D8
Part of subcall function 0045091E: DestroyWindow.USER32(?,?,?,?,?,00000003,00000003,?,?,00000001), ref: 004509ED
Part of subcall function 0045091E: MapWindowPoints.USER32 ref: 004509FE

Part of subcall function 00450B48: __EH_prolog3.LIBCMT ref: 00450B4F
Part of subcall function 00450B48: #1165.MFC42U(CItemPicker::CreatePickerWnd,00000000,0000003C,00456B08,004570B7,MSNB_IP_IPWC,00000000,004570B7,?,?,00000000,?,CImagePicker::CreateImagePicker,00000000,00000010,004584F3), ref: 00450B6F
Part of subcall function 00450B48: GetWindowLongW.USER32(00000000,000000EC), ref: 00450B7D
Part of subcall function 00450B48: GetClassInfoW.USER32 ref: 00450B94
Part of subcall function 00450B48: RegisterClassW.USER32 ref: 00450BC9

Strings

MSNB_IP_PPWC, xrefs: 00456218
CPenPicker::CreatePenPicker, xrefs: 004561D2

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Class$#1165H_prolog3InfoLongRegister$DataDestroyH_prolog3_OpenPointsTheme
String ID: CPenPicker::CreatePenPicker$MSNB_IP_PPWC
API String ID: 504531101-1735453288
Opcode ID: fe2f198e1b96026b87b8f0431eda7212de44cee9a7fa623bbc39989fc4491c1c
Instruction ID: 0f5a5029c2723660e5ceb5dd2dd4f772b9dbcd0ee9e05fc28c6c6a6f673a1292
Opcode Fuzzy Hash: fe2f198e1b96026b87b8f0431eda7212de44cee9a7fa623bbc39989fc4491c1c
Instruction Fuzzy Hash: 2501C431E012299BCF11EF51C941AAE7A71EF48B59F51406AFD05BB242CB384E1587F9

Uniqueness

Uniqueness Score: -1.00%

Function 004AF3C0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(00000000,00000000,00000000,?), ref: 004AF3EB
GetLastError.KERNEL32 ref: 004AF3F7

Strings

Helpers::SetTimer, xrefs: 004AF3D6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastTimer
String ID: Helpers::SetTimer
API String ID: 856675056-1526796510
Opcode ID: 7c5796de4c0c0115e9136b3b3aaed17fe5f439aa2079c863ab35d517ff718432
Instruction ID: e1c2c7a7ae9278e0365877d32b81b5c45e1f92465f4cc87a387096dc59de1e19
Opcode Fuzzy Hash: 7c5796de4c0c0115e9136b3b3aaed17fe5f439aa2079c863ab35d517ff718432
Instruction Fuzzy Hash: 7401F531500114ABC7259B969C04FFF3B69EF65314F6041AFFD0496261CB3AC846C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 004293E8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004293EF
#1165.MFC42U(CNBDocViewCtrl::SetScale,00000000,00000014,0044F051,0E0227DC), ref: 00429418

Part of subcall function 0042AF6F: __EH_prolog3.LIBCMT ref: 0042AF76
Part of subcall function 0042AF6F: #1165.MFC42U(CMainFrame::GetNotebookDPIRatio,00000000,0000001C,004293AF), ref: 0042AF98
Part of subcall function 0042AF6F: GetDC.USER32(?), ref: 0042AFC0
Part of subcall function 0042AF6F: #2854.MFC42U(00000000), ref: 0042AFC7
Part of subcall function 0042AF6F: GetDeviceCaps.GDI32(?,00000058), ref: 0042AFED
Part of subcall function 0042AF6F: ReleaseDC.USER32 ref: 0042B00B

Strings

CNBDocViewCtrl::SetScale, xrefs: 00429401

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3$#2854CapsDeviceRelease
String ID: CNBDocViewCtrl::SetScale
API String ID: 75335821-2456611392
Opcode ID: 9d57c6873bd2530bbe0b789cc4a057960ce7573bf5c329b2d32e813c4c96dd77
Instruction ID: 70c2924cff4a3719991cd9cd0a3f2652eebe8b58c3cf284446b316db3f56aa79
Opcode Fuzzy Hash: 9d57c6873bd2530bbe0b789cc4a057960ce7573bf5c329b2d32e813c4c96dd77
Instruction Fuzzy Hash: 3911C271E04119DBCB00EF50D9496EE7B70FF04300F51049AE986772A5DB395D25CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00454DFA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00454E01

Part of subcall function 0045091E: __EH_prolog3_GS.LIBCMT ref: 00450925
Part of subcall function 0045091E: #1165.MFC42U(CItemPicker::CreateSampleWnd,?,00000054,00456AF2,00000000,004570B7,?,?,00000000,?,CImagePicker::CreateImagePicker,00000000,00000010,004584F3,00000000,?), ref: 00450956
Part of subcall function 0045091E: GetWindowLongW.USER32(00000000,000000EC), ref: 00450967
Part of subcall function 0045091E: OpenThemeData.UXTHEME(00000000,COMBOBOX,?,?,?,00000003,00000003,?,?,00000001), ref: 0045097B
Part of subcall function 0045091E: GetClassInfoW.USER32 ref: 00450993
Part of subcall function 0045091E: RegisterClassW.USER32 ref: 004509CF
Part of subcall function 0045091E: GetWindow.USER32(?,00000003), ref: 004509D8
Part of subcall function 0045091E: DestroyWindow.USER32(?,?,?,?,?,00000003,00000003,?,?,00000001), ref: 004509ED
Part of subcall function 0045091E: MapWindowPoints.USER32 ref: 004509FE

Part of subcall function 00450B48: __EH_prolog3.LIBCMT ref: 00450B4F
Part of subcall function 00450B48: #1165.MFC42U(CItemPicker::CreatePickerWnd,00000000,0000003C,00456B08,004570B7,MSNB_IP_IPWC,00000000,004570B7,?,?,00000000,?,CImagePicker::CreateImagePicker,00000000,00000010,004584F3), ref: 00450B6F
Part of subcall function 00450B48: GetWindowLongW.USER32(00000000,000000EC), ref: 00450B7D
Part of subcall function 00450B48: GetClassInfoW.USER32 ref: 00450B94
Part of subcall function 00450B48: RegisterClassW.USER32 ref: 00450BC9

Strings

MSNB_IP_TPWC, xrefs: 00454E56
CThicknessPicker::CreateThicknessPicker, xrefs: 00454E10

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Class$#1165H_prolog3InfoLongRegister$DataDestroyH_prolog3_OpenPointsTheme
String ID: CThicknessPicker::CreateThicknessPicker$MSNB_IP_TPWC
API String ID: 504531101-3845770896
Opcode ID: 16f128037c90d74c32fd0d7ee433a12fc3e303293192ea8c96eecbc99c6f2779
Instruction ID: 95523e8d1917314b09e3b72461bd4492f7466c618f09c3dbd8f5d499a4749b43
Opcode Fuzzy Hash: 16f128037c90d74c32fd0d7ee433a12fc3e303293192ea8c96eecbc99c6f2779
Instruction Fuzzy Hash: E301C432D0222A9BCF11DF51C941AAE7A71BF54B59F15002AFD04BB252CB385E1497F9

Uniqueness

Uniqueness Score: -1.00%

Function 004B01BF, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

RemoveMenu.USER32(?,00009D40,00000000,Helpers::RemoveMenu,00000000,00000000,?,CCopyTo::ReplaceEmailPlaceholder,00000000,?), ref: 004B01E6
GetLastError.KERNEL32 ref: 004B01F2

Strings

Helpers::RemoveMenu, xrefs: 004B01D5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMenuRemove
String ID: Helpers::RemoveMenu
API String ID: 2980455211-8981420
Opcode ID: 4dee63a74fdab30f9c424c663883977facecb7ecb539d4946f5290019e04c242
Instruction ID: ad09f7581a3591c9a2b8a3980236515ff4955e9bb9cb519d59003cfe463d32d4
Opcode Fuzzy Hash: 4dee63a74fdab30f9c424c663883977facecb7ecb539d4946f5290019e04c242
Instruction Fuzzy Hash: 27014C71600104ABCB28DA569D08BFB3768DB50315F2044EFF904D7291CB39CD05C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 004B058C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,0000009B,?,Helpers::FindResourceW,00000000,00000000,00000000), ref: 004B05B4
GetLastError.KERNEL32 ref: 004B05C0

Strings

Helpers::FindResourceW, xrefs: 004B05A2

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFindLastResource
String ID: Helpers::FindResourceW
API String ID: 1692681905-3811319106
Opcode ID: 41b41c7c6ac5cab02d6c1319da4a6ccc9c3314ee2b503e266e3993e273a2979c
Instruction ID: f1860c3ef6ae380c9bfa8102e66b46199abc9a3d3cd7a5c0a06970c154f93731
Opcode Fuzzy Hash: 41b41c7c6ac5cab02d6c1319da4a6ccc9c3314ee2b503e266e3993e273a2979c
Instruction Fuzzy Hash: 8F01F571600114BBC725DA56D904BFB3B69DB50325F2041ABF90096251CB3ACD41CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0049762E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00497635

Part of subcall function 0042A2C9: TraceMessage.ADVAPI32(00000000,0000EF51,0000002B,0041E910,00000064,00969CB0,00000004,00000000,?,004B04F0,00969CB0,0000EF51,00000000,?,?), ref: 0042A2E0

Strings

CNBCacheMgr::_OpenChildrenStorage, xrefs: 00497644
Children, xrefs: 00497661

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3MessageTrace
String ID: CNBCacheMgr::_OpenChildrenStorage$Children
API String ID: 2216407281-3010203871
Opcode ID: 98111df01540cd3f343f665a87bb3739a41631b75c514afae610ca3c17668f6f
Instruction ID: 8fb82565c297676b0dce7238b12dbe064128f09828f7b667d1d5a558107ecb28
Opcode Fuzzy Hash: 98111df01540cd3f343f665a87bb3739a41631b75c514afae610ca3c17668f6f
Instruction Fuzzy Hash: A70192719002159FDB199F9A8C85EEF7F64AF14728F5504ABE904AB351C7788D40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004AF127, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 004AF14C
GetLastError.KERNEL32 ref: 004AF158

Strings

Helpers::GetClientRect, xrefs: 004AF13D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientErrorLastRect
String ID: Helpers::GetClientRect
API String ID: 372406337-3380892982
Opcode ID: fc2c9d8889f4ab0ee237c5540ced0733d5084120116be2872b5a10bf736cf80f
Instruction ID: 8070aeca10f03d7088e360b55873661f9bee245167bff1102087a26c7b42c78a
Opcode Fuzzy Hash: fc2c9d8889f4ab0ee237c5540ced0733d5084120116be2872b5a10bf736cf80f
Instruction Fuzzy Hash: E301F771600114ABC7259B9ADD48BBB7BA8DF51318F2044BFE904D7291DB3ACC45C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 004AF1AC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 004AF1D1
GetLastError.KERNEL32(?,?,0047EE63,?,CMetaListView::ModifyStyle), ref: 004AF1DD

Strings

Helpers::GetWindowLongW, xrefs: 004AF1C2

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongWindow
String ID: Helpers::GetWindowLongW
API String ID: 3631197057-1091193104
Opcode ID: 8248b9ab099ef8171d353a655ccdc2f5c9e994415b79598930a75171c1f75785
Instruction ID: b17623bb62daae748d45e5489f71d7dfc1c984cceed8b19f3b2610c5916cceb9
Opcode Fuzzy Hash: 8248b9ab099ef8171d353a655ccdc2f5c9e994415b79598930a75171c1f75785
Instruction Fuzzy Hash: 5B01F736601114ABC7259A96DD04BBB7BA9DB65314F2041BFF900D6291DB3ACC45C7AC

Uniqueness

Uniqueness Score: -1.00%

Function 004B0246, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnableWindow.USER32(?,00000001), ref: 004B026B
GetLastError.KERNEL32 ref: 004B0273

Strings

Helpers::EnableWindow, xrefs: 004B025C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: EnableErrorLastWindow
String ID: Helpers::EnableWindow
API String ID: 3911142412-3746367322
Opcode ID: 70f93c87d3bd847ad8ccb111502aaf7f4abbbdba1040722304b4da2615e002e9
Instruction ID: 0b686a3a4b81c6a31026d142f37eb8fba49c376bea8c5ec78efc55a1c7a35fbc
Opcode Fuzzy Hash: 70f93c87d3bd847ad8ccb111502aaf7f4abbbdba1040722304b4da2615e002e9
Instruction Fuzzy Hash: DA01F731600214ABDB189A66DD48FFB7BA8DF50315F2040AFE900D6291DB3ACC45C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 004AF231, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 004AF256
GetLastError.KERNEL32(?,?,0042B1F9,00008010,00009C7D), ref: 004AF262

Strings

Helpers::GetWindowRect, xrefs: 004AF247

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastRectWindow
String ID: Helpers::GetWindowRect
API String ID: 3105162182-2367199795
Opcode ID: bb2e1ae851826ef0798e4ac8682ba35cfadb13764cff136cff7e1cf2aae4e34e
Instruction ID: 704414a427f78d283bf2614bb15167b6bb1354906e71e060d49a4a14ff4e5ebb
Opcode Fuzzy Hash: bb2e1ae851826ef0798e4ac8682ba35cfadb13764cff136cff7e1cf2aae4e34e
Instruction Fuzzy Hash: A101FC76600114ABC725DA96DD44BBB7B68DB61314F2040BFE904D7251DB3ACC45C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 004412D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004412D7

Part of subcall function 0044547B: __EH_prolog3_GS.LIBCMT ref: 00445485
Part of subcall function 0044547B: #1165.MFC42U(CNotebookDoc::OpenCreateDocument,00000000,00000254,00432F2D,00000000,00000000,00000000,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000), ref: 00445507
Part of subcall function 0044547B: LockWindowUpdate.USER32(?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00445515
Part of subcall function 0044547B: #1165.MFC42U(?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044551B
Part of subcall function 0044547B: PathFindExtensionW.SHLWAPI(?,00000001,CPgIpc::OnOpenDocument,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044558C
Part of subcall function 0044547B: #538.MFC42U(00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 00445599
Part of subcall function 0044547B: _wcsicmp.MSVCRT ref: 004455AA
Part of subcall function 0044547B: #800.MFC42U(?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 004455C2
Part of subcall function 0044547B: #1165.MFC42U(00000001,CPgIpc::OnOpenDocument,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 004455C8

#1165.MFC42U(00000003,00000000,?,00000000,CNotebookApp::InitFromFile,00000003,0000000C,00442F4A,00000003,00000000,00000003,00000003,?,00000003,CNotebookApp::OpenDocument,00000000), ref: 00441338

Strings

CNotebookApp::InitFromFile, xrefs: 004412E4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#538#800ExtensionFindH_prolog3H_prolog3_LockPathUpdateWindow_wcsicmp
String ID: CNotebookApp::InitFromFile
API String ID: 2100151207-3733415969
Opcode ID: a9fc57b51f7c88d418fdbf4369b53780aa6480bb72e4f1ad80cfa8f35a6d6f87
Instruction ID: 296cfa06a65dc03727679fb13569ce263b12be921225b072c114409ffdac5c97
Opcode Fuzzy Hash: a9fc57b51f7c88d418fdbf4369b53780aa6480bb72e4f1ad80cfa8f35a6d6f87
Instruction Fuzzy Hash: 6901A17450051A9FEB04EFA1CC519FEB724FF58304B44416EE9165B251DB386E46CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004502EE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004502F5
#521.MFC42U(00000000,CPgIpc::FindRecoveringInstance,00000000,0000001C,004A7E35,00000000), ref: 00450320

Part of subcall function 0044FC3B: __EH_prolog3.LIBCMT ref: 0044FC42
Part of subcall function 0044FC3B: #4162.MFC42U(CLockHolder::AcquireLock,00000000,0000000C,00450044,?,?,?,?), ref: 0044FC6A

Strings

CPgIpc::FindRecoveringInstance, xrefs: 00450301

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#4162#521
String ID: CPgIpc::FindRecoveringInstance
API String ID: 1674528075-1208003933
Opcode ID: c9423a19155700b6736752a01246c5264f1e67765015730b5a44f54a04aaabd0
Instruction ID: a5e8b4dacc6c2d5fac3c0ea923e695a23ff16982291b8f3a86d2171acffe5352
Opcode Fuzzy Hash: c9423a19155700b6736752a01246c5264f1e67765015730b5a44f54a04aaabd0
Instruction Fuzzy Hash: AE018035A002459BEB00EBA6CD85BED77A0AF14725F58406EED01671C2DBBC9A09C76A

Uniqueness

Uniqueness Score: -1.00%

Function 004AF33B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,00000000,Helpers::KillTimer,00000000,00000000,00000000,TimedMessageBox,00000000,?), ref: 004AF360
GetLastError.KERNEL32 ref: 004AF36C

Strings

Helpers::KillTimer, xrefs: 004AF351

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorKillLastTimer
String ID: Helpers::KillTimer
API String ID: 3067653206-752196959
Opcode ID: 07f14b2a29bd1b2824401a1dd275718809f50294d6c074c4b434c6a8d6ae44f4
Instruction ID: f6301ca4ce55b58c78f341cb154a474f263d0105986a284f3f75bb361881ba9d
Opcode Fuzzy Hash: 07f14b2a29bd1b2824401a1dd275718809f50294d6c074c4b434c6a8d6ae44f4
Instruction Fuzzy Hash: FF0147716001146BCB24EBAAC804BBB7BA8DF51314F6040BFED00D2290CB7ACC41C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 004283CD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

#2371.MFC42U(?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 00428442

Part of subcall function 004270F3: __EH_prolog3_GS.LIBCMT ref: 004270FA
Part of subcall function 004270F3: GetClientRect.USER32 ref: 00427125
Part of subcall function 004270F3: #3792.MFC42U ref: 0042712F
Part of subcall function 004270F3: GetParent.USER32(?), ref: 0042713F
Part of subcall function 004270F3: #2859.MFC42U(00000000), ref: 00427146
Part of subcall function 004270F3: #3792.MFC42U ref: 00427150
Part of subcall function 004270F3: GetClientRect.USER32 ref: 00427169

SendMessageW.USER32(?,00000112,?,?), ref: 00428438

Strings

CSplitWnd::OnSysCommand, xrefs: 004283FD

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #3792ClientRect$#2371#2859H_prolog3_MessageParentSend
String ID: CSplitWnd::OnSysCommand
API String ID: 2868504444-3083844196
Opcode ID: 8151ad9089d535c0c0ee4e8775545c51ea68d4f5df5b43178ff31be5f0cc9699
Instruction ID: 72621b9313b0370b2dea0a4a78ec290f2b0761d1e8090c57c1957ed882d57b12
Opcode Fuzzy Hash: 8151ad9089d535c0c0ee4e8775545c51ea68d4f5df5b43178ff31be5f0cc9699
Instruction Fuzzy Hash: 0F01F132208615AFDB21EF15DD02BAA77A4EB54724F10463EF411862E1EF7CA814C79E

Uniqueness

Uniqueness Score: -1.00%

Function 004924F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004924F7
lstrlenW.KERNEL32(?,CNBNotebook::IsExcludableTempFile,00000000,00000008,0047C0D8), ref: 00492519

Part of subcall function 0047B091: memset.MSVCRT ref: 0047B0D6
Part of subcall function 0047B091: memset.MSVCRT ref: 0047B0F4

Strings

CNBNotebook::IsExcludableTempFile, xrefs: 00492500

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$H_prolog3lstrlen
String ID: CNBNotebook::IsExcludableTempFile
API String ID: 3710483515-982908735
Opcode ID: 6617b6089928a072176803c188bfb13db390473ddd1953ad79f07e1c05b8abf6
Instruction ID: d9d74b78f96340ad765739ceed597c716aa8c1c4972f02f097c1698c5e1935ab
Opcode Fuzzy Hash: 6617b6089928a072176803c188bfb13db390473ddd1953ad79f07e1c05b8abf6
Instruction Fuzzy Hash: 7101B5317001017BCB10EB65C999FAF3B74AF44716F15806EE9099B280CB78ED05CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004AEC85, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SelectObject.GDI32(?,00000000), ref: 004AECAA
GetLastError.KERNEL32(?,?,005A0049), ref: 004AECB6

Strings

Helpers::SelectObject, xrefs: 004AEC9B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastObjectSelect
String ID: Helpers::SelectObject
API String ID: 804767242-3038181788
Opcode ID: 03cdef524c259e5eb6cf4886c6d659b310b99be07c286263a660ed06a53b364e
Instruction ID: d7c71586f6d07212280411bc88977d796164653a93e5c4e1a74c9e21a520d4cf
Opcode Fuzzy Hash: 03cdef524c259e5eb6cf4886c6d659b310b99be07c286263a660ed06a53b364e
Instruction Fuzzy Hash: EA01F7316002246BC7259A5BDD04BBF7BB8AF65324F2044AFED11D7291CB7AC941C7B8

Uniqueness

Uniqueness Score: -1.00%

Function 004B0507, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,0E0227DC,Helpers::LoadResource,00000000,00000000,00000000), ref: 004B052C
GetLastError.KERNEL32 ref: 004B0538

Strings

Helpers::LoadResource, xrefs: 004B051D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLoadResource
String ID: Helpers::LoadResource
API String ID: 3883721301-3019200854
Opcode ID: a44f7f6391a93950a0dfb6c10faf1d066d2bd910f33de3e9b2e27006b2ded769
Instruction ID: 04dc11d4c95739d2ca51fdb717178ff561be171c516a76d8f4698c3c765bc869
Opcode Fuzzy Hash: a44f7f6391a93950a0dfb6c10faf1d066d2bd910f33de3e9b2e27006b2ded769
Instruction Fuzzy Hash: 0101F771A001147BC725EA5A9904BFF7BA8DB50325F2040AFE914D7291CB7AC841CBBD

Uniqueness

Uniqueness Score: -1.00%

Function 004AF5D6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F04), ref: 004AF5FB
GetLastError.KERNEL32 ref: 004AF607

Strings

Helpers::LoadIconW, xrefs: 004AF5EC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorIconLastLoad
String ID: Helpers::LoadIconW
API String ID: 808202925-1608937481
Opcode ID: 43045df19468709740cedae822761b4e2c7b9a259283088e25fff8e569514dad
Instruction ID: 29edddfc51ecc9546ff71e99a213fa1c4475d744c5540b0d1f9d06cfc3653e02
Opcode Fuzzy Hash: 43045df19468709740cedae822761b4e2c7b9a259283088e25fff8e569514dad
Instruction Fuzzy Hash: 5501F7316001146BC725AA969905BBB7BA89B61314F2044BFFD01D72A1CB7AC846C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 004498A3, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

#1165.MFC42U(CNotebookDoc::PeekEPDoc,00000000,0E0227DC,?,00000000), ref: 004498EA

Strings

CNotebookDoc::PeekEPDoc, xrefs: 004498D9
CNBNotebook::GetNBDocumentPtr, xrefs: 004498F1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165
String ID: CNBNotebook::GetNBDocumentPtr$CNotebookDoc::PeekEPDoc
API String ID: 4073908220-3909935326
Opcode ID: 1d4e756a202f17441ce0d48103d48697e01aaa9c0d8c2c2c0c4fc24fa9ad03b4
Instruction ID: 4da9ee0f13e0a6900ac5efa81cda9a3e60ae6a4ae10adb34d84a306a6715292e
Opcode Fuzzy Hash: 1d4e756a202f17441ce0d48103d48697e01aaa9c0d8c2c2c0c4fc24fa9ad03b4
Instruction Fuzzy Hash: 5B01B5321087409BC224DF16DD46A47B7E8EBD5B24F00062FF46593290DB78A804CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042609D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 004260BE
InflateRect.USER32(?,?,?), ref: 004260D1

Strings

CSplitWnd::GetInsideRect, xrefs: 004260AD

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$ClientInflate
String ID: CSplitWnd::GetInsideRect
API String ID: 256450704-782280797
Opcode ID: 76528f916005a19f3305e7ae6514addd999bd5c939fcddb8dafb748bc0766065
Instruction ID: f47f105c900d166c18e89f3010368d0d446925f855fb5293eb3825878260995f
Opcode Fuzzy Hash: 76528f916005a19f3305e7ae6514addd999bd5c939fcddb8dafb748bc0766065
Instruction Fuzzy Hash: BB01AD31201215AFC708DF2AC949EB7BBA8FF45720F00422EE41687590DB74B890CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004ADBF6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004ADBFD
lstrlenW.KERNEL32(00000000,CIdleAddToRecentDocsTask::CIdleAddToRecentDocsTask,00000000,00000010,004ADED1,?,CNBIdleTaskMgr::AddToRecentDocs,00000000,00000010,0049111D,00000000), ref: 004ADC35

Strings

CIdleAddToRecentDocsTask::CIdleAddToRecentDocsTask, xrefs: 004ADC15

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3lstrlen
String ID: CIdleAddToRecentDocsTask::CIdleAddToRecentDocsTask
API String ID: 3073243474-3565576235
Opcode ID: b1fad6ad99ef01c04f9b96e2cc4e6a4255135d254887df20e2147c9f26000908
Instruction ID: 7bbc71e0aaaed89f384bd82994175b620323fb35bd09ef0e6db899c5fadeb783
Opcode Fuzzy Hash: b1fad6ad99ef01c04f9b96e2cc4e6a4255135d254887df20e2147c9f26000908
Instruction Fuzzy Hash: 0E018475A00205AFDB14DF75C85AAEE77B09F10344F14C46FE8069B291EF7D9A44CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0044FBA8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044FBAF
#521.MFC42U(00000000,CPgIpc::OnBootComplete,?,0000001C,004406ED,?,00000019,00000000), ref: 0044FBD9

Part of subcall function 0044FC3B: __EH_prolog3.LIBCMT ref: 0044FC42
Part of subcall function 0044FC3B: #4162.MFC42U(CLockHolder::AcquireLock,00000000,0000000C,00450044,?,?,?,?), ref: 0044FC6A

Part of subcall function 0044FC98: __EH_prolog3.LIBCMT ref: 0044FC9F

Strings

CPgIpc::OnBootComplete, xrefs: 0044FBBC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#4162#521
String ID: CPgIpc::OnBootComplete
API String ID: 1674528075-1373209227
Opcode ID: b09c5f921c8599936eaeb345a39aa02bdb8df636821f221645f7e262143e5849
Instruction ID: 1d6721681c67cf130fa066d252cdab57fb9f1c70b013d7ceb6134f2b57599155
Opcode Fuzzy Hash: b09c5f921c8599936eaeb345a39aa02bdb8df636821f221645f7e262143e5849
Instruction Fuzzy Hash: 7C014070D012099EEB04EBA5C981AFDBB74AF14714F59007FE80277281DB7C5E4ADBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004AED0A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 004AED2F
GetLastError.KERNEL32 ref: 004AED3B

Strings

Helpers::DeleteObject, xrefs: 004AED24

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteErrorLastObject
String ID: Helpers::DeleteObject
API String ID: 1085950563-2051101351
Opcode ID: e7d39c4c16152556a6c55c08d1e2ab9db899bb516fd597d7eea0c2a2f713a01b
Instruction ID: 43261153d9d2927f8617e92389b1439b9099664a0a2687adaf82d7863c5df6e0
Opcode Fuzzy Hash: e7d39c4c16152556a6c55c08d1e2ab9db899bb516fd597d7eea0c2a2f713a01b
Instruction Fuzzy Hash: 83014976200211ABC325AB269804BB737989F15328F25456FFDA4C6390DB3ACC45C7EE

Uniqueness

Uniqueness Score: -1.00%

Function 004AF810, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

DestroyCursor.USER32(00000000), ref: 004AF831
GetLastError.KERNEL32 ref: 004AF83D

Strings

Helpers::DestroyCursor, xrefs: 004AF826

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CursorDestroyErrorLast
String ID: Helpers::DestroyCursor
API String ID: 1467428475-2924770937
Opcode ID: b2225fc291e9f63f7ce3aeeebd0f394f19e694f7622c2dc1be6d23467871368d
Instruction ID: c53a0cc87b8bd080449cc09b38245003cd26326b2b40fdd9dc787da58881c515
Opcode Fuzzy Hash: b2225fc291e9f63f7ce3aeeebd0f394f19e694f7622c2dc1be6d23467871368d
Instruction Fuzzy Hash: EE012671A01114ABC725EB96D904BAA3768AB20314F2040AFED0097260CB3ECE09C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00445948, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044594F

Part of subcall function 0044C6E5: __EH_prolog3.LIBCMT ref: 0044C6EC
Part of subcall function 0044C6E5: PropVariantClear.OLE32(?,?,?,?,?,?,?), ref: 0044C73D

Part of subcall function 00445E38: __EH_prolog3.LIBCMT ref: 00445E3F
Part of subcall function 00445E38: lstrlenW.KERNEL32(00000000), ref: 00445E6D
Part of subcall function 00445E38: SHPathPrepareForWriteW.SHELL32(00000000,00000000,00000000,00000004), ref: 00445E84
Part of subcall function 00445E38: GetFileAttributesW.KERNEL32(00000000), ref: 00445E8F

#1165.MFC42U(CNotebookDoc::MustSaveAs,00000000,0000000C,00445896,CNotebookDoc::OnFileSave,00000000,0000000C,0042D361), ref: 0044599F

Strings

CNotebookDoc::MustSaveAs, xrefs: 00445958

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165AttributesClearFilePathPreparePropVariantWritelstrlen
String ID: CNotebookDoc::MustSaveAs
API String ID: 1734661973-3052457597
Opcode ID: 10e9d4450f5b1e394cc7f2f930228affc14d8a87bd6a06d247760d4796e023e2
Instruction ID: deb875d532a5d75a7cb3bc66817931884de58eaa7a4a48a8525150400460bcfd
Opcode Fuzzy Hash: 10e9d4450f5b1e394cc7f2f930228affc14d8a87bd6a06d247760d4796e023e2
Instruction Fuzzy Hash: FDF04F717019118BFB15B2628D5777E51126F90B28F44402FAE069B2C3EF9C9D02869D

Uniqueness

Uniqueness Score: -1.00%

Function 00450123, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045012A
#521.MFC42U(00000000,CPgIpc::SetGlobalRecoveryMode,?,00000018,004A79BD,00000000,?,CNotebookApp::_OnEndRecovery,00000000,0000000C,004A845A,?,00000001,CNotebookApp::_SecondaryInstanceRecovery,?,00000014), ref: 00450154

Strings

CPgIpc::SetGlobalRecoveryMode, xrefs: 00450137

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #521H_prolog3
String ID: CPgIpc::SetGlobalRecoveryMode
API String ID: 2244394926-4101425544
Opcode ID: f20d2a2e398ad0b0fa09172d60613f4fd0e518936915796670ec2250b9bdc3d9
Instruction ID: 288423899df84e5f956296aef625714222dd3cfd7578d60d2df1693687736e21
Opcode Fuzzy Hash: f20d2a2e398ad0b0fa09172d60613f4fd0e518936915796670ec2250b9bdc3d9
Instruction Fuzzy Hash: 79013C75901619DFCB00EF95C8815EDBBB0BF18314B5001AFE90167242DB79AE09CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00449C1F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00449C26
#1165.MFC42U(CNotebookDoc::ResetAutoSaveTimer,?,00000014,00464F77), ref: 00449C52

Part of subcall function 00449A76: #1165.MFC42U(CNotebookDoc::StartAutoSaveTimer,0E0227DC,0E0227DC,00000000,?,00000000,CMainFrame::OnCommand,00000000,0E0227DC), ref: 00449ACF
Part of subcall function 00449A76: #1165.MFC42U ref: 00449B32
Part of subcall function 00449A76: GetLastError.KERNEL32(?,00449CA3), ref: 00449B5C

Strings

CNotebookDoc::ResetAutoSaveTimer, xrefs: 00449C33

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$ErrorH_prolog3Last
String ID: CNotebookDoc::ResetAutoSaveTimer
API String ID: 3492571276-1196636193
Opcode ID: 9397dfa89919bb1cba04d8e4858551feabfee91b66ad2bc0a2d3bea54b93325f
Instruction ID: 736bc9dbba9135a596cf0b3a19041d607eead23e17f6dd7af67fed21834e9668
Opcode Fuzzy Hash: 9397dfa89919bb1cba04d8e4858551feabfee91b66ad2bc0a2d3bea54b93325f
Instruction Fuzzy Hash: D7015E7190151A8BEB11EB9689819FFB6B4AF84704B14016FE50277200DA3C5E06D7BA

Uniqueness

Uniqueness Score: -1.00%

Function 004AED8E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004AEDAF
GetLastError.KERNEL32 ref: 004AEDBB

Strings

Helpers::GetDC, xrefs: 004AEDA4

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID: Helpers::GetDC
API String ID: 1452528299-3478667067
Opcode ID: bcb7b5988cac3692ef2804a213819ac944bb7f7411661d647e08e9dc758643ba
Instruction ID: f574b13d3c4a22f5bd5a8f763a31b330257d391099c3cc0633c7f51278c3b2b3
Opcode Fuzzy Hash: bcb7b5988cac3692ef2804a213819ac944bb7f7411661d647e08e9dc758643ba
Instruction Fuzzy Hash: 66012635A01114A7D725DB969904BAA37699F14318F2040AFE920A6290CF3ACE01C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0044C6E5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C6EC
PropVariantClear.OLE32(?,?,?,?,?,?,?), ref: 0044C73D

Strings

CNotebookDoc::IsReadOnly, xrefs: 0044C6F9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ClearH_prolog3PropVariant
String ID: CNotebookDoc::IsReadOnly
API String ID: 2985067408-4222558418
Opcode ID: 3f7b9640e2e681c202e1d0b6b308285782721104628b62b4aa980384f4018cf1
Instruction ID: d7310c932f57c868b26fb54de025450c144ad81a7412303f06a1b7d2056e12b1
Opcode Fuzzy Hash: 3f7b9640e2e681c202e1d0b6b308285782721104628b62b4aa980384f4018cf1
Instruction Fuzzy Hash: 0F01A2716002096BEB05DFE9CC85AEEB7B4AF0C704F08043EE206A7151D7789948CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042AB1E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

#1165.MFC42U(?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 0042AB6A

Part of subcall function 0044D0EA: __EH_prolog3.LIBCMT ref: 0044D0F1
Part of subcall function 0044D0EA: #1165.MFC42U(CNotebookView::ToggleFullScreenMode,?,00000014,0042AB7E,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 0044D11A
Part of subcall function 0044D0EA: #1165.MFC42U ref: 0044D12F
Part of subcall function 0044D0EA: #3792.MFC42U ref: 0044D137
Part of subcall function 0044D0EA: #1165.MFC42U(00000000), ref: 0044D158

#5048.MFC42U(00009C96,?,?,?,?,?,?,?,?,?,?,?,004BFB86,000000FF), ref: 0042AB88

Strings

CMainFrame::OnSysCommand, xrefs: 0042AB4E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165$#3792#5048H_prolog3
String ID: CMainFrame::OnSysCommand
API String ID: 1278408150-2763515521
Opcode ID: 51f0a09453533113df7ecefc1390df881ce54b35d29c18bbf7787c174e91edb7
Instruction ID: 1587a5aa6be57b8606b5fda2896f7d07b29e06d96fc5e98f5a63a74738a94e2a
Opcode Fuzzy Hash: 51f0a09453533113df7ecefc1390df881ce54b35d29c18bbf7787c174e91edb7
Instruction Fuzzy Hash: 52012F31608200AFD710EF15CE1AF667BA4EB58734F10422FF826432D1EB78A804CA9A

Uniqueness

Uniqueness Score: -1.00%

Function 00435580, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,KF,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,?,00464BEE,00000000), ref: 004355A7
RegCloseKey.ADVAPI32(?,?,00464BEE,00000000,Version,?,?,?,?,?,?,0E0227DC), ref: 004355BB

Strings

KF, xrefs: 0043559F

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreate
String ID: KF
API String ID: 2932200918-1745086199
Opcode ID: 0fce19d7588752ac0b315c0eb4c765a271b8ae93274cc71a04ae585ba23c048f
Instruction ID: d66f72a63c6c6c6740b7a8a7022b15e05fce63e9e240ef1ac4d87889e0fb7dae
Opcode Fuzzy Hash: 0fce19d7588752ac0b315c0eb4c765a271b8ae93274cc71a04ae585ba23c048f
Instruction Fuzzy Hash: 64F0F975601149BB9B258F46DC09CBBBFFDEBD5710B10416EB84592210EA71AE00DA64

Uniqueness

Uniqueness Score: -1.00%

Function 0048F8DD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0048F8E4
lstrlenW.KERNEL32(00000000), ref: 0048F914

Part of subcall function 0048A0CF: __EH_prolog3.LIBCMT ref: 0048A0D6

Strings

CNBFolder::_SetLastOpenedChild, xrefs: 0048F8F3

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$lstrlen
String ID: CNBFolder::_SetLastOpenedChild
API String ID: 1485999228-2038549588
Opcode ID: 97df97523643ec6ce2944e158c81251e4818bd75d164c32546626ac9daf2f3d9
Instruction ID: 8f5baca7aa4a65a4b914bea1f1e5e0192818fb9c22bb1bd68f312850eec92bc7
Opcode Fuzzy Hash: 97df97523643ec6ce2944e158c81251e4818bd75d164c32546626ac9daf2f3d9
Instruction Fuzzy Hash: FE01A271901116ABCB04EB55C846BFE7764AF10714F10446AF805B7280DF78AE09C7FA

Uniqueness

Uniqueness Score: -1.00%

Function 0044C412, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C419
#1165.MFC42U(CNotebookDoc::GetCurrentHighContrastState,00000000,0000001C,0044ED44,?,CMainFrame::SetDefaultPen,00000000,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001), ref: 0044C434

Part of subcall function 004AFE8A: SystemParametersInfoW.USER32(00000059,00000000,00000000,00000000), ref: 004AFEB4
Part of subcall function 004AFE8A: GetLastError.KERNEL32(?,00000000,0E0227DC), ref: 004AFEC0

Strings

CNotebookDoc::GetCurrentHighContrastState, xrefs: 0044C424

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165ErrorH_prolog3InfoLastParametersSystem
String ID: CNotebookDoc::GetCurrentHighContrastState
API String ID: 2088184188-2657695931
Opcode ID: b122083786cbf8ed190f493be269532a4cac4fbf5ba55fb5ddd53d4bd6c8c13c
Instruction ID: e7918d19b5fb0b00fb2813cb70981a617a4eb9b0a30e597b6b48bdbbdd5dfe3d
Opcode Fuzzy Hash: b122083786cbf8ed190f493be269532a4cac4fbf5ba55fb5ddd53d4bd6c8c13c
Instruction Fuzzy Hash: 26F086709412099EEB54EBD1CA91FFE7364DB15304F54403FE50166191DA7C9948C739

Uniqueness

Uniqueness Score: -1.00%

Function 00486580, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00486587
SendMessageW.USER32(?,0000014E,?,00000000), ref: 004865E7

Strings

CTOCView::_ResetScopeSelection, xrefs: 00486594

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3MessageSend
String ID: CTOCView::_ResetScopeSelection
API String ID: 936991600-1203304465
Opcode ID: 734fddefd282e0b982e4780719a220b15d073f62f2f52a296cecffb932e68bde
Instruction ID: 35cccfa0c034c0608007d012aee6f307076e71c8d3a4203e9aa464d1866f99ba
Opcode Fuzzy Hash: 734fddefd282e0b982e4780719a220b15d073f62f2f52a296cecffb932e68bde
Instruction Fuzzy Hash: DF016D7050021AAFDB14ABA5DC41AFFB7B8FF18708F41483EF61696190DF786E458728

Uniqueness

Uniqueness Score: -1.00%

Function 0047B674, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,G_IsFileAvailable,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0047B6A0
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 0047B6AA

Strings

G_IsFileAvailable, xrefs: 0047B689

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorExistsFileLastPath
String ID: G_IsFileAvailable
API String ID: 271802177-3706412156
Opcode ID: 2906d0f8191646b07d7062cb6a3ef5163c31aa26cd27598f77ec002ccd6d99d2
Instruction ID: 442289be831dc7ed54e7aab93ae50c2ba4d0c378b2316e320f41f808da4754ab
Opcode Fuzzy Hash: 2906d0f8191646b07d7062cb6a3ef5163c31aa26cd27598f77ec002ccd6d99d2
Instruction Fuzzy Hash: 40F0C832D01128E78720EBA599099EEB778DE4071071581ABED19A3210DB386E01D7DE

Uniqueness

Uniqueness Score: -1.00%

Function 0046480D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00464814

Strings

W, xrefs: 0046481E
CNBSettingsMgr::RestoreDefaults, xrefs: 00464826

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBSettingsMgr::RestoreDefaults$W
API String ID: 431132790-572001840
Opcode ID: 2a68e1d4570f1d554ec46f90fa24db42be2b007e91779185b26a21dbc9f28bae
Instruction ID: e76fc2cb2077a78a2a97828e968a69fabfbd6a992ee2dc9eb9e5b8d8fd837df1
Opcode Fuzzy Hash: 2a68e1d4570f1d554ec46f90fa24db42be2b007e91779185b26a21dbc9f28bae
Instruction Fuzzy Hash: F401AD359011169BCF04FB61C956AFEB2A4AF95318F14806FE10577281EB7C9E0587AB

Uniqueness

Uniqueness Score: -1.00%

Function 004AD9C6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004AD9CD

Strings

CIdleTaskMgr::~CIdleTaskMgr, xrefs: 004AD9DD
CIdleTaskMgr::RemoveAll, xrefs: 004AD9EB

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CIdleTaskMgr::RemoveAll$CIdleTaskMgr::~CIdleTaskMgr
API String ID: 431132790-854227943
Opcode ID: bdbfa6edec0f6f7b3e4ef5b66adc438656de255ff9f5708b2f503953129863f1
Instruction ID: df4bfc124712475100031698dbd9efb36a89ab4086d810e0dd67b5f13d32bde4
Opcode Fuzzy Hash: bdbfa6edec0f6f7b3e4ef5b66adc438656de255ff9f5708b2f503953129863f1
Instruction Fuzzy Hash: E801A230A00105DFDB04EFA6C8869EDBB61AF69314B10466FE116572C1DFBC5E418769

Uniqueness

Uniqueness Score: -1.00%

Function 0047F46F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000C,00000000,0E0227DC), ref: 0047F4A5
ShowWindow.USER32(?,00000005,?,?,?,CMainFrame::OnSysCommand,00000000,0E0227DC), ref: 0047F4B0

Strings

CMetaListView::ShowStatusMessage, xrefs: 0047F47E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSendShowWindow
String ID: CMetaListView::ShowStatusMessage
API String ID: 1631623395-14489507
Opcode ID: 86ee1410010ac45b3e4644398e8ed28294eb2917b7a632818b3c1eda26dd2c6e
Instruction ID: 398077b62cba76798db664c484b12cf29583832d975e90c75b2bcf182ff19be6
Opcode Fuzzy Hash: 86ee1410010ac45b3e4644398e8ed28294eb2917b7a632818b3c1eda26dd2c6e
Instruction Fuzzy Hash: BAF0F031200204BBDB20EB67CC09EEFBB79EFA1711F00443FF51A920A1EA745944C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 004A788D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004A7897
memset.MSVCRT ref: 004A78CA

Part of subcall function 004A75DA: __EH_prolog3_GS.LIBCMT ref: 004A75E4
Part of subcall function 004A75DA: memset.MSVCRT ref: 004A762F

Strings

_PurgeCrashedNotes, xrefs: 004A78A0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_memset
String ID: _PurgeCrashedNotes
API String ID: 2828583354-3889235899
Opcode ID: 359bdc8a734ac732537e2f3ca2882a7b0530c28127fa4ce4a0a6946ca900bf33
Instruction ID: a9ab09aea23a0be7513f879f085959fd4a5415c2b2f0a6c6a8de46b31ddd385c
Opcode Fuzzy Hash: 359bdc8a734ac732537e2f3ca2882a7b0530c28127fa4ce4a0a6946ca900bf33
Instruction Fuzzy Hash: 54F0C870D402186ADF20F761CC8EBDE22389F20714F4000EF640993192EF7C9F848BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00471355, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047135C
#30.ATL(?,00000000,00000000,00000000,CSrchView::NewDocNotify,00000000,0000000C,00441AB2,00000001,00000002,CNotebookApp::OnNoteOpened,00000000,00000008,004457DA,?), ref: 004713C7

Strings

CSrchView::NewDocNotify, xrefs: 00471369

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CSrchView::NewDocNotify
API String ID: 431132790-754871610
Opcode ID: 2c81c339240d56efb6964904f66cc67c5fee06b41fdb84ca66e4ea3aac29e90a
Instruction ID: 7b8deed86deb70afe39981b6702df5a8ca957a9b9ae70a5d1e0466d3a4b77802
Opcode Fuzzy Hash: 2c81c339240d56efb6964904f66cc67c5fee06b41fdb84ca66e4ea3aac29e90a
Instruction Fuzzy Hash: 35F0F9715006019AD724AB7B884AADE77E49F81724F00472EB1BF931E1DF3C2505CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0047C044, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetSettings.SHELL32(?,00000001), ref: 0047C069
GetFileAttributesW.KERNEL32(?), ref: 0047C079

Strings

G_IsFileInvisible, xrefs: 0047C053

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFileSettings
String ID: G_IsFileInvisible
API String ID: 211365831-1292918278
Opcode ID: 690fa34ff97521dd3dba3ce01a25f49c2922127865ea6dcbf1e46fe5d04126b1
Instruction ID: 9215408fd2e04794a06d4a13317b57a74b1995eda4191ed08af8d1a1d1436d32
Opcode Fuzzy Hash: 690fa34ff97521dd3dba3ce01a25f49c2922127865ea6dcbf1e46fe5d04126b1
Instruction Fuzzy Hash: E5F0E930901114ABC710A7AA9D49AFF7B6CDF41720F10429FF815D3190DBB46E15C6D4

Uniqueness

Uniqueness Score: -1.00%

Function 004819F8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004819FF
#30.ATL(00000000,00000000,CMetaListObject::Init,00000000,00000010,0047EBA2,00000000,CMetaListView::InsertObject,00000000,00000010,00486EA1,?,00000000,?,00000000), ref: 00481A32

Strings

CMetaListObject::Init, xrefs: 00481A0E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CMetaListObject::Init
API String ID: 431132790-2865465189
Opcode ID: c702230f117877d1864dd85b7e7e9a150f372f35ec6ab95635325b48b41436f7
Instruction ID: e58678d999952dfb14435808ac715babad4c2d87bd4d72caf166e83a0cbae4cb
Opcode Fuzzy Hash: c702230f117877d1864dd85b7e7e9a150f372f35ec6ab95635325b48b41436f7
Instruction Fuzzy Hash: B9F0CD76941119ABCB00EB90C845BEEB338AF14715F20806BE905B7240CB7CAF09CBF9

Uniqueness

Uniqueness Score: -1.00%

Function 0044DA25, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044DA2C
#1165.MFC42U(CNotebookView::ShowHideRiffle,00000000,0000000C,004456EF,?,?,?,?,?,CMainFrame::ShowPageSettings,00000000,00000920,0042D337,00000000,00000001,00000000), ref: 0044DA46

Part of subcall function 0042994E: __EH_prolog3.LIBCMT ref: 00429955

Strings

CNotebookView::ShowHideRiffle, xrefs: 0044DA35

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165
String ID: CNotebookView::ShowHideRiffle
API String ID: 2986221888-4061286545
Opcode ID: 7c074dae256ea3788d87a07d202ae03e1b221add5b69a98585b1546906340ff5
Instruction ID: 716df2be78601c8488bb712579097207820dbcc0a7b79e094278ca76ebaf031b
Opcode Fuzzy Hash: 7c074dae256ea3788d87a07d202ae03e1b221add5b69a98585b1546906340ff5
Instruction Fuzzy Hash: C5F0F671A000155BEB00E7A1CC0ABEE7760AF14319F44003EE505A31C1EF7CA9048768

Uniqueness

Uniqueness Score: -1.00%

Function 0042A482, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042A489

Strings

CNotebookView::PeekActionState, xrefs: 0042A492
CNBDocViewCtrl::GetActionState, xrefs: 0042A4A7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBDocViewCtrl::GetActionState$CNotebookView::PeekActionState
API String ID: 431132790-694512422
Opcode ID: 1159123bfdb239421c85afa66a65995624b122a94d43fe64cf370a89e06426cf
Instruction ID: eb53cec94b35429b6267d277e1e3e75044488d9b099c6cc01f517eb6c2af7663
Opcode Fuzzy Hash: 1159123bfdb239421c85afa66a65995624b122a94d43fe64cf370a89e06426cf
Instruction Fuzzy Hash: 3CF0813190010A9FDF04EB91C845BED7774AF14308F54006EE501B7181DB7C6A09CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0044CD38, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044CD3F

Strings

CNotebookView::GetDocViewMode, xrefs: 0044CD48
CNBDocViewCtrl::GetDocViewMode, xrefs: 0044CD5D

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBDocViewCtrl::GetDocViewMode$CNotebookView::GetDocViewMode
API String ID: 431132790-2538225564
Opcode ID: e115d0b53be0ddba5760ba4746c3b93a208eb6e3b3123d46101a777f939fd477
Instruction ID: 529fb6cd60c64359da83f02e745b3c5d28f6fe421374b3024a67ef0d82394d5a
Opcode Fuzzy Hash: e115d0b53be0ddba5760ba4746c3b93a208eb6e3b3123d46101a777f939fd477
Instruction Fuzzy Hash: 12F0A4319012099FDF04EBA1C845BED7734AF14318F14006EE602B7181DB7D6E08CB79

Uniqueness

Uniqueness Score: -1.00%

Function 004876C6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004876CD

Part of subcall function 0048744B: __EH_prolog3.LIBCMT ref: 00487452
Part of subcall function 0048744B: #1165.MFC42U(CTOCView::_GetViewRegistryKey,00000000,00000044,004876FB,CTOCView::_LoadColumns,00000000,00000014,00485607), ref: 004874EA
Part of subcall function 0048744B: RegCloseKey.ADVAPI32(?,Portrait), ref: 0048755B
Part of subcall function 0048744B: RegCloseKey.ADVAPI32(0E0227DC,Portrait), ref: 00487565
Part of subcall function 0048744B: RegCloseKey.ADVAPI32(00000000,Portrait), ref: 0048756C

Part of subcall function 004829DB: __EH_prolog3_GS.LIBCMT ref: 004829E5

RegCloseKey.ADVAPI32(00000000,00000000,CTOCView::_LoadColumns,00000000,00000014,00485607), ref: 00487716

Strings

CTOCView::_LoadColumns, xrefs: 004876DA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$H_prolog3$#1165H_prolog3_
String ID: CTOCView::_LoadColumns
API String ID: 1359798015-279838979
Opcode ID: 0c78fb7a877a484a68aa16da291963a69cce5859d31f83fc0d321b1a330a75dd
Instruction ID: 3a9fea2282c8b5e514ce7864e60c2f6debf40a86ff96e8eac2b89c4ec2eadff3
Opcode Fuzzy Hash: 0c78fb7a877a484a68aa16da291963a69cce5859d31f83fc0d321b1a330a75dd
Instruction Fuzzy Hash: 70F09671A002658BCB04FFAA8951ADE7AB4AF55B48F10006FF505E7241DB7C5A05C7BD

Uniqueness

Uniqueness Score: -1.00%

Function 004952AB, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004952B2

Strings

CNBFileSettingsEnum::Reset, xrefs: 004952E6
CNBFileSettingsEnum::_InstallItemList, xrefs: 004952BF

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBFileSettingsEnum::Reset$CNBFileSettingsEnum::_InstallItemList
API String ID: 431132790-993292322
Opcode ID: 90c48d6c755da0f12823162509149d8b737a9f2aa47464d9961bebf1766beff2
Instruction ID: a4fc081d493b1583a051ffd78c1a73c85290589935cd65dadbbe2a4e76220228
Opcode Fuzzy Hash: 90c48d6c755da0f12823162509149d8b737a9f2aa47464d9961bebf1766beff2
Instruction Fuzzy Hash: FAF06271900109EBCB14EFA6C8818EEBBF0AF64304720446FF49597140DB7D5A85CB29

Uniqueness

Uniqueness Score: -1.00%

Function 004325FA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00432601
#1165.MFC42U(CMainFrame::OnShowRiffle,00000000,0000000C,0042CB18), ref: 00432619

Part of subcall function 004298F0: __EH_prolog3.LIBCMT ref: 004298F7

Part of subcall function 0042994E: __EH_prolog3.LIBCMT ref: 00429955

Strings

CMainFrame::OnShowRiffle, xrefs: 00432608

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165
String ID: CMainFrame::OnShowRiffle
API String ID: 2986221888-2989450421
Opcode ID: 05386a4999caa3acaf1a8e5bb1de9797bb8364d245885efe1232e8a4b6e2196f
Instruction ID: 92a605870dd0aa1e0cc0af34b7ead255c8baf478a8a0c5b4f7e2b2439131a87c
Opcode Fuzzy Hash: 05386a4999caa3acaf1a8e5bb1de9797bb8364d245885efe1232e8a4b6e2196f
Instruction Fuzzy Hash: 3CF09031B012219BDB00EBA2CD4ABAE77A46F18715F80007EE605D32C1DFBC9905CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004335B3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004335BA
memset.MSVCRT ref: 004335DD

Strings

CMainFrame::GetMRUItemPath, xrefs: 004335C7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3memset
String ID: CMainFrame::GetMRUItemPath
API String ID: 747782440-2401133863
Opcode ID: 1dd515b312755265172d82e42d6e568bc8bac5177e10c6cff039a1c44f14fdf6
Instruction ID: f69e83aa46b2ad30cc6087c04073b86d348875f34c94f3d591fce4d3b65a02d9
Opcode Fuzzy Hash: 1dd515b312755265172d82e42d6e568bc8bac5177e10c6cff039a1c44f14fdf6
Instruction Fuzzy Hash: 68F05E75600105BBCB20EFA68C46EDF7B75AFD6708F10806EF916AA181CA399A05D739

Uniqueness

Uniqueness Score: -1.00%

Function 004458D4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004458DE

Part of subcall function 00446017: __EH_prolog3_GS.LIBCMT ref: 00446021
Part of subcall function 00446017: memset.MSVCRT ref: 00446060

#1165.MFC42U(CNotebookDoc::OnFileSaveAs,00000000,00000214,004458A1,CNotebookDoc::OnFileSave,00000000,0000000C,0042D361), ref: 00445906

Part of subcall function 004423A4: __EH_prolog3_GS.LIBCMT ref: 004423AE
Part of subcall function 004423A4: memset.MSVCRT ref: 00442400
Part of subcall function 004423A4: memset.MSVCRT ref: 0044241E
Part of subcall function 004423A4: memset.MSVCRT ref: 0044243C

Part of subcall function 004459CB: __EH_prolog3_GS.LIBCMT ref: 004459D5
Part of subcall function 004459CB: memset.MSVCRT ref: 00445A46
Part of subcall function 004459CB: lstrlenW.KERNEL32(?,?,00000001,?), ref: 00445A68

Strings

CNotebookDoc::OnFileSaveAs, xrefs: 004458E7

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$H_prolog3_$#1165lstrlen
String ID: CNotebookDoc::OnFileSaveAs
API String ID: 133192370-1247242454
Opcode ID: 8a9849076d308ea9534232b92ef84a5334ee495b0fc052cfc3f4c28424e4e7f7
Instruction ID: c82676ceeb609965db1dc1fd0dccd82f0db722ce81b7f980b0e2ea1a26fdfed5
Opcode Fuzzy Hash: 8a9849076d308ea9534232b92ef84a5334ee495b0fc052cfc3f4c28424e4e7f7
Instruction Fuzzy Hash: C3F05470740215ABFF14F772CC5ABED26249F14729F4000AEB509561D2DFBC9D458A69

Uniqueness

Uniqueness Score: -1.00%

Function 004839AB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004839B2
#1165.MFC42U(CViewInfo::LoadSetting,00000000,00000010,00483EAD,?,00000001,00000002), ref: 004839D2

Strings

CViewInfo::LoadSetting, xrefs: 004839C1

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CViewInfo::LoadSetting
API String ID: 2221090558-3405456721
Opcode ID: 4d02e63befa7061bbd1cbd71916a253d15fbd1ef26b53e96c50c08d45f374a4b
Instruction ID: 7d0fc4837f86394b8a6f8bfc72afd2a3ddfc6e28fed094a095d2182174887fdd
Opcode Fuzzy Hash: 4d02e63befa7061bbd1cbd71916a253d15fbd1ef26b53e96c50c08d45f374a4b
Instruction Fuzzy Hash: A7F0C27190020A9BD700EF91C841BEE77B4AF44319F10842EE50997240DF7C9A49CB39

Uniqueness

Uniqueness Score: -1.00%

Function 004AAE1A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004AAE21
#567.MFC42U(0000000C,004AC1B0,GetJournalNotification,00000000,00000014,004AC27D,ShowJournalNotification,?,0E0227DC,?,?,00000104), ref: 004AAE2B

Part of subcall function 0049775B: #567.MFC42U(00000000,004AAE52,?,00000104), ref: 00497766

Strings

CJournalNotificationWnd::CJournalNotificationWnd, xrefs: 004AAE53

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$H_prolog3
String ID: CJournalNotificationWnd::CJournalNotificationWnd
API String ID: 966824177-2288125038
Opcode ID: 7c90c39256176035a9435f108ee0b86783a7c6cdb7fe41f66ccb2a3b757e7884
Instruction ID: 8665f486c6801f7f525f35056ca38d7fe981f5e1109827fbb8b5d6b5cac1333e
Opcode Fuzzy Hash: 7c90c39256176035a9435f108ee0b86783a7c6cdb7fe41f66ccb2a3b757e7884
Instruction Fuzzy Hash: 4201E8B4A01B06EED304DF66C4857D9FBA0BF09304F90416FD12D97281CB796558CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0044C48B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044C495

Part of subcall function 00466783: __EH_prolog3.LIBCMT ref: 0046678A
Part of subcall function 00466783: #1165.MFC42U(0000000C,0044C4C9,0000DBA3,00000066,00000000,0000EF20,00000000,00000000,00000000,?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019), ref: 0046679B
Part of subcall function 00466783: #324.MFC42U(00005E2E,?,0000000C,0044C4C9,0000DBA3,00000066,00000000,0000EF20,00000000,00000000,00000000,?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9), ref: 004667AF
Part of subcall function 00466783: #567.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 004667C8
Part of subcall function 00466783: #567.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 004667DD
Part of subcall function 00466783: #567.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 004667F1
Part of subcall function 00466783: #567.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 00466805

#2506.MFC42U(0000DBA3,00000066,00000000,0000EF20,00000000,00000000,00000000,?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C4D3

Part of subcall function 0044C4FA: __EH_prolog3.LIBCMT ref: 0044C501
Part of subcall function 0044C4FA: #795.MFC42U(00000004,0044C4E7,?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C518
Part of subcall function 0044C4FA: #609.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C528
Part of subcall function 0044C4FA: #609.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C538
Part of subcall function 0044C4FA: #795.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C545
Part of subcall function 0044C4FA: #641.MFC42U(?,CNotebookDoc::ShowHighContrastWarning,00000000,0000018C,004406D9,?,00000019,00000000), ref: 0044C551

Strings

CNotebookDoc::ShowHighContrastWarning, xrefs: 0044C4A0

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #567$H_prolog3$#609#795$#1165#2506#324#641
String ID: CNotebookDoc::ShowHighContrastWarning
API String ID: 3057489975-2774464711
Opcode ID: 2fd9005f3255345108e8bc24ad4a42f325f68b639af652b4a035d869ddae621d
Instruction ID: 9326f9e7b6f612ae8add13b3711bdd0d58282bce0ba88f833e03d419cd8fb170
Opcode Fuzzy Hash: 2fd9005f3255345108e8bc24ad4a42f325f68b639af652b4a035d869ddae621d
Instruction Fuzzy Hash: 36F05470541248BDEB40EBA1CD92EED76289B1574CF5000BEB506221C1DE791F448639

Uniqueness

Uniqueness Score: -1.00%

Function 004975D6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004975DD

Strings

CNBCacheMgr::_CreateChildrenStorage, xrefs: 004975EC
Children, xrefs: 0049760B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3
String ID: CNBCacheMgr::_CreateChildrenStorage$Children
API String ID: 431132790-1539449968
Opcode ID: 31402273d6bb0eb1fee5b7af0beab26a50efa3f544bbe34f2318d4185f5fb23d
Instruction ID: 29f9f33850819c7baabbe9c5ab35b3b7162dd37471021749dd83b5aeb6f8be18
Opcode Fuzzy Hash: 31402273d6bb0eb1fee5b7af0beab26a50efa3f544bbe34f2318d4185f5fb23d
Instruction Fuzzy Hash: 33F082B0900215AFD700AF928C85CEEBB74FF08714B50046FF515A7240DBB84E448769

Uniqueness

Uniqueness Score: -1.00%

Function 004515A8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004515AF
InvalidateRect.USER32(?,00000000,00000000), ref: 004515EA

Strings

CItemPicker::SetAutoCalcSize, xrefs: 004515BC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3InvalidateRect
String ID: CItemPicker::SetAutoCalcSize
API String ID: 1853375015-267717369
Opcode ID: 10ce4658b05f305e5a2240559a4008f4a9f472c34d6d8946eaf0183a36fb19d2
Instruction ID: 1dadd3173deacf2dc77fc00e178438d3c46f495ce3a1992a75cd89714a1a27d2
Opcode Fuzzy Hash: 10ce4658b05f305e5a2240559a4008f4a9f472c34d6d8946eaf0183a36fb19d2
Instruction Fuzzy Hash: 81F09030400208AFCB30EF66C80589BBBB1AF98B01704452FE54647291EA38A905CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00445DE5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00445DEC
lstrlenW.KERNEL32(00000000), ref: 00445E18

Strings

CNotebookDoc::IsNamed, xrefs: 00445DF9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3lstrlen
String ID: CNotebookDoc::IsNamed
API String ID: 3073243474-1542089422
Opcode ID: 40001306339144012e9f6e9f389805b45d8fcf0fa08c6d785a620b09a0684781
Instruction ID: eb924751c34495ace8dc19054a59edfde6268e1028c5d2938c94e45572af1ac3
Opcode Fuzzy Hash: 40001306339144012e9f6e9f389805b45d8fcf0fa08c6d785a620b09a0684781
Instruction Fuzzy Hash: F9E06C317012015BEB24EF66DC49AAF77689F44704750046FB506D7255CF6CD905CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00451864, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0045186B
InvalidateRect.USER32(?,00000000,00000000), ref: 004518A1

Strings

CItemPicker::SetItemVertBorder, xrefs: 00451878

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3InvalidateRect
String ID: CItemPicker::SetItemVertBorder
API String ID: 1853375015-930218572
Opcode ID: 01ac378c46f9c258cc3b14bb50ddebffd5338854eabccb77670ace00464f13f6
Instruction ID: 9f816e771aed7c33ff9cd5d19bf75371b5e4f71292f6b8ac1252a01cfade5f6e
Opcode Fuzzy Hash: 01ac378c46f9c258cc3b14bb50ddebffd5338854eabccb77670ace00464f13f6
Instruction Fuzzy Hash: C7F05E319006059FC730EF62CC05C9EBBB1BF95705B10847FA44267291CA39A905DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0045180C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00451813
InvalidateRect.USER32(?,00000000,00000000), ref: 00451849

Strings

CItemPicker::SetItemHorzBorder, xrefs: 00451820

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3InvalidateRect
String ID: CItemPicker::SetItemHorzBorder
API String ID: 1853375015-3406054100
Opcode ID: 782c558a05d949c8e2e1942b5d4ab5533cd0a4af246a5550194fcc3237419209
Instruction ID: 4b36c82ebac4c5dfd4da9bc324ff48e622e25982d914595cfa28111d08f7039f
Opcode Fuzzy Hash: 782c558a05d949c8e2e1942b5d4ab5533cd0a4af246a5550194fcc3237419209
Instruction Fuzzy Hash: 63F05E319002089FC730EF66CC4589EBBB1BF95705710447EA44267291CE39A945CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00451550, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00451557
InvalidateRect.USER32(?,00000000,00000000), ref: 0045158D

Strings

CItemPicker::SetItemHeight, xrefs: 00451564

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3InvalidateRect
String ID: CItemPicker::SetItemHeight
API String ID: 1853375015-1257037925
Opcode ID: 718fd0573b700904cf1128d6f23b47f843e8c191c4be46990e6869b124836edc
Instruction ID: 112c1ad512d6cdd0222187ddaf858883b7698bd1f7c4681cdae352404ea93455
Opcode Fuzzy Hash: 718fd0573b700904cf1128d6f23b47f843e8c191c4be46990e6869b124836edc
Instruction Fuzzy Hash: 10F08231900209EFCB20EF62CC05DAFBBB1FF95B01B10447FA54267291DE38A909CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00488C2A, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PropVariantCopy.OLE32(?,?,CPropVal::GetValue,00000000,CPropVal::CPropVal,00000000,00000000), ref: 00488C5F

Strings

CPropVal::CPropVal, xrefs: 00488C3A
CPropVal::GetValue, xrefs: 00488C46

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: CopyPropVariant
String ID: CPropVal::CPropVal$CPropVal::GetValue
API String ID: 3541164278-725894583
Opcode ID: d300a153c9a97ac44628516167b50df4be99dda87938a1d9acddec97e4993af4
Instruction ID: 12f2c5ec9d8d664b097e4f963bbb772dc1b87409a9b776e2f7adac551335a598
Opcode Fuzzy Hash: d300a153c9a97ac44628516167b50df4be99dda87938a1d9acddec97e4993af4
Instruction Fuzzy Hash: E8E092319411087BC710F696DC4AFDE77349B21714F10016BBA2562082DE696A04C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 00434D4B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00434D52
#5867.MFC42U(?,CMainFrame::SetReBarPosition,00000000,00000008,0042B590,?,?,00000003,00000072,00000008,00000003,?,00000002,00000071,00000009,00000016), ref: 00434D89

Strings

CMainFrame::SetReBarPosition, xrefs: 00434D5B

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #5867H_prolog3
String ID: CMainFrame::SetReBarPosition
API String ID: 3716589252-1830727329
Opcode ID: c85d4cb15cb80e1ac4daa2d0aa8c96346e11891c588730880a625168f6986f10
Instruction ID: 3091d97b458c89aa2f503760bcdc273d4f3052a4187614a41d02cc2ef1acb07d
Opcode Fuzzy Hash: c85d4cb15cb80e1ac4daa2d0aa8c96346e11891c588730880a625168f6986f10
Instruction Fuzzy Hash: BEF0A031B01200ABE714EBA1CC5AFFE7B60EF24716F00047EB116E72C1DEA96A04C769

Uniqueness

Uniqueness Score: -1.00%

Function 004510FE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00451105
InvalidateRect.USER32(?,00000000,00000000), ref: 00451136

Strings

CItemPicker::SetNumColumns, xrefs: 00451112

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3InvalidateRect
String ID: CItemPicker::SetNumColumns
API String ID: 1853375015-1005829632
Opcode ID: 1e4c8599bf859c873d33235bc96d0497f5d0af6d55a320700f7d80170111d22c
Instruction ID: c1a0fd82cc24440e84f81847ed7192c199f93ee5723652f611b7c4523d5da52d
Opcode Fuzzy Hash: 1e4c8599bf859c873d33235bc96d0497f5d0af6d55a320700f7d80170111d22c
Instruction Fuzzy Hash: CCF01C355006089FC724EF66CC4999EBBB0BF95700750446FA542A7291CA79AA05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00431189, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00431190
#1165.MFC42U(CMainFrame::GetCurrentEraser,00000000,0000000C,0042C873,?,00000001,00000005), ref: 004311AB

Strings

CMainFrame::GetCurrentEraser, xrefs: 00431197

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CMainFrame::GetCurrentEraser
API String ID: 2221090558-3200708290
Opcode ID: 4374329c5ef4d96fc1f94c3be92d60041265b7f50b4ada0b6017a96aaa7ce5a2
Instruction ID: 573a4a28e481e90866792c3f543edc677eaf2bd5794b73491bc9f661002daa54
Opcode Fuzzy Hash: 4374329c5ef4d96fc1f94c3be92d60041265b7f50b4ada0b6017a96aaa7ce5a2
Instruction Fuzzy Hash: 7CE06D3074011B9BEB04E792CC56BED7764AF14B18F40406FE715AB1C1DBBCAA4A876D

Uniqueness

Uniqueness Score: -1.00%

Function 0044FC3B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044FC42
#4162.MFC42U(CLockHolder::AcquireLock,00000000,0000000C,00450044,?,?,?,?), ref: 0044FC6A

Strings

CLockHolder::AcquireLock, xrefs: 0044FC51

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #4162H_prolog3
String ID: CLockHolder::AcquireLock
API String ID: 2073071252-2242344742
Opcode ID: 5cf5149df9355f96b1e04019fae171700d633914cf26838ecd7cfdaac4d7e7be
Instruction ID: 186cdb0377cbfb8df38fcdab5879a401b03d5f5db6a337ee0b4b9f933211f62b
Opcode Fuzzy Hash: 5cf5149df9355f96b1e04019fae171700d633914cf26838ecd7cfdaac4d7e7be
Instruction Fuzzy Hash: 3FF0583194012A9BEB00EB92CC467FE7770BB04729F80047AE51167290DBBC6D09CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0042FE2B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042FE32
#1165.MFC42U(CMainFrame::IsHighlightMode,00000000,0000000C,0042FAAE), ref: 0042FE4A

Part of subcall function 0042A482: __EH_prolog3.LIBCMT ref: 0042A489

Part of subcall function 0042ADE7: __EH_prolog3.LIBCMT ref: 0042ADEE
Part of subcall function 0042ADE7: #1165.MFC42U(CMainFrame::GetCurrentPenType,00000000,0000000C,00430CA9), ref: 0042AE06

Strings

CMainFrame::IsHighlightMode, xrefs: 0042FE39

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165
String ID: CMainFrame::IsHighlightMode
API String ID: 2986221888-4050722093
Opcode ID: d267879ebe2fc185b37ee73083209db6d43ea74c6cd2a90e3ba1c983e6eaccb7
Instruction ID: 980ec9d224d90a1861ad303debc901aa54fbea2016989eb35b5725bbb6572bab
Opcode Fuzzy Hash: d267879ebe2fc185b37ee73083209db6d43ea74c6cd2a90e3ba1c983e6eaccb7
Instruction Fuzzy Hash: DFE09B307001204FD751F792DD4AFADB7709B14B15FC100BBEA06971E2CE6C5D4586AE

Uniqueness

Uniqueness Score: -1.00%

Function 004306DC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004306E3
#1165.MFC42U(CMainFrame::OnUpdateRedoMenu,00000000,00000008,0042FC1C,?), ref: 004306FB

Part of subcall function 0044C7D7: __EH_prolog3.LIBCMT ref: 0044C7DE
Part of subcall function 0044C7D7: #2809.MFC42U(?,0000EF42,00000000,00000000,CNotebookDoc::GetCurrentRedoString,00000000,0000000C,0042A71C), ref: 0044C81E
Part of subcall function 0044C7D7: SysFreeString.OLEAUT32(00000000), ref: 0044C83B

Strings

CMainFrame::OnUpdateRedoMenu, xrefs: 004306EA

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165#2809FreeString
String ID: CMainFrame::OnUpdateRedoMenu
API String ID: 2946518952-2631560166
Opcode ID: 8a5b9cd87e4d09c38e8597f627b4b7cea9ab65bf1039f14fb1f4a8fb15f0b2fe
Instruction ID: c01d3d4f295946d58c199e044613b2c797faea9b9f48d865a3de87c2fb1d30ff
Opcode Fuzzy Hash: 8a5b9cd87e4d09c38e8597f627b4b7cea9ab65bf1039f14fb1f4a8fb15f0b2fe
Instruction Fuzzy Hash: 7EF0A0342012059FDB04EB12CD5ABBE7760AF54316F14807EA84AA72C2CF38AD058B29

Uniqueness

Uniqueness Score: -1.00%

Function 00483A1C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00483A23
#1165.MFC42U(CViewInfo::SaveSetting,00000000,00000010,00483D3B,?,00000001,CViewMgr::FlushViewSettings,00000000,CViewMgr::SaveViewSettings,?,00000014,0042BBFE,?,0000002C,00000018), ref: 00483A43

Strings

CViewInfo::SaveSetting, xrefs: 00483A32

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CViewInfo::SaveSetting
API String ID: 2221090558-3979807433
Opcode ID: c1c0c577617ded619c28671ec682cb8eb093b346817385c434fb60d18c08e1ca
Instruction ID: e48d1e28fa5034911e4c57bb8208d580f3a8bf471ba8e6ccb0e6919e3f407fea
Opcode Fuzzy Hash: c1c0c577617ded619c28671ec682cb8eb093b346817385c434fb60d18c08e1ca
Instruction Fuzzy Hash: D1F0A0329001059BDB00EB92C805BEEB770AF14319F00816FE505A7191DF7C6A05CBBA

Uniqueness

Uniqueness Score: -1.00%

Function 0047CD3E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047CD45

Part of subcall function 004796DC: __EH_prolog3.LIBCMT ref: 004796E3
Part of subcall function 004796DC: #1165.MFC42U(W_SetWaitMode,00000000,0000000C,00445E7F), ref: 004796FD

#1165.MFC42U(CNotebookDocPrint::AbortJob,00000000,0000000C,00444CB7), ref: 0047CD65

Part of subcall function 00479295: __EH_prolog3.LIBCMT ref: 0047929C
Part of subcall function 00479295: WaitForSingleObject.KERNEL32(?,000000FF,Helpers::WaitForSingleObject,?,CThreadMgr::SetThreadAbort,00000000,CThreadMgr::AbortThread,?,00000020,0047CD7A,?), ref: 004792F6
Part of subcall function 00479295: GetLastError.KERNEL32 ref: 00479301

Strings

CNotebookDocPrint::AbortJob, xrefs: 0047CD4C

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165$ErrorLastObjectSingleWait
String ID: CNotebookDocPrint::AbortJob
API String ID: 1639061756-3343317692
Opcode ID: 75ee591d30ee7001b05992dccaba699cd2add0d3432d95a1eaf2d30661837231
Instruction ID: b2f90a2c178cb106117bd7ac35696973623713337cfcd448966f86d72c107843
Opcode Fuzzy Hash: 75ee591d30ee7001b05992dccaba699cd2add0d3432d95a1eaf2d30661837231
Instruction Fuzzy Hash: C9E092306401005BEB08B3B2CC1BBEE67605B14729F4441BFF20A971C2CE6C89058A6C

Uniqueness

Uniqueness Score: -1.00%

Function 0042FDD4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042FDDB
#1165.MFC42U(CMainFrame::IsPenMode,00000000,0000000C,0042F9C2), ref: 0042FDF3

Part of subcall function 0042A482: __EH_prolog3.LIBCMT ref: 0042A489

Part of subcall function 0042ADE7: __EH_prolog3.LIBCMT ref: 0042ADEE
Part of subcall function 0042ADE7: #1165.MFC42U(CMainFrame::GetCurrentPenType,00000000,0000000C,00430CA9), ref: 0042AE06

Strings

CMainFrame::IsPenMode, xrefs: 0042FDE6

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3$#1165
String ID: CMainFrame::IsPenMode
API String ID: 2986221888-1230264730
Opcode ID: 07e909e453c07ed178910a5ca13c693f61b910951fc4375bc50dab42680a5819
Instruction ID: 4f1fde4ea441ccc0c7df72a4335808b4da0c9365c3bbe213e38d359d2eda0f9f
Opcode Fuzzy Hash: 07e909e453c07ed178910a5ca13c693f61b910951fc4375bc50dab42680a5819
Instruction Fuzzy Hash: 2DE06D306001209BCB10BBA3AD4A9EE77709F54714F9100BBEA0687292DA6C9E45CA6E

Uniqueness

Uniqueness Score: -1.00%

Function 0042ADE7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042ADEE
#1165.MFC42U(CMainFrame::GetCurrentPenType,00000000,0000000C,00430CA9), ref: 0042AE06

Strings

CMainFrame::GetCurrentPenType, xrefs: 0042ADF9

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CMainFrame::GetCurrentPenType
API String ID: 2221090558-696559266
Opcode ID: b922ad858be58ae3e3353a14f1bdf2d1a9f35403fe4ebcf3c3492f90d2973485
Instruction ID: 89a160d5a77875b1c5eba72e4e2a3f2379ead96b6a4b5faaadf3057edae075fb
Opcode Fuzzy Hash: b922ad858be58ae3e3353a14f1bdf2d1a9f35403fe4ebcf3c3492f90d2973485
Instruction Fuzzy Hash: 58E0657160002A97DB04E7D2CD06AEE7724AF04718F40006EEA05A7181DE7C5A46C77D

Uniqueness

Uniqueness Score: -1.00%

Function 0042AE3C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0042AE43
#1165.MFC42U(CMainFrame::GetCurrentWritingPenIndex,00000000,0000000C,0042B2E0,00009CEB,00008012,00008011,00008010,00009CEB,00009CFF,004D2078,00000005,00009CFE,004D20F0,00000005,00009C7C), ref: 0042AE5B

Strings

CMainFrame::GetCurrentWritingPenIndex, xrefs: 0042AE4E

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165H_prolog3
String ID: CMainFrame::GetCurrentWritingPenIndex
API String ID: 2221090558-2640091841
Opcode ID: f3d959f4d47250efe26a3299a8fe57792fa299c2caf00a323008f252ea63dcff
Instruction ID: c40e70c8de268747e6d3c66bd9646337716c7e3684ade36b7387e89a27cb6b1c
Opcode Fuzzy Hash: f3d959f4d47250efe26a3299a8fe57792fa299c2caf00a323008f252ea63dcff
Instruction Fuzzy Hash: 46E0653160002A97DB00E7D2CD46AEE7724AF44714F40006EF60597181DA7C5A06C77D

Uniqueness

Uniqueness Score: -1.00%

Function 0049E056, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

#793.MFC42U(CSpinEdit::~CSpinEdit,00000000), ref: 0049E091

Strings

DK, xrefs: 0049E06F
CSpinEdit::~CSpinEdit, xrefs: 0049E06A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #793
String ID: CSpinEdit::~CSpinEdit$DK
API String ID: 62111861-1681962446
Opcode ID: cdaff1381d960a99d4538dfaf9fa644a2de2001246074cabc4871067757b2b4c
Instruction ID: b29affaa1f7d6c690ff0122ff83a801370d96492c1378ce8d3b4d1376cfade04
Opcode Fuzzy Hash: cdaff1381d960a99d4538dfaf9fa644a2de2001246074cabc4871067757b2b4c
Instruction Fuzzy Hash: DCE0D8325116005BC324FB26DC06BE9B7A4AB51328F00061FF5A6824D0EFB46955C7CF

Uniqueness

Uniqueness Score: -1.00%

Function 00479106, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0047910D
#2606.MFC42U(CThreadMgr::Init,00000000,0000000C,0047923C,?,CNotebookDocPrint::OnPrint,?,000003D8,0047CE28,?,?,00000080,CNotebookDoc::OnPrint,00000000,00000010,0042D324), ref: 00479133

Strings

CThreadMgr::Init, xrefs: 0047911A

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #2606H_prolog3
String ID: CThreadMgr::Init
API String ID: 1320407807-4095064700
Opcode ID: 5220f75ebb18b33fcbd2e5a081cbaf9ca1ae80bcf48146a5006af3becf35f7be
Instruction ID: a24804069ead7bdd4b7692f74b1a5c6e500d337f112d74562df51f4bf4909520
Opcode Fuzzy Hash: 5220f75ebb18b33fcbd2e5a081cbaf9ca1ae80bcf48146a5006af3becf35f7be
Instruction Fuzzy Hash: E4E039B58007058BC724EF67C8469EAFBF8AFA4700B40C56FD55B83250DE786146CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004796DC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004796E3
#1165.MFC42U(W_SetWaitMode,00000000,0000000C,00445E7F), ref: 004796FD

Part of subcall function 00441B78: #1662.MFC42U ref: 00441BC9

Strings

W_SetWaitMode, xrefs: 004796EC

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: #1165#1662H_prolog3
String ID: W_SetWaitMode
API String ID: 3809252685-159958660
Opcode ID: fd4ac8114acc403271f4a612f1f835eb65f2e29631458766611112829ac3fd73
Instruction ID: 26c510567b35dba8e869360e89f0837ced15eba95884923703041df156e69891
Opcode Fuzzy Hash: fd4ac8114acc403271f4a612f1f835eb65f2e29631458766611112829ac3fd73
Instruction Fuzzy Hash: B4E0EC345411009AE704F7A2CC4BBED77609F15719F8040BFA205571E2EFA86945C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 00483176, Relevance: 5.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004831D5

Memory Dump Source

Source File: 00000001.00000002.259326830.0000000000417000.00000080.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.259307171.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.259311762.0000000000401000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259402485.00000000004B8000.00000040.00020000.sdmp Download File
Associated: 00000001.00000002.259406007.00000000004B9000.00000080.00020000.sdmp Download File
Associated: 00000001.00000002.259420062.00000000004D2000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259423779.00000000004D3000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.259428829.00000000004D6000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.259432492.00000000004D8000.00000002.00020000.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 2670a1bbf697a2c97794dd14468fc42a40068a4a137cd0891acbed334d5c5839
Instruction ID: 6e778ffd158ec4b94c9a285563ac3eff8eca62dadfd110607d08ad30ab2ddd18
Opcode Fuzzy Hash: 2670a1bbf697a2c97794dd14468fc42a40068a4a137cd0891acbed334d5c5839
Instruction Fuzzy Hash: 05410AB1600302ABC724EF5DCC8595EB7D8EF94B193208C7FE48AC7711D235EA418B68

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 6c9e4dd7_by_Libranalysis

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NetWire

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets