Edit tour

Windows Analysis Report
AxoPac.exe

Overview

General Information

Sample name:	AxoPac.exe
Analysis ID:	1580143
MD5:	cdc969b4443762c7355fe3d7d2cd67dd
SHA1:	1f1c77a921532e177e5f1b624fb8d8fbb8e35bc8
SHA256:	131313b1f68179ad8df9d3bafc0f14c07abb2f3652067c4c1c6d0e0574fa0d54
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

AxoPac.exe (PID: 1272 cmdline: "C:\Users\user\Desktop\AxoPac.exe" MD5: CDC969B4443762C7355FE3D7D2CD67DD)

cmd.exe (PID: 5720 cmdline: "C:\Windows\System32\cmd.exe" /c move Formed Formed.cmd & Formed.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4428 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 4820 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 5696 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2696 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6668 cmdline: cmd /c md 296336 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 7036 cmdline: extrac32 /Y /E Eyed MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 4076 cmdline: findstr /V "Avoid" Registered MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 4420 cmdline: cmd /c copy /b ..\Licensing + ..\Onto + ..\Needed + ..\Floral + ..\Two + ..\Access + ..\Wing j MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Essex.com (PID: 4296 cmdline: Essex.com j MD5: 62D09F076E6E0240548C2F837536A46A)

choice.exe (PID: 1704 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bashfulacid.lat", "manyrestro.lat", "slipperyloo.lat", "tentabatte.lat", "curverpluch.lat", "obtainableruun.click", "talkynicer.lat", "shapestickyr.lat", "wordyfindy.lat"], "Build id": "yau6Na--1779986370"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Formed Formed.cmd & Formed.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5720, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 2696, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:05.267495+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	172.67.184.241	443	TCP
2024-12-24T02:17:07.383927+0100	2028371	3	Unknown Traffic	192.168.2.4	49749	172.67.184.241	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:06.430426+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49743	172.67.184.241	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:06.430426+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49743	172.67.184.241	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (wordyfindy .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:05.267495+0100	2058515	1	Domain Observed Used for C2 Detected	192.168.2.4	49743	172.67.184.241	443	TCP
2024-12-24T02:17:07.383927+0100	2058515	1	Domain Observed Used for C2 Detected	192.168.2.4	49749	172.67.184.241	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T02:17:03.704581+0100	2058514	1	Domain Observed Used for C2 Detected	192.168.2.4	65385	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://wordyfindy.lat:443/apiS	Avira URL Cloud: Label: malware
Source: https://wordyfindy.lat/api	Avira URL Cloud: Label: malware
Source: https://wordyfindy.lat:443/api	Avira URL Cloud: Label: malware
Source: https://obtainableruun.click:443/api	Avira URL Cloud: Label: malware
Source: obtainableruun.click	Avira URL Cloud: Label: malware
Source: https://wordyfindy.lat/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["bashfulacid.lat", "manyrestro.lat", "slipperyloo.lat", "tentabatte.lat", "curverpluch.lat", "obtainableruun.click", "talkynicer.lat", "shapestickyr.lat", "wordyfindy.lat"], "Build id": "yau6Na--1779986370"}

Multi AV Scanner detection for submitted file

Source: AxoPac.exe	ReversingLabs: Detection: 21%
Source: AxoPac.exe	Virustotal: Detection: 18%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.1% probability

Sample uses string decryption to hide its real strings

Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: obtainableruun.click
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: bashfulacid.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: tentabatte.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: curverpluch.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: talkynicer.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: shapestickyr.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: manyrestro.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: slipperyloo.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: wordyfindy.lat
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: obtainableruun.click
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: yau6Na--1779986370

Source: AxoPac.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.184.241:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: AxoPac.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\AxoPac.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\AxoPac.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003BA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_003BA570
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003ADC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_003ADC54
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003BA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_003BA087
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003BA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_003BA1E2
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003AE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_003AE472
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0037C622 FindFirstFileExW,	11_2_0037C622
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003B66DC FindFirstFileW,FindNextFileW,FindClose,	11_2_003B66DC
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003B7333 FindFirstFileW,FindClose,	11_2_003B7333
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003B73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_003B73D4
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003AD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_003AD921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\296336\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\296336	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058515 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (wordyfindy .lat in TLS SNI) : 192.168.2.4:49749 -> 172.67.184.241:443
Source: Network traffic	Suricata IDS: 2058515 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (wordyfindy .lat in TLS SNI) : 192.168.2.4:49743 -> 172.67.184.241:443
Source: Network traffic	Suricata IDS: 2058514 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat) : 192.168.2.4:65385 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49743 -> 172.67.184.241:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49743 -> 172.67.184.241:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: obtainableruun.click
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49749 -> 172.67.184.241:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 172.67.184.241:443

Source: global traffic

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: wordyfindy.lat

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003BD889 InternetReadFile,SetEvent,GetLastError,SetEvent,

11_2_003BD889

Source: global traffic	DNS traffic detected: DNS query: GBXYzxvXwTFqwDeYCWLngdSLgvXMN.GBXYzxvXwTFqwDeYCWLngdSLgvXMN
Source: global traffic	DNS traffic detected: DNS query: obtainableruun.click
Source: global traffic	DNS traffic detected: DNS query: wordyfindy.lat

Source: unknown

Source: AxoPac.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: AxoPac.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: AxoPac.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: AxoPac.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: AxoPac.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AxoPac.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: AxoPac.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: AxoPac.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: AxoPac.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: AxoPac.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: AxoPac.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: AxoPac.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: AxoPac.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: AxoPac.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Essex.com, 0000000B.00000000.1817949779.0000000000415000.00000002.00000001.01000000.00000007.sdmp, Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: AxoPac.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Essex.com, 0000000B.00000002.2329368919.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://obtainableruun.click:443/api
Source: Essex.com, 0000000B.00000002.2329368919.0000000001456000.00000004.00000020.00020000.00000000.sdmp, Essex.com, 0000000B.00000002.2329368919.000000000150D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wordyfindy.lat/
Source: Essex.com, 0000000B.00000002.2329368919.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wordyfindy.lat/api
Source: Essex.com, 0000000B.00000002.2329368919.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wordyfindy.lat:443/api
Source: Essex.com, 0000000B.00000002.2329368919.0000000001456000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wordyfindy.lat:443/apiS
Source: Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Particularly.8.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749

Source: unknown

HTTPS traffic detected: 172.67.184.241:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: C:\Users\user\Desktop\AxoPac.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003BF7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

11_2_003BF7C7

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003BF55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_003BF55C

Source: C:\Users\user\Desktop\AxoPac.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003D9FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

11_2_003D9FD2

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003B4763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

11_2_003B4763

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003A1B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_003A1B4D

Source: C:\Users\user\Desktop\AxoPac.exe	Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		0_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003AF20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		11_2_003AF20D

Source: C:\Users\user\Desktop\AxoPac.exe	File created: C:\Windows\GovernmentCompounds	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	File created: C:\Windows\SoccerCheaper	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	File created: C:\Windows\InnPearl	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	File created: C:\Windows\PressEditing	Jump to behavior

Source: C:\Users\user\Desktop\AxoPac.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\AxoPac.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\AxoPac.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\AxoPac.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00368017	11_2_00368017
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0035E144	11_2_0035E144
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0034E1F0	11_2_0034E1F0
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0037A26E	11_2_0037A26E
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003622A2	11_2_003622A2
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003422AD	11_2_003422AD
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0035C624	11_2_0035C624
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0037E87F	11_2_0037E87F
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003CC8A4	11_2_003CC8A4
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003B2A05	11_2_003B2A05
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00376ADE	11_2_00376ADE
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003A8BFF	11_2_003A8BFF
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0035CD7A	11_2_0035CD7A
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0036CE10	11_2_0036CE10
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00377159	11_2_00377159
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00349240	11_2_00349240
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003D5311	11_2_003D5311
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003496E0	11_2_003496E0
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00361704	11_2_00361704
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00361A76	11_2_00361A76
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00349B60	11_2_00349B60
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00367B8B	11_2_00367B8B
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00361D20	11_2_00361D20
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00367DBA	11_2_00367DBA
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00361FE7	11_2_00361FE7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\296336\Essex.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: String function: 0035FD52 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: String function: 00360DA0 appears 46 times
Source: C:\Users\user\Desktop\AxoPac.exe	Code function: String function: 004062CF appears 57 times

Source: AxoPac.exe

Static PE information: invalid certificate

Source: AxoPac.exe, 00000000.00000003.1757069719.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs AxoPac.exe
Source: AxoPac.exe, 00000000.00000002.1757566213.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs AxoPac.exe

Source: AxoPac.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Essex.com, 0000000B.00000003.1819060158.00000000011B6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: m.sLnZ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@24/23@3/1

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003B41FA GetLastError,FormatMessageW,

11_2_003B41FA

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003A2010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		11_2_003A2010
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003A1A0B AdjustTokenPrivileges,CloseHandle,		11_2_003A1A0B

Source: C:\Users\user\Desktop\AxoPac.exe

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003ADD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_003ADD87

Source: C:\Users\user\Desktop\AxoPac.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003B3A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

11_2_003B3A0E

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5080:120:WilError_03

Source: C:\Users\user\Desktop\AxoPac.exe

File created: C:\Users\user\AppData\Local\Temp\nst63D.tmp

Jump to behavior

Source: AxoPac.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\AxoPac.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AxoPac.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AxoPac.exe	ReversingLabs: Detection: 21%
Source: AxoPac.exe	Virustotal: Detection: 18%

Source: C:\Users\user\Desktop\AxoPac.exe

File read: C:\Users\user\Desktop\AxoPac.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AxoPac.exe "C:\Users\user\Desktop\AxoPac.exe"
Source: C:\Users\user\Desktop\AxoPac.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Formed Formed.cmd & Formed.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 296336
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Eyed
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Avoid" Registered
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Licensing + ..\Onto + ..\Needed + ..\Floral + ..\Two + ..\Access + ..\Wing j
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\296336\Essex.com Essex.com j
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\Desktop\AxoPac.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Formed Formed.cmd & Formed.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 296336	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Eyed	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Avoid" Registered	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Licensing + ..\Onto + ..\Needed + ..\Floral + ..\Two + ..\Access + ..\Wing j	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\296336\Essex.com Essex.com j	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\AxoPac.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AxoPac.exe

Static file information: File size 1608397 > 1048576

Source: AxoPac.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\AxoPac.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: AxoPac.exe

Static PE information: real checksum: 0x18e53d should be: 0x18b940

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00390315 push cs; retn 0038h		11_2_00390318
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00360DE6 push ecx; ret		11_2_00360DF9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003D26DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		11_2_003D26DD
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0035FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		11_2_0035FC7C

Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AxoPac.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

API coverage: 4.3 %

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com TID: 404

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Windows\SysWOW64\extrac32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\extrac32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\extrac32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\extrac32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\AxoPac.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\AxoPac.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003BA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_003BA570
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003ADC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_003ADC54
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003BA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_003BA087
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003BA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_003BA1E2
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003AE472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_003AE472
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_0037C622 FindFirstFileExW,	11_2_0037C622
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003B66DC FindFirstFileW,FindNextFileW,FindClose,	11_2_003B66DC
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003B7333 FindFirstFileW,FindClose,	11_2_003B7333
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003B73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_003B73D4
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003AD921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_003AD921

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_00345FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_00345FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\296336\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\296336	Jump to behavior

Source: Essex.com, 0000000B.00000002.2329539574.0000000001526000.00000004.00000020.00020000.00000000.sdmp, Essex.com, 0000000B.00000002.2329539574.0000000001558000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Essex.com, 0000000B.00000002.2329539574.0000000001558000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWi
Source: Essex.com, 0000000B.00000003.2282002170.0000000001544000.00000004.00000020.00020000.00000000.sdmp, Essex.com, 0000000B.00000003.2283113653.0000000001544000.00000004.00000020.00020000.00000000.sdmp, Essex.com, 0000000B.00000003.2282212738.0000000001544000.00000004.00000020.00020000.00000000.sdmp, Essex.com, 0000000B.00000003.2281323785.0000000001537000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003BF4FF BlockInput,

11_2_003BF4FF

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_0034338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_0034338B

Source: C:\Users\user\Desktop\AxoPac.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_00365058 mov eax, dword ptr fs:[00000030h]

11_2_00365058

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003A20AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

11_2_003A20AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00372992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00372992
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00360BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00360BAF
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00360D45 SetUnhandledExceptionFilter,	11_2_00360D45
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_00360F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00360F91

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Essex.com, 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: Essex.com, 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: Essex.com, 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: Essex.com, 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: Essex.com, 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: Essex.com, 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: Essex.com, 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: Essex.com, 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: Essex.com, 0000000B.00000003.2282092598.0000000006E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: obtainableruun.click

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

11_2_003A1B4D

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_0034338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_0034338B

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003ABBED SendInput,keybd_event,

11_2_003ABBED

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003AEC6C mouse_event,

11_2_003AEC6C

Source: C:\Users\user\Desktop\AxoPac.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Formed Formed.cmd & Formed.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 296336	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Eyed	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Avoid" Registered	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Licensing + ..\Onto + ..\Needed + ..\Floral + ..\Two + ..\Access + ..\Wing j	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\296336\Essex.com Essex.com j	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003A14AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

11_2_003A14AE

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_003A1FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_003A1FB0

Source: Essex.com, 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmp, Essex.com, 0000000B.00000003.2287649409.000000000775E000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Essex.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_00360A08 cpuid

11_2_00360A08

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_0039E5F4 GetLocalTime,

11_2_0039E5F4

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_0039E652 GetUserNameW,

11_2_0039E652

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Code function: 11_2_0037BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

11_2_0037BCD2

Source: C:\Users\user\Desktop\AxoPac.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: Essex.com	Binary or memory string: WIN_81
Source: Essex.com	Binary or memory string: WIN_XP
Source: Particularly.8.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Essex.com	Binary or memory string: WIN_XPe
Source: Essex.com	Binary or memory string: WIN_VISTA
Source: Essex.com	Binary or memory string: WIN_7
Source: Essex.com	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003C2263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		11_2_003C2263
Source: C:\Users\user\AppData\Local\Temp\296336\Essex.com	Code function: 11_2_003C1C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		11_2_003C1C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	37 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	11 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AxoPac.exe	21%	ReversingLabs	Win32.Trojan.Generic
AxoPac.exe	18%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\296336\Essex.com	0%	ReversingLabs

Source	Detection	Scanner	Label
https://wordyfindy.lat:443/apiS	100%	Avira URL Cloud	malware
https://wordyfindy.lat/api	100%	Avira URL Cloud	malware
https://wordyfindy.lat:443/api	100%	Avira URL Cloud	malware
https://obtainableruun.click:443/api	100%	Avira URL Cloud	malware
obtainableruun.click	100%	Avira URL Cloud	malware
https://wordyfindy.lat/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
wordyfindy.lat	172.67.184.241	true	true	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.100	true	false	high
GBXYzxvXwTFqwDeYCWLngdSLgvXMN.GBXYzxvXwTFqwDeYCWLngdSLgvXMN	unknown	unknown	false	unknown
obtainableruun.click	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
wordyfindy.lat	false		high
https://wordyfindy.lat/api	true	Avira URL Cloud: malware	unknown
slipperyloo.lat	false		high
curverpluch.lat	false		high
tentabatte.lat	false		high
bashfulacid.lat	false		high
manyrestro.lat	false		high
shapestickyr.lat	false		high
obtainableruun.click	true	Avira URL Cloud: malware	unknown
talkynicer.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://obtainableruun.click:443/api	Essex.com, 0000000B.00000002.2329368919.0000000001456000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.autoitscript.com/autoit3/X	Essex.com, 0000000B.00000000.1817949779.0000000000415000.00000002.00000001.01000000.00000007.sdmp, Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	AxoPac.exe	false		high
https://wordyfindy.lat:443/apiS	Essex.com, 0000000B.00000002.2329368919.0000000001456000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.autoitscript.com/autoit3/	Essex.com, 0000000B.00000003.2287649409.000000000776C000.00000004.00000800.00020000.00000000.sdmp, Essex.com.1.dr, Particularly.8.dr	false		high
https://wordyfindy.lat:443/api	Essex.com, 0000000B.00000002.2329368919.0000000001456000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://wordyfindy.lat/	Essex.com, 0000000B.00000002.2329368919.0000000001456000.00000004.00000020.00020000.00000000.sdmp, Essex.com, 0000000B.00000002.2329368919.000000000150D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.184.241	wordyfindy.lat	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580143
Start date and time:	2024-12-24 02:15:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AxoPac.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@24/23@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 77 Number of non-executed functions: 307
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.85.23.206, 52.165.164.15, 13.107.246.63
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:16:08	API Interceptor	1x Sleep call for process: AxoPac.exe modified
20:16:15	API Interceptor	20x Sleep call for process: Essex.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.184.241	http://qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js	Get hash	malicious	Unknown	Browse	qwasdrgqwdasd.winbestprizess.info/palasekddq2hf45ysm.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
wordyfindy.lat	ZysXVT72cl.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
wordyfindy.lat	external.exe	Get hash	malicious	LummaC	Browse	104.21.19.35
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml	Get hash	malicious	Unknown	Browse	217.20.58.99
	PLEASE SIGN THIS DOCUMENT - Reference number(s) 0598190575 DPR.msg	Get hash	malicious	Unknown	Browse	217.20.58.101
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	217.20.58.99
	fKdiT1D1dk.exe	Get hash	malicious	RHADAMANTHYS	Browse	217.20.58.100
	uDTW3VjJJT.exe	Get hash	malicious	LummaC, Stealc	Browse	217.20.58.99
	data.exe	Get hash	malicious	Unknown	Browse	217.20.58.99
	4hSuRTwnWJ.dll	Get hash	malicious	Unknown	Browse	217.20.58.100
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	217.20.58.99
	gCXzb0K8Ci.ps1	Get hash	malicious	Unknown	Browse	217.20.58.99
	H2PspQWoHE.ps1	Get hash	malicious	Unknown	Browse	84.201.212.68

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.6
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.6
	'Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.191.144
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.27.229
	installer.msi	Get hash	malicious	Unknown	Browse	104.21.80.93
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.58.45
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.169.205
	EPIRTURMEROOO0060.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
	'Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
	AutoUpdate.exe	Get hash	malicious	LummaC	Browse	172.67.184.241
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	172.67.184.241
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.184.241

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\296336\Essex.com	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse
	ChoForgot.exe	Get hash	malicious	Vidar	Browse
	94e.exe	Get hash	malicious	Remcos	Browse
	94e.exe	Get hash	malicious	Remcos	Browse
	0442.pdf.exe	Get hash	malicious	Remcos	Browse
	acronis recovery expert deluxe 1.0.0.132.rarl.exe	Get hash	malicious	LummaC	Browse
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\296336\Essex.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: fkawMJ7FH8.exe, Detection: malicious, Browse Filename: ChoForgot.exe, Detection: malicious, Browse Filename: 94e.exe, Detection: malicious, Browse Filename: 94e.exe, Detection: malicious, Browse Filename: 0442.pdf.exe, Detection: malicious, Browse Filename: acronis recovery expert deluxe 1.0.0.132.rarl.exe, Detection: malicious, Browse Filename: trZG6pItZj.exe, Detection: malicious, Browse Filename: 9EI7wrGs4K.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\296336\j

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	482108
Entropy (8bit):	7.999596245177931
Encrypted:	true
SSDEEP:	12288:LvKyEHJkr7Z5WlzkmuS0c/hX2XX9CukP0eoyAj:rSpK74gS0sGtlkPG
MD5:	E641D39BE9BA66D7E4FDD480E820AD3E
SHA1:	95C433ACFC506E0F8879DDFE7F54452251DF6F3B
SHA-256:	4947299F74E137693C2439966FABBC4792A5CBF02239E2B4BE46CDB53D93EB58
SHA-512:	F2E22DE1AD1BEF19A137A0C9EF1D05026EE61120863AF2A518103B9A642186C65FAAB5F4B0D08E98AC7C4C8BE0A073439C054FEBC608316D49E50F68E7D50D89
Malicious:	false
Preview:	...Z..v....:3R...=.50........5.._=..).B.+`...9..\gL....-N .q#.t...C@.].4...-.Le. \....E..8!..<D^..B...Q.......Q...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R{...B.?.'.F...h.............?U..D.j?U..D.jkC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..}.'..,P..Myn.2..t.W....d..........?U..&..j?U..D.jm.....\|...5...x..2(.U.j...."g.\|#.A.....)..h...}.......sX...=....O..ga.e9$...g>.o..\|V./.@..L.`...;_..... .xbJ.8..].2.>..w..]:.JfDW.L..}lnx....c.5b.\|z...K.@.6.,<.N'.....&.nK.(...R..AI.G..+..x.!.`4.......=....J.w8V_.....%\|..M2...V....R...0.......c..O..0..z...v....\|cKx.JP..).e.x.GB......B...Q..[...!..>..\|...._.].b1..........`&p.PD..LJ.s.L....p.r5....P..K.d..B.c...f...n.

C:\Users\user\AppData\Local\Temp\Access

Download File

Process:	C:\Users\user\Desktop\AxoPac.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997375722181267
Encrypted:	true
SSDEEP:	1536:ua1xNVegEMhMngTEWdNdDMkpnUvfxhnKmFw:N/VVRFdNdvpnUvXE
MD5:	7620A4BB7203BDD86ACFD1B79CDEC40E
SHA1:	01FED5CF88DF075ABE3C171D1DD6EB60753D4A15
SHA-256:	F477C413A140B71D406091D4B1802A93B9DADAD3BE2A0B76A9D5E2F468A14C84
SHA-512:	4ADA05548196E93C13D0ED533057B32A105ABA620C1C5372E865E1879559DCC5182E25A5BAC60BE5A12A9EB03ACE8167DFFB6EEA5AF5E0894F16A116754957C4
Malicious:	false
Preview:	.n....?...V...G.0T.A......M.).[...EiI.^.B...).J....5iB..=.j........9Z@...P.jEZ.O6!...#..u.9.W?........i.....;.$...........I;..s.~.3Q...\...L....P.-o....@.k"vA.A.....p.0.v..D&8'.E#.#....[.._>..j,k'...`E-.".....L.....hT./.5..9.s.....y<...J5Y.x..a@O..0...P.{t..C^..e........?Qa..q.6i.T<.s...s~.b.IV...DB..>..mJ"....`....Y......}.... .....'.#..7.....&.1.;....9B0.q..k\v9..:...U.....^......9o.w..eIT...).).w}i....}/_4{..uOa.@I..kU.(yt..S.^.{.[......>.xi.uLA.=T...U...O.....K..].....8...2.pJ.S..q.t%.[.t....(Z.....W..,.K1. ..}....q.<t-...~..&.. .......z,.....k..)....d..WD9......F......^D..2p..J..B.`]..'...j..o....R....$..z.7.9@F..o.:<.-.5E.R.H.9.Y..l....y......r..H..}.\|.l.....r......TXR..Y.".../M.."....>.iP.M..Z...;..e..{...JI..<.$..5<.x.../......(..D.....?.'~.:.o.dG.u[...e.....39s..A.v.....j.r..s....6..f.v.8-\\|c...P.u....M...^".Yp.~.Cf....;.._.E.......g.....n0Z..m......r.a...$rZ.=.....l.......A....:.&*..............e.DE%.P$.Q^..'.sT......~

C:\Users\user\AppData\Local\Temp\Annually

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	6.561102028551895
Encrypted:	false
SSDEEP:	3072:xCThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bL7:xCThp6vmVnjphfhnvO5bL7
MD5:	1328F91B618F403C6724498A02AA4B11
SHA1:	45D2210C6D8805C150F6C7A70BC772E8290335C1
SHA-256:	66D8CEC052236E17147BDE77CC92EEC245AE2B4CAABA7BB71EFA4350384DAB5D
SHA-512:	790766CBAAFDBA2BA45C1C846AA840215FF4EE360545A6FE25F7226F228D7FDB0C76547658C359E40F4BFCFBDECC7D33A2B39C35FE5E4B333D8E3A9E587B46BA
Malicious:	false
Preview:	$ ..o...L$T.F....D$.P.D$hWP.y.......D$d.L$TP."<..P.L$$.+...j.j..D$(PV.@.......L$ .to...L$T.cF....D$.P.D$hWP.).......D$d.L$TP..;..P.L$$.....j.j..D$(PV.........L$ .$o...L$T..F....D$.P.D$hWP........D$d.L$TP.;..P.L$$....j.j..D$(PV........L$ ..n...L$T..E............D$.P.D$hh.{L.P.}.......D$d.L$TP.&;..P.L$$./...j.j..D$(PV.D.......L$ .xn...L$T.gE...9.M.h..I.........@..\|....L..t..I8.A......\|....L..t..I8.A.._^3.[..]...U..E........x..SVW..u..0.I....@..p.........F....E..@..0........F.......S....k..Y<.u..M.......P.(....Ph0.I.S....Y....xL.Yt....I..M.P........H..\|9...D9.t..@8.@......\|9...D9.t..@8.@.._^3.[....U.........SV3.W...D$l.L$..\|$(.D$p.D$t..F...L$,..F...]..{..u..C..H...P....t..D$....3.L$..C..0...$....F.. vL..D$.V.@..D$@.....Y.L$<;.u6..t(.D$...+...>...0.\|$.f;.\|$(............u.3.......................C..0.......D$.;F.t..v....D...0.I..L$.V.gz.....u8.......D$.;.t.W...D..V.L$..(....C..0...`....v..L$..I....C..p....G....D$,;F.t..v....MD...L$,..p....t?.D$0.L$,HP....f.8\t*.u.....k..3..F.

C:\Users\user\AppData\Local\Temp\Anti

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	5.544486740707327
Encrypted:	false
SSDEEP:	768:07Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXc/mex/SGKAGWV:0klMBNIimuzaAwusPdKk
MD5:	BF5ADFDD386171EE3C4AB4D3217060E3
SHA1:	2A32738D05C2F53F6E868F2A4D412B210ADF49B7
SHA-256:	AD233B178FFFC7C982B1C9AD9730A2456BA71B3193A87909663FC6133BAEECE8
SHA-512:	9E309D1506BFCE5E1F5C573BCBC02A333CF444F4A58CC8FA9F240ED05DB3A0BC3168C26CF2BC11F7D2C0B6FDE89205C2E5E3B179CFE083142622943FBA4900FC
Malicious:	false
Preview:	..?7...Y.>.......@...P...?..[..p&>.......@......?h4.M..A>.....@.@.......?E.p.l.E>.......@....+..?.o..$.E>.......@...h...?\...*.K>.......@.......?-.?...B>.....@.@...P8..?.(l.\|.@>.......@....p!.?u...@.J>.......@...@p-.?..V...1>.......@....89.?.....5>.....@.@...<.D.?.....7>.......@...h)P.?.R`D.OG>.......@....T[.?9%....K>.......@....Mf.?.../.<>.....@.@.....q.?.....?>.......@.....{.?4..2G<>.......@...L...?....\|/>.......@....Y..?...s..@>.....@.@....k..?....a@>.......@...XS..?x(3..u8>.......@.......?v.O,ib.>.......@......?..&L.C>.....@.@.......?..}...L>.......@....X..?Lo.....>.......@....x..?-....9>.......@....s..?6FID.?9>.....@.@...8J..?....gsL>.......@...d...?....y..>.......@......?>.&.09C>.......@.......?....<.A>.....@.@...(J..?.I..V.C>.......@...`w..?..^.@.N>.......@.......?.#..%.@>.......@....s..?...M..K>.....@.@....D'.?..Q..->.......@.......?9.!...G>.......@.....6.?......1>.......@.....>.?.1..NcB>..... .@....cE.?..s..1>.....@.@...L.L.?..n.H.N>.....`.@...H.S.?.W....$>.....

C:\Users\user\AppData\Local\Temp\Bulk

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	6.698887718397176
Encrypted:	false
SSDEEP:	1536:OvI932eOypvcLSDOSpZ+Sh+I+FrbCyI7P4CZ:Ov+32eOyKODOSpQSAU4CZ
MD5:	C3DC46A18921C4DB3AEDD910A07DEA70
SHA1:	19513FD40C82B8D3D8C3B47AC22FB59137E38D5A
SHA-256:	984B47C5B1A69A5D81107AAA95BA8BF3BBCD11E2BE79521875B6392D47345382
SHA-512:	A715FED09BF2004531AF8846508819D2B07914EDE6D953F647D2C6E77CCE39A6495152D014B916A3A217A01456298FEDCA86C793F576283E22F227B2633A50BA
Malicious:	false
Preview:	..U..j..u......YY]..U..V.u...u.3..m.E...u..D#..j.^.0.MX.....SW.}...t.9u.r.VWP.h>.....3..6.u.j.P.vS.......u...#..j...9u.s..."..j"^.0..W......j.X_^].j.h..L...L...}...u...0.I.P....I..Y]....`.....e....t.j...e.........G..e...7.w.......I...Yj......M.....E.QP.RE..YY.e..u..}...j.h..L..lL...}...u...0.I.P....I...\....`....ge....t.j..d.........G..e...7.w.......I...P......M.....E.QP..D..YY.e..u...}....U..V.u...t%.~..t..v...`.I..~..t..v.....I.V.X..Y^].....U..V..\....u..u.....I...`.....t.~..t..Gd...F....t...t.P..`.I..F....t..t..u.P....I...U..QVj.j...z..j....,X.......t..E..M..F..F.PQj.......I.j..M..0.....^..]..U..QQ.}..u... ..........V......SVW.u..u.......YY..t..e...E.Pj.Vhi.B..u.j...h.I.....u!..0.I.P.s ..Y...V.M......._^..].W.~.....I....t.3....U..QQ.}..u..o .........wU..3..PVW.u..u........YY..t,.E.P.u.Vh..B..u..u...h.I.....u ..0.I.P.....Y3.V.M..0....._^..].M...t..E...3....U...u..B.....U..M.W.}...t-.U.+....:f.....f..t....u..t....t.3......f.E._]..U..Q.U.SV.u.W................

C:\Users\user\AppData\Local\Temp\Cornwall

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	6.694725617220775
Encrypted:	false
SSDEEP:	3072:iBxT/sZydTmRxlHS3NxrHSBRtNPnj0nEoXnmL:iL/sZ7HS3zcNPj0nEo3w
MD5:	F78D0D56C57D015FB7AF2B6FEAE774B9
SHA1:	196099A92B290091721ACDDD9CF614EAD573DA68
SHA-256:	9DAF5671F1AB77586E726A160BDCC5ED73DCB4CFA9797CA49FA0A12525C47175
SHA-512:	F92EB892D69A45D0B2AD1CCCD121F52EEAE8F0D16D7BB97581414A2A3C2635D4610CEADD9A54243E3F1AFEE6ADE58B616A1A149B095F07903E0C065EED23CEB5
Malicious:	false
Preview:	......@=...........3=_ ..w!t*=. ........=. ..v.=/ ..........=.0........A;M.~..M.......}......9M.......;~\|.............}.=....w..._......r......Q.....=( ..r.=) ....=...A;M.~..M......}......9M...4...;~\|.............}.=....w.t.............................A;M.~.M..?....}......;...,...;~\|..4.......E.....f;E.w...FD...........M...B.}.;.~.......}......;.......;~\|..............f;...d.....FD......U....M...B.}.;.~......}......;.......;~\|..........E.....f;E.w...FD...........M...B.}.;.~..Z....}......;...J...;~\|..R...........f;.........FD...........M...B.}.;.~.......}......;.......;~\|..........E.....f;E.w...FD......s....M...B.}.;.~.......}......;.......;~\|..............f;...6.....FD......'....M...B.}.;.~..w.....U.....j.........4...$...E..E.;.......;~\|sN.}.......t#f...E.....f#E..E.....f;E.E.u.......}.........<O.M.A.}..M.;.\|..................;.......~....Fh.............j....U4..;M...\...;~\|.......}........E.....t5..%....=....u"..O...............................U.....................

C:\Users\user\AppData\Local\Temp\Eyed

Download File

Process:	C:\Users\user\Desktop\AxoPac.exe
File Type:	Microsoft Cabinet archive data, 489805 bytes, 11 files, at 0x2c +A "Pasta" +A "Cornwall", ID 7230, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489805
Entropy (8bit):	7.998575580074661
Encrypted:	true
SSDEEP:	6144:KcdKpkewGWKVgcyN9pgw+YKoNBhfNrG8MN9MPfsN1Npao7dfeuPekK1A9jUPIVQE:rFzo2+cNA8Ff44CRYzuvIFXi
MD5:	65C3F745C55A461DD06142C202A63C36
SHA1:	0B5FFF9D5F3E1DFFF96A1BD3D557C7931836D39E
SHA-256:	545762FEF5DD3C2C1C75C62B3D90B5B9A56362A4EE9D6FA91D151DC70BD7A0B6
SHA-512:	4AF8FDBAF58F6B8E7C76CB99E6E841AF9B6A8CFEC27C2DD8EF4AFD4676C5FEE26A7AD11CAADA5A39E18BE2AC94EA54FF894ED21330CA98E6FDAEF39DB122F257
Malicious:	false
Preview:	MSCF....My......,...............>...-........l.........YSt .Pasta......l.....YSt .Cornwall......T.....YSt .Sand............YSt .Annually............YSt .Anti......0.....YSt .Registered......6.....YSt .Bulk......6.....YSt .Oo...........YSt .Literary..-.........YSt .Particularly..T..] .....YSt .Fotos.z.._.T..CK}..\TU.8~...U..`TX.cQZ.....(.X.C.......~.t&m...r<..w.m{5.]k.]...jm..0]Es..6.=4la..J...<w@.......s.=/.9.9..y...$..k(...n}..u.n......>......e._....wR...V..B.+....\|qS...v..^y1.d.)...E....+...Y....uk..[..oL..V.x.T..L.%.V.(.M.6I..P.#...../3..=O)_\..27F.V.....I......y..J.Y...V.@.QH..i..n.....r.+Qx.O`.hPW.mX.Vm.}i.B.8a...y...._...........T-.....4\|^Q.6..x..T.....(.sE>ey.#....Wvw..J....%.I....q.AO^....v..A`.._.x%......3.R.....H\.9..{XI..Cu.P......<#..4H.y.#_.?...~+.jb....HP.7S...$aDQ...q{..[Z..ZJ.,k. .A.\.Q....ecl.....'..x..]+..~..O.......us......&.J.`....R./.....\...Y..L.`(QK..t..Ne>..#.g.?B...yb.N.I.t@..}..+..2...'[?..&.d.F....u.Z....o.8I...oL...H

C:\Users\user\AppData\Local\Temp\Floral

Download File

Process:	C:\Users\user\Desktop\AxoPac.exe
File Type:	data
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	7.997742071701335
Encrypted:	true
SSDEEP:	1536:lJUWCBkM2u5QWxsHYgrbvP3ZHDs/WAP3ssXjq8tk/QsjEz2HkWz:lJUvmMjQWxs3rbHJIeAP3ssT5tkvjW8
MD5:	DE1823BEB534C23F143AF2AACEB3FAF0
SHA1:	7DDC99B637B77E62388FAAC0D85117AC1129C2BF
SHA-256:	59B181F3718636135178E83EFC905AE212BFF088F41DC99A42EEF70FE449246C
SHA-512:	0F8F4F05F2F1BFC2EA8334AFA760019D8D0248E3B1F2399D97E91612470393ECDDD67C9C558E624CFB52588335912B6342C1EB606ED7E576AB66C81886E0206A
Malicious:	false
Preview:	.{.....P..m.#..S..!.....i...V.n+@..F..;.....T........d.......a.E..].n.y.0.%]A.og..cu.....8:6..g.hK..K[..&..G.Q..k..C...."qE@..Bc..J.........`..<.../84\|.t.........5.rEQ.}...g....b.=.c.?...G.@..k}...BTM#7/Yo.8...F...`...i.`.......O...A.r.L......'.?...p.......GV..K..5%-...t.2...\....Q....n.].....)...rl...O.)M.`.k[....QU.^..l9u~.b.+Y....t....t.P7>..../..v.~//.B..._%..qe.;8...H.Z...}}.:1?...;...2?pr.Yn..7..\..<Z.(.....^m..2....t.l..........r..$K........}..-...d#6...e..n..\|..DAA@.(...f.=\|......"{..)...T....,...o..x2... ...6s..</..Q.[.....xA.ZI..{.k...X...3.'Qp.I.w\.`... 7;...eP.s..a.v...C..kx..7._....m...f.."....}+{N.........-#...6..\|33..u..tQ..M..$&i.Al..N.U.[.{.;q.../3d.ZU a-@-..qh.l;.Z.F....^...M.=.F2...@...>.R...%.]..D.b.]S.h}.?.8...W.ai.....N..W...].S..B..D..v....._.e.....A.-.mg.b.3r=..*..I...L;.t"Iy.{V...@..Yk....\|.[..1...J.v./..mx.".:.u.C........R. ..E.s.1.x)..t...9s.O....-0D...,.7g..%......-.R...h..L..;..4&f....d.fER,......3..!..5......

C:\Users\user\AppData\Local\Temp\Formed

Download File

Process:	C:\Users\user\Desktop\AxoPac.exe
File Type:	ASCII text, with very long lines (859), with CRLF line terminators
Category:	dropped
Size (bytes):	26258
Entropy (8bit):	5.119089347572229
Encrypted:	false
SSDEEP:	768:HZZSBXexuTF0OMDdtmRPLStNsReSR7bUi87:H3SZ0JDfmRPmG/Ui2
MD5:	B97F09CB29112C803D88134048194ABD
SHA1:	FC1AA1BD4CAD431030D48AEC77AFF71BFD26CBF4
SHA-256:	AF16378DE6BFB910FFD9681F29F57CB0975393010875B55CBFBE7DB49796FF7C
SHA-512:	8147FAEF13783B1429DA395E7C30A415A6050411EA1F81C60A1C0AB5D8DCB6BECF03B5A276D895D9E994A025909F6839875044D3B30ED37EDC74582A980584E4
Malicious:	false
Preview:	Set Bermuda=b..gIShade-Stroke-Plain-Melissa-Sensors-Combat-Complexity-Wish-..IoLQuotations-Candy-Hentai-Those-..nHPeKind-Nominations-Pacific-Masturbation-Humans-Diff-Coding-Integrate-..ZuBatteries-Firmware-Uk-Buildings-Sri-Exempt-Prefer-..VdTmBridal-Hostels-Educators-Confidentiality-Signal-Acknowledged-Backgrounds-Representation-..pXOs-Resolve-..Set Affects=4..twOutcomes-Readers-Begun-Arbitrary-Ld-Hygiene-Bobby-Committed-..waxFridge-Beta-Ate-Vermont-Reputation-Loans-Heavily-Improvement-Lance-..xzEQModifications-Ciao-Houses-Short-Till-..oYElectro-Filtering-David-Manuals-Stakeholders-Lines-Vector-..qqGulf-Prohibited-..Set Deliver=W..DYOgEr-Solely-..tDScModerator-Attended-Nationwide-Started-Many-Verde-..lJDACoaches-Knowing-Jose-Hydrogen-Allen-Actors-Josh-Trails-..GLNUVarious-..LzPapers-..Set Hired=E..mJJewelry-Relevance-Husband-..MUGGovernment-Granny-Employee-Md-Bob-..pgxRRecipe-Make-..jnScotland-..PAYpChallenged-Story-Governments-Signals-Representations-Sunrise-Myanmar-Taxation-..fxFetis

C:\Users\user\AppData\Local\Temp\Formed.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (859), with CRLF line terminators
Category:	dropped
Size (bytes):	26258
Entropy (8bit):	5.119089347572229
Encrypted:	false
SSDEEP:	768:HZZSBXexuTF0OMDdtmRPLStNsReSR7bUi87:H3SZ0JDfmRPmG/Ui2
MD5:	B97F09CB29112C803D88134048194ABD
SHA1:	FC1AA1BD4CAD431030D48AEC77AFF71BFD26CBF4
SHA-256:	AF16378DE6BFB910FFD9681F29F57CB0975393010875B55CBFBE7DB49796FF7C
SHA-512:	8147FAEF13783B1429DA395E7C30A415A6050411EA1F81C60A1C0AB5D8DCB6BECF03B5A276D895D9E994A025909F6839875044D3B30ED37EDC74582A980584E4
Malicious:	false
Preview:	Set Bermuda=b..gIShade-Stroke-Plain-Melissa-Sensors-Combat-Complexity-Wish-..IoLQuotations-Candy-Hentai-Those-..nHPeKind-Nominations-Pacific-Masturbation-Humans-Diff-Coding-Integrate-..ZuBatteries-Firmware-Uk-Buildings-Sri-Exempt-Prefer-..VdTmBridal-Hostels-Educators-Confidentiality-Signal-Acknowledged-Backgrounds-Representation-..pXOs-Resolve-..Set Affects=4..twOutcomes-Readers-Begun-Arbitrary-Ld-Hygiene-Bobby-Committed-..waxFridge-Beta-Ate-Vermont-Reputation-Loans-Heavily-Improvement-Lance-..xzEQModifications-Ciao-Houses-Short-Till-..oYElectro-Filtering-David-Manuals-Stakeholders-Lines-Vector-..qqGulf-Prohibited-..Set Deliver=W..DYOgEr-Solely-..tDScModerator-Attended-Nationwide-Started-Many-Verde-..lJDACoaches-Knowing-Jose-Hydrogen-Allen-Actors-Josh-Trails-..GLNUVarious-..LzPapers-..Set Hired=E..mJJewelry-Relevance-Husband-..MUGGovernment-Granny-Employee-Md-Bob-..pgxRRecipe-Make-..jnScotland-..PAYpChallenged-Story-Governments-Signals-Representations-Sunrise-Myanmar-Taxation-..fxFetis

C:\Users\user\AppData\Local\Temp\Fotos

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.587823174450351
Encrypted:	false
SSDEEP:	1536:3+tKA3QkvyNf7Xw2U0pkzUWBh2zGc/xv5mjKu2IwNnPEBiqXv+G/UXT6TvY4647:nA3laW2UDQWf05mjccBiqXvpgF47
MD5:	535844FAF7A8BDE1B4A9904D169A13CE
SHA1:	BE1DEE0C71D701A14B4A322D287C7BF46110F57B
SHA-256:	1A8CA0ACF67CBE526CC020D6A080BF8C208B60EF1981AD2F1D92867323BAF7A5
SHA-512:	7267FCD1DAED9B4E735C8B976D05AACF69CDB7EFBF9CE8C293973805C389D2BE800B738E6CDA58B4FD563D307DCEB2D501DD77BF18CF600F17D79986407A443E
Malicious:	false
Preview:	M.k.I.....M.........M.........M.........M.....f....M.......M...J.....M.X.H.....M.........M.........M.........M.....f....M.......M.h.I.....M...H.....M.........M.........M.........M.....f....M.......M...I... .M...H...$.M.......(.M.......,.M.......0.M.....f..4.M.....8.M...I...D.M..H...H.M.......L.M.......P.M.......T.M.....f..X.M.....\.M.0.J...h.M.9.H...l.M.......p.M.......t.M.......x.M.....f..\|.M.......M. .J.....M.o.A.....M.........M.........M.........M.....f....M.......M...J.....M.P.A.....M.........M.........M.........M.....f....M.......M.(.J.....M...H.....M.........M.........M.........M.....f....M.......M...I.....M.h.H.....M.........M.........M.........M.....f....M.......M...I.....M...H... .M.......$.M.......(.M.......,.M.....f..0.M.....4.M.,.J...@.M...H...D.M.......H.M.......L.M.......P.M.....f..T.M.....X.M...I...d.M...H...h.M.......l.M.......p.M.......t.M.....f..x.M.....\|.M.p.J.....M...G.....M.........M.........M.........M.....f....M.......M.\.J.....M...G.....M.........M.........M...

C:\Users\user\AppData\Local\Temp\Licensing

Download File

Process:	C:\Users\user\Desktop\AxoPac.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	7.997375754784315
Encrypted:	true
SSDEEP:	1536:MEFy2PU2tyV/uLvSLovJhA9CZI3pU8bL5jQSQU:CITPvRRhWN5Tbd0SF
MD5:	BF6934C1B558CE7E02F09D7B3CF88F99
SHA1:	661B51E320F7D8AE38A56C18E2877203CEF8BAED
SHA-256:	F214E02773E091A978572AAE65E6D9D57CD2291D7D8CBC974CDFE8F6CDCAE207
SHA-512:	BC9F6B93F67DC5CCBDFC70C1CA7A382D06BA290A24B1C9AEA389A4B8FC7BA03232A60DA56C26C7F6F3F018EA9F027BB7EA8FCFB226E2494477C7C0676D9044B7
Malicious:	false
Preview:	...Z..v....:3R...=.50........5.._=..).B.+`...9..\gL....-N .q#.t...C@.].4...-.Le. \....E..8!..<D^..B...Q.......Q...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R{...B.?.'.F...h.............?U..D.j?U..D.jkC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..}.'..,P..Myn.2..t.W....d..........?U..&..j?U..D.jm.....\|...5...x..2(.U.j...."g.\|#.A.....)..h...}.......sX...=....O..ga.e9$...g>.o..\|V./.@..L.`...;_..... .xbJ.8..].2.>..w..]:.JfDW.L..}lnx....c.5b.\|z...K.@.6.,<.N'.....&.nK.(...R..AI.G..+..x.!.`4.......=....J.w8V_.....%\|..M2...V....R...0.......c..O..0..z...v....\|cKx.JP..).e.x.GB......B...Q..[...!..>..\|...._.].b1..........`&p.PD..LJ.s.L....p.r5....P..K.d..B.c...f...n.

C:\Users\user\AppData\Local\Temp\Literary

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	6.65539151436705
Encrypted:	false
SSDEEP:	1536:AiKwtk2ukC5HRu+OoQjz7nts/M26N7oKzYkBvRmLOA:swS2u5hVOoQ7t8T6pUkBJRA
MD5:	2E6606937DD44A1379BF877F8D870627
SHA1:	67E9AB2485486FE7B24B44EB803865BA93CD38D5
SHA-256:	76443106A0E909C811DF6263851463063E32659320C9BB92FCA76733C765DBAC
SHA-512:	61F38F675FBA515B5E096F546E8BAEF34B6739B7FF942635DF2DD651322CBEC1D09134C2A03DBA53FF39148B9533EEB0DC03F7AB7308D415CE9BE752CED4BF2B
Malicious:	false
Preview:	..h.wL..u....YY..u..E......h.wL..u....YY..u..E......3..M.W.D...j0Yf9.uqj..M..2...f.8xt.j..M.."...f.8XuQj.W.M......U.M..m...W.M.......}.j0Yf9..E.Wu.h$wL...h,wL.P.R.......E..M.P........u......Y..y.3..u..u..4..!K.....YY..t.F..c\|.u...c.u.u:j..M.....M....P.^...................j..M..a...W...P.n....E...H!K..... K.uLQ.M.......................E.... K.8].t.j....}..t.j.P.`.......WP......................$...F.j..M..$.....t..~....d....]..t..~....T....F...@....E..P.j....0...j..M.......E....u(.E..P..........~........j..M......F...E..P. .........~........j..M......h.....M.......t..~.........k....k....~.........F......h.....M..H.....t..~.........F....../....~....p....F...\....~....]...j..M.......F...I....~....@...j..M.......~....*...j..M.......F........~........j..M......F........~........j[.M......F........~........j[.M..{....F.......~........j\.M..^....F.......~........j\.M..A....F...~3.9^ t.j.W...o....v8^.u.j..M.......E..P......W.M....f9.t2W.M.....M...0...P.

C:\Users\user\AppData\Local\Temp\Needed

Download File

Process:	C:\Users\user\Desktop\AxoPac.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.996451000277983
Encrypted:	true
SSDEEP:	1536:lJ6sLfvKlW0xXmOZ53vSTC2HYi0x+FvsKDtwHk1qS:lgE3Kl7Z5wt7lvfDiHPS
MD5:	28CA5CCC0A2D08792F33418EAFCF7271
SHA1:	2A9D35951659FA9EA39EDFBEA7F7410B3D9ABF40
SHA-256:	53DB87A56610A1F436AAE253FE68F60F0F315A21C73E01A85FCCBC39D589285F
SHA-512:	C5F8874F0B311E0EFAEB2ABDA9B578CD1A2031E8BA7D19AA552FC716F250236F0B0926944182F72E0CAF562D2F851E51427B936FACE29CC2D431638E0871B667
Malicious:	false
Preview:	..XjJ:....Z.v\|.p).Q.....\|&.S.W.z...A.<n9.tjW....r7.\|AU.u.{.W....e..qU.lA.2.#..A......@:.fW6....1...:12..x..C..9.]..g.........Q.T.vn.......t.d{....._.l.yg...Sq.}.....Sj.....q..jg.J..V~.a.v....5y.....N........>M^?7.e8..j....c.....3......I\.e&`T...K:u....._>....}..Y~\.~d..{............'6.~.)..D.L].......tJ.~.;..Y.6...:D.k8.(.........{....]>./.........s...".C.@."...\|.u..G..XSoKXM.\.5..'G..ff.... ....N.y5..WE...)........T~..Gi..[Y..K.!.L.S.S..........N\|..F.me..c..L8A..G].../..\z.........A.@Z...!.;Ju>..=.."t...;.4....zYj...V.........X.,u.)...:../qp..........n.9.....5....3.A}B.Y...G>v..%/r.....U..Io.z.+.5v...)..@......X..S....}...m2r.lKYh..j..].F....w.....t/n0....2..v.....]+Q..D......Yx+.I..;\R.s.-4.j.sd..}...-....&....7..PQ...l...O..Z..1..H.A.....,.$7 l...u.:...Bo.b....G\|..q"H6.H...[.SF..:.....YS...9..f...*j...V..u.@+8..B.fC...z.J..."=...WF...X....y........T2.A"7.O..hk.T.....7.#...]..2.+=....P.6....U..w..N...\{....p;5+..cm.F.wi.7.i.^....B..

C:\Users\user\AppData\Local\Temp\Onto

Download File

Process:	C:\Users\user\Desktop\AxoPac.exe
File Type:	data
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	7.9970124240630485
Encrypted:	true
SSDEEP:	1536:emW9tVrIo5h14xiwtT/9aqHSxiXdtAOakp5:3AtFNmxpHSkvAOF5
MD5:	D3B7C66AE712EB0B219E6B85322503AF
SHA1:	18DBC8D722ED8FD5C7B3ECAEF2CA06B9ECCEB617
SHA-256:	A9B80F28CAEFB283C1937C5CA5375B5BC70911EF9D722806F85774020B3C75B8
SHA-512:	372C794F13402A4DC6BDBA077422B169FDF1440E4EF759071D884B8E2C36B256F475C074B6C689C47D625B000B08DCE2DA195BC236245FC61CC640928BFDD844
Malicious:	false
Preview:	...S\4"......x..Up..y,.@.J....}........%.w..`..^C.."AX......E.~.ca.t..f.kce{....E..f...d&..m9../......L&.j....v..s...1..u.mA..5>.ve.v...y..f....)9XU...L.W5C...."..t'..4P-_)..-...7...."..H).....N.C.K.......u....cHu_>....j...l. .<..].....l.........{&...`...V....1....0......?.....z...C.Q5..LaA.Y..:..$.Z.w..a.ud..$..J...e..Q.]......?...!.Lo#...U...u..]'.>>O..+.2.ui....<.(.Y.e(.D_......H.Pi.Hc........N`.s.qcO.J....noS~.$.>M.a....T..-.@.\|..z".T...ff.v..MK..;. .f..~....YQ.z>......i4..~....... .....O.......=....Kr...".\.."......@..\....25-.taK........)..l.K#wO.!.......{.D..-B8$.Xk..g4.[....Uq0#.JM.......V....&..:...M.\.0../.=.....L....2.6.Z....<.2.V..f4..?Q.$.f....B.v..)..f...,V) .Z.W.T...%..N .r.......>.R.x'."5).i..+.........`0..0.9.2.nA:..{..g..(...h....P......,f.&~!..........D.\...<.(..^....s......#.e..3<.!.Vn6V..3..7.kN. e)..>....e.G.?.qN.1ik.".3%._@)Rg-..t.1.0...U.q...r...~.\=.An..`.....M.w.8%....9..K....s.^..X.I.......$...)..25\|...N.A.

C:\Users\user\AppData\Local\Temp\Oo

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	6.623400971929916
Encrypted:	false
SSDEEP:	1536:Hi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7QnswIPi:W0Imbi80PtCZEMnVIPi
MD5:	6DCF4F25B3C703A737946CF8A168CF1B
SHA1:	78E33D284B3FA5B13DF303B999C1998BBE95448D
SHA-256:	BA7113F091C2215A439E290B70102B7C5A70CCFDEDF59915BE0F1D1B57A3DFAA
SHA-512:	9366665348CB2CAE0D263C1DE068658F63EE2043E7BE8B5767FDD21550C8087D0D03CD3D1D4C900923A19A6F6B30F38FA08121CE1E2E71B9D11E65F983C7C605
Malicious:	false
Preview:	...t.9...M.u%j.j...}..S...M..BZ.....9...M.t..5..M...t..E..+.PQ......E.YY..xH9.tD.4...Z..Y.M.8].u..E.........D.....A9..u.j.QV.HX..S....Y........tX.P8].........E..H.;............?......j.QV..X..S...Y..............M....E.....\...5..M.9].........Q...A..u.+.j..A.P.E...\|....YY..tG.u..u.V.aX.......u@.M..+E.A....E.......Y.#.PV....I...u..."..........V..X..Y.a...SSSSS."W....U..QW.}...u.3.....3..9.t..@.A.8.u.V.A.j.P.s{....YY..te.?.tPS..+...Q...A..u.+.j..A.P.E..E{..j...;.X......<;.t,.7.u..4;.W.......u....9.u.[j..WX..Y..^_..]..(W..3.PPPPP.qV....U..SVW.=..M....?.t.].S.6.u..P>.......u......<=t...t.....>.u.+......_..^[].+.......U..]......t.I.....#M.....%.#M......U..Q...L.3.E.W.}.;}.u....WV..S....t.......I....t....;u.u.;u.u....,;.t&....~..t.....t.j.......I...Y....F.;.u.2.[^.M.3._..8....]..U..Q...L.3.E.V.u.9u.t#...W.>..t.j.......I...Y....F.;E.u._.M...3.^.7....].j.h.L..N7...e...E..0.q\..Y.e...5..L.....35.#M...u..E.............X7......u.M..1.{\..Y..U.....E..M..E..E.E.P.u..E

C:\Users\user\AppData\Local\Temp\Particularly

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	Matlab v4 mat-file (little endian) \377\377\377, numeric, rows 4278190081, columns 16777215
Category:	dropped
Size (bytes):	142723
Entropy (8bit):	5.9746259108439075
Encrypted:	false
SSDEEP:	3072:z6whxjgarB/5elDWy4ZNoGmROL7F1G7ho2kOb:z6ggarZ8aBZ2GmRq76tl
MD5:	F71A1A5DEE8DA55A4A481CB9BC8FA88F
SHA1:	62FF71602C66E32CC1FDA6057ADAAC9A2648B68C
SHA-256:	A9255E188D524CF604BBB3004E68310CE1014B6A6B712C3903067D5E44A27442
SHA-512:	8C936C344DBE6F56165CA5DD192B156FEED4D0BCD3C8B4DCB8D6BD47B884EE33F011A5DB5694342CD3143542A2051D9C0D5132ED35D3BD84CD0E069F94F9B103
Malicious:	false
Preview:	....................................... ...............................................................................................................................................\.P.{.N.d.}.....\.P.{.X.p.s.}...\.p.{.X.p.s.}.......................................................................................................................alpha.lower.upper.alnum.ascii.blank.cntrl.digit.graph.print.punct.space.word.xdigit.\.P.{.X.w.d.}...\.p.{.N.d.}.....................\.h.....\.P.{.L.}...\.p.{.L.}................MARK.ACCEPT.COMMIT.F.FAIL.PRUNE.SKIP.THEN..\.P.{.L.l.}...............................M.....=.%...N.+...f.5...\.;.....C.....L...].S.....[.....d.....j.....l.........B.....g................._.....C.........................................>.............................h.....O.....i. .....).....2.....=.....D...j.L.....R.....[.....d.....h.....o.....w.....~.........P...........Q.....R.....S.....T.................D.................k.....l............. ... .$...!.*...E.1...".7...m

C:\Users\user\AppData\Local\Temp\Pasta

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	6.34174118787604
Encrypted:	false
SSDEEP:	1536:y1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdZPp7Ha:yZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/E
MD5:	5061B2B2DD18E021DACBCDE56EF97219
SHA1:	1F131A33271E5398542F2B554BE0D2F8CA30022D
SHA-256:	88FE8B773F008AB6EAB880A3732D209471A69C6C0B94A1750D67A48E1E0A01F0
SHA-512:	0C4D597C438ED871D700B1B8858BB7B232F3F14B5AA3292EB5055470A03A6C3114942BEAA41FE676FC29881C6CE7E139F228AE93F8E2AD309CC89624ACA2B4F8
Malicious:	false
Preview:	.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.\|$..............'........P............H..............a...WQ.P....7..<.I..t$

C:\Users\user\AppData\Local\Temp\Registered

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1754
Entropy (8bit):	4.769760463552221
Encrypted:	false
SSDEEP:	24:JyGS9PvCA433C+sCNC1skNkvQfhSHQU2L55e1yb/uBx39lt6DhBhhB4+JvUZ:i9n9mTsCNvEQH5O5U1nPKrhBzMZ
MD5:	C473C6ADE2F605256CAE25098DA4E530
SHA1:	0CA1B00ACC1501D75AA9F3C2B1D8B7DE726820AC
SHA-256:	0B0E41C5F3D94D7EB083FC42B5400807E3A4E708D5CC984E93F04A1F6075A8B9
SHA-512:	27EAE4E083A6ECD5C6480774F0FCC63844CD18E6AEEDA2C4F67AD017AF63D694A170BE54FF8FA2D2B51A9169F712C7EA97D9242D3492F78BECCBB12FE1953965
Malicious:	false
Preview:	Avoid........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Sand

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	6.215618728158605
Encrypted:	false
SSDEEP:	3072:qzW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz084:qzWWt/Dd314V14ZgP0JaAOz0j
MD5:	69D2DB1C27EDB1ECA21EAD3C10A11F16
SHA1:	8A90E068DF94C8F20DB4D3F9327A6C3DEB1D98CF
SHA-256:	CAFD4852080D483F9F0CBB22655D337C2B6CDE8544D48475ABBC39AB483DDBB3
SHA-512:	096EDFD896C5F4F647CA759A68EEE061F5AAB546BA5B550E0350711AD39F2E9CD08A29EE32AF958370D6594C41A2D769C2048B67A5359A82B9E6744F6D92007C
Malicious:	false
Preview:	.........]...D$...u......#..C......(.......0.....C......3..j..t$..H....M\.........c..._^3.[..]...U..SVW.u.................23..y'...Q..L2.8\2.t..I8..A..D2.8\2.t..@8.X.3.G....4.I.j..._.u.........~.3._..^[]...U..V.u.......j...........By...Q..\|2...L2.t..I8..A..\|2...D2.t..@8.@...u........&..F.............j.j.j..0....I........l...3.^]...U..V.u....9...j..........@y*...Q..\|2...L2.t..I8..A..\|2...D2.t..@8.@...u...."....&..F.....3.^]...U....QSVW.}...W.....3..CS.".......y=...Q..\|2...L2.t..I8..A..\|2...D2.t..@8.@.............k%....t..u........&..^..g._..D$........v..G..H..n....D$....v..O..I..Z.............L$...M.......~..y.......j..0....I....,......u._^3.[..]...U...$SV.54.I.W........]...!...E.P....I...u>.u........3.3.B...V....H..D9.8\9.t..@8.P..D9.8\9.t..@8.X......E.PS....I...P.E.P.......3....E.)E.E..M.)E...[..3...j.GWV.Nb...M.E.3.M.SWPV.].}..$h......M..Y....E..E.3.@.].PP.E.E.PV..g......M..3....M.2...!.._^3.[....U.......SV.u........j....3.......L...I...Y..A...y...t..@8.

C:\Users\user\AppData\Local\Temp\Two

Download File

Process:	C:\Users\user\Desktop\AxoPac.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	7.996547528057622
Encrypted:	true
SSDEEP:	1536:6+1yApCt1j4R7MKCf0wLN0pOkrgm8T9zQoFBVW6ZA:6+1yECDE9fCf1LN6OkUmkzJzVWn
MD5:	B6312396CE7741E6844B4E82A7A6EEA0
SHA1:	0C3202A4F249AD5F319D0602E191A02C8B0EDC50
SHA-256:	57FD2BD796A5F34BD5300EE0281FA6CB82590CB5CB5D764C83483EA88587448E
SHA-512:	98C1CE8BF444A034D73EA45B94D41BE7255F28477744DC26934C91A830DB51DCDEA9C1D6023661F73959364FB6F04B07BAA1F0954FB2D441E4B9C6EF0BB9642E
Malicious:	false
Preview:	.a.....M.QBPL.../......fKJ.N.k.T.t\|$.u...}.>..=,An.>5...f...+(......u.Ja....>.Je.0pm.gEX..&.....;.a.q.....q._..7B.]........#VR.....NgF]A.g.M...q............y2.(,>.G..DW.r..?.:56.VO..e.+.p......2.< _....".I..Sd.'......Q...V2.:..G..d.....4.e..l....{.Ya.....,u......\........l..f.i......1S5..d.N.>$.}....lrT.-L.D...IK...o....7"..\|.8..b[.Z..........&.!......j6^.(.:-K..b.Q.B`Bi.M....x[&.k.4"..p+..m...4.z.7B%R;.\|mH...[P<E..V[7\r..5.J.3....L.W.z.o.}X......<G...i...>.[..........&ff.nm....I..ei.G+..q."....[.....F...9?..,B.."zY..'......-.U...FS8.^)...jJ.#e .\|7.2.z:^[J.!...:.'2..L...}.sH.......$.r.....c".H....\|.<..QY...S..UfZ.kg......"A.'.[(...m......L./6..(D)(.Q.K....=...-H2..0.+.......A...P.IS.~...B.5....7.e.$......[Y..,.x.V.3n@...Sf..z...d(.l........R....6Q+ ..+..w.tm.G..h.r.=.8..?....72O...$..Z/.;.....F..Ezo..64,.......#"z6a....:+F...../Q.^fk.X....V]).g......=dZ?.v......./O4-....gM...........9{2.[.$_..H.z1C..+(]..6......r@2.....}.N.,......./..E..

C:\Users\user\AppData\Local\Temp\Wing

Download File

Process:	C:\Users\user\Desktop\AxoPac.exe
File Type:	data
Category:	dropped
Size (bytes):	75580
Entropy (8bit):	7.997882164645132
Encrypted:	true
SSDEEP:	1536:cHYmYXACM6B2FwrXJkF5Kk8Az4HeaaYdbJPVpbquJOmBpDWlWrGK6bJYkeoKYGyD:ccwCnFkF554h5bJPHBTGHbekeoKDbknj
MD5:	142F9166926714853DA38B4D2389F034
SHA1:	D84B31151E9B0DDEBF308F98319B3F6F08F6CE43
SHA-256:	C6BA3DCBCAD05CB79DE943653E494CE306A11321AD332CA725C70403F00F9544
SHA-512:	838ECA01FE8AD7701422E6F90FC3ED1585EC8AF00B95B1EA77BF9B1A8BBD69DDD9EDB9550E1013158D91AC798987636D4935A8282AF276CD7EA5FB1C1EAF811E
Malicious:	false
Preview:	.g....).ED.g....L...\^3[0.....v.3..h._5....Z......8PlQ......Z...........h/z.q@D......\|....R1....^.m...1Y..Hc.......V...%.........8.._....%.......9-j&....k..1...'8c...!.wY3.R..t+!..VT.4,...ky..#.X.pg2Bt..5.B.#8.-...=..2.......\q_."..J..........."#^}u....."\....".Q...w.~.d........7Y........R..u.......EPmV....-L..~s...z.}..?..4.P..n.G..c.ez.!%.../.7Y.d..Z..a.\|._aYt.P.X.......l..Q9.....K1L....;....)....O.4v.nl.9{t^q.....".Z..$F..E`P...9.q.Ds=8..6..s...o.....rm.,.k...Pv........G~iL)d.LR.[V.m'\|.....<........:.k..M......e....w.$.....U...pY2....Q..E?. _.!......\|1......a.3...."...."..8.ip........*..F....r..Br...,...1+/.(...m.u%.].GJ..5.......Z.Splk5.r....$.jt.8.Q.o.b3.S. ..8.}."........)...S./.....&...NK.c.web....`.]....j....X...[I.FS..T.. ...t.H.g..}.5%.........._...7:8....4..8.>.p..]....(....+H_.6.Ce..B...0.vX....,.0... .2..}......6i...,...t!..-.E.rhsJ.(.+=..D!?..}.v...s....U./.S.x1U.z:........h..............Jf.X..1.a..z...2~B..L...c

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9789979060068905
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AxoPac.exe
File size:	1'608'397 bytes
MD5:	cdc969b4443762c7355fe3d7d2cd67dd
SHA1:	1f1c77a921532e177e5f1b624fb8d8fbb8e35bc8
SHA256:	131313b1f68179ad8df9d3bafc0f14c07abb2f3652067c4c1c6d0e0574fa0d54
SHA512:	4125d3d5e83a8655612e4acdd596c97bbd444675be9ff70a3edb743888f953a076e7d0cb562e321f0559cad09cd0a1ba85c2219e0f193fd748f6771f1e4fbbdc
SSDEEP:	24576:r4EmlVpeXSys1fCPhHWdZg2a+lN8n0PGtlXPHpP7BYVkVSoi:cEmlVpys9CPhHWLFlen08rxMoi
TLSH:	3E7533D16F320069F4B71F71367AC322E27174330BB5E2317368866CAE65983E6747A9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	f0e4e16161606170

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	03/11/2023 00:00:00 04/11/2025 23:59:59
Subject Chain	CN=Adobe Inc., OU=Acrobat DC, O=Adobe Inc., L=San Jose, S=ca, C=US, SERIALNUMBER=2748129, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	464C015DAA50884AB4DD5502E6B164B0
Thumbprint SHA-1:	96B7B1EF175BBA4BDE33A05402134289B28B5BCB
Thumbprint SHA-256:	ABC429325881B54BEC561B7B5A635E0E0AC9C94742F1324EBE5EB9AF6AE0CCC5
Serial:	0D1A340F78D7D000E089FDBAAD6522DF

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F26F129208Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F26F1291D6Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F26F1291D5Bh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F26F128F65Ah
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F26F1291A31h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F26F128F6E3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F26F128F65Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x86ca2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x186135	0x2998
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x86ca2	0x86e00	bc12b5e197446a7c73992ca2a1f63cb7	False	0.9879228452270621	data	7.960941227619659	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x187000	0xfd6	0x1000	cdb4b9204242cf15b71aa9a969092457	False	0.568359375	data	5.326714399664844	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x100298	0x78a25	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	1.0000890477356577
RT_ICON	0x178cc0	0x77e5	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0005212914996904
RT_ICON	0x1804a8	0x285e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.001064447455003
RT_ICON	0x182d08	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.6045565500406835
RT_ICON	0x185370	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.6550546448087432
RT_DIALOG	0x186498	0x100	data	English	United States	0.5234375
RT_DIALOG	0x186598	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x1866b4	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x186714	0x4c	data	English	United States	0.8157894736842105
RT_VERSION	0x186760	0x26c	data	English	United States	0.5193548387096775
RT_MANIFEST	0x1869cc	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T02:17:03.704581+0100	2058514	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wordyfindy .lat)	1	192.168.2.4	65385	1.1.1.1	53	UDP
2024-12-24T02:17:05.267495+0100	2058515	ET MALWARE Observed Win32/Lumma Stealer Related Domain (wordyfindy .lat in TLS SNI)	1	192.168.2.4	49743	172.67.184.241	443	TCP
2024-12-24T02:17:05.267495+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	172.67.184.241	443	TCP
2024-12-24T02:17:06.430426+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49743	172.67.184.241	443	TCP
2024-12-24T02:17:06.430426+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49743	172.67.184.241	443	TCP
2024-12-24T02:17:07.383927+0100	2058515	ET MALWARE Observed Win32/Lumma Stealer Related Domain (wordyfindy .lat in TLS SNI)	1	192.168.2.4	49749	172.67.184.241	443	TCP
2024-12-24T02:17:07.383927+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49749	172.67.184.241	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 02:17:04.044841051 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:04.044907093 CET	443	49743	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:04.045015097 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:04.048285961 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:04.048305988 CET	443	49743	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:05.267404079 CET	443	49743	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:05.267494917 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:05.286935091 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:05.286955118 CET	443	49743	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:05.287787914 CET	443	49743	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:05.336932898 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:05.681361914 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:05.681410074 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:05.681543112 CET	443	49743	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:06.430428982 CET	443	49743	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:06.430584908 CET	443	49743	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:06.430704117 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:06.432795048 CET	49743	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:06.432817936 CET	443	49743	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:06.438535929 CET	49749	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:06.438565969 CET	443	49749	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:06.438690901 CET	49749	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:06.439007044 CET	49749	443	192.168.2.4	172.67.184.241
Dec 24, 2024 02:17:06.439019918 CET	443	49749	172.67.184.241	192.168.2.4
Dec 24, 2024 02:17:07.383927107 CET	49749	443	192.168.2.4	172.67.184.241

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 02:16:16.973886967 CET	49845	53	192.168.2.4	1.1.1.1
Dec 24, 2024 02:16:17.206331968 CET	53	49845	1.1.1.1	192.168.2.4
Dec 24, 2024 02:17:03.413811922 CET	51095	53	192.168.2.4	1.1.1.1
Dec 24, 2024 02:17:03.700470924 CET	53	51095	1.1.1.1	192.168.2.4
Dec 24, 2024 02:17:03.704581022 CET	65385	53	192.168.2.4	1.1.1.1
Dec 24, 2024 02:17:04.038405895 CET	53	65385	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 02:16:16.973886967 CET	192.168.2.4	1.1.1.1	0x6e5a	Standard query (0)	GBXYzxvXwTFqwDeYCWLngdSLgvXMN.GBXYzxvXwTFqwDeYCWLngdSLgvXMN	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:17:03.413811922 CET	192.168.2.4	1.1.1.1	0xf31e	Standard query (0)	obtainableruun.click	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:17:03.704581022 CET	192.168.2.4	1.1.1.1	0xe021	Standard query (0)	wordyfindy.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 02:16:17.206331968 CET	1.1.1.1	192.168.2.4	0x6e5a	Name error (3)	GBXYzxvXwTFqwDeYCWLngdSLgvXMN.GBXYzxvXwTFqwDeYCWLngdSLgvXMN	none	none	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:16:28.054861069 CET	1.1.1.1	192.168.2.4	0xd127	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 02:16:28.054861069 CET	1.1.1.1	192.168.2.4	0xd127	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:16:28.054861069 CET	1.1.1.1	192.168.2.4	0xd127	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:16:28.054861069 CET	1.1.1.1	192.168.2.4	0xd127	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:16:28.054861069 CET	1.1.1.1	192.168.2.4	0xd127	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:17:03.700470924 CET	1.1.1.1	192.168.2.4	0xf31e	Name error (3)	obtainableruun.click	none	none	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:17:04.038405895 CET	1.1.1.1	192.168.2.4	0xe021	No error (0)	wordyfindy.lat		172.67.184.241	A (IP address)	IN (0x0001)	false
Dec 24, 2024 02:17:04.038405895 CET	1.1.1.1	192.168.2.4	0xe021	No error (0)	wordyfindy.lat		104.21.19.35	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

wordyfindy.lat

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	172.67.184.241	443	4296	C:\Users\user\AppData\Local\Temp\296336\Essex.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 01:17:05 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: wordyfindy.lat
2024-12-24 01:17:05 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 01:17:06 UTC	1120	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 01:17:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4t14ghg6otpahtbr7va7c5pvbr; expires=Fri, 18 Apr 2025 19:03:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f4uZb8E1mLpxdyAcrp3pxTDs1UGIXQtekkitUF8ZeN2TXCHvODF5xkbmyt7g3ZjDvqvx6e8hsaCPfm1BjuKzyFx9jw4xkwtSBEF5qTbuK0jAUUJTYWb4wo8uwsKmKAhwLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6cbfef7ff84314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1718&min_rtt=1711&rtt_var=656&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2833&recv_bytes=905&delivery_rate=1649717&cwnd=188&unsent_bytes=0&cid=24acbd4132c2bbe6&ts=1176&x=0"
2024-12-24 01:17:06 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 01:17:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:16:07
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\AxoPac.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AxoPac.exe"
Imagebase:	0x400000
File size:	1'608'397 bytes
MD5 hash:	CDC969B4443762C7355FE3D7D2CD67DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:16:08
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Formed Formed.cmd & Formed.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:16:08
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:16:11
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x8c0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:16:11
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x1d0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:16:12
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x8c0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:16:12
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x1d0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:16:12
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 296336
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:16:12
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Eyed
Imagebase:	0xf80000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:16:14
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Avoid" Registered
Imagebase:	0x1d0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:16:14
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Licensing + ..\Onto + ..\Needed + ..\Floral + ..\Two + ..\Access + ..\Wing j
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:16:14
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\296336\Essex.com
Wow64 process (32bit):	true
Commandline:	Essex.com j
Imagebase:	0x340000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:16:15
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x80000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	25

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427576,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

NCRC, xrefs: 004039A8
NSIS Error, xrefs: 0040390E
\Temp, xrefs: 00403A47
~nsu.tmp, xrefs: 00403B23
SeShutdownPrivilege, xrefs: 00403C42
Error launching installer, xrefs: 00403AA9
_?=, xrefs: 00403A90
/D=, xrefs: 004039D2

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

CreateDirectory: "%s" (%d), xrefs: 004017BF
Aborting: "%s", xrefs: 0040161D
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Rename on reboot: %s, xrefs: 00401943
Rename failed: %s, xrefs: 0040194B
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Rename: %s, xrefs: 004018F8
SetFileAttributes failed., xrefs: 004017A1
Call: %d, xrefs: 0040165A
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Jump: %d, xrefs: 00401602
CreateDirectory: "%s" created, xrefs: 00401849
SetFileAttributes: "%s":%08X, xrefs: 0040177B
detailprint: %s, xrefs: 00401679
Sleep(%d), xrefs: 0040169D
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
BringToFront, xrefs: 004016BD

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

"F, xrefs: 00405A4B
RichEdit20A, xrefs: 00405BE2, 00405BE7
F, xrefs: 00405A22
RichEd32, xrefs: 00405BD4
RichEd20, xrefs: 00405BC9
RichEdit, xrefs: 00405BF0
.DEFAULT\Control Panel\International, xrefs: 004059C5
_Nb, xrefs: 00405AFD
@jG, xrefs: 00405AF2
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
.exe, xrefs: 00405A69

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,165,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,165,165,00000000,00000000,165,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427576,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: wrote %d to "%s", xrefs: 00401BD0
165, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user abort, xrefs: 00401B53
File: error creating "%s", xrefs: 00401AF0
File: error, user cancel, xrefs: 00401B93
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user retry, xrefs: 00401B40

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: 165$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-211596482
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 0040337F Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00427576,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

pAB, xrefs: 004033AB
vuB, xrefs: 0040346F, 0040348A, 00403513
v5B, xrefs: 00403458, 0040346A
... %d%%, xrefs: 004034C8
(]C, xrefs: 004033FD

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$v5B$vuB
API String ID: 651206458-2852903789
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Inst, xrefs: 00403698
Null, xrefs: 004036AA
soft, xrefs: 004036A1
Error launching installer, xrefs: 00403603
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00427576,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427576,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

165, xrefs: 00402770
<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: 165$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-4225409514
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427576,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

N, xrefs: 00404C32
@, xrefs: 00404BBC
M, xrefs: 00404B6F
, xrefs: 00404F65

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
ptF, xrefs: 00406D1A
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
Delete: DeleteFile("%s"), xrefs: 00406DE8
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
\*.*, xrefs: 00406D2F
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
Delete: DeleteFile failed("%s"), xrefs: 00406E29

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427576,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

F, xrefs: 004046A0
A, xrefs: 00404662

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

GetTTFNameString, xrefs: 00406F33
%s: failed opening file "%s", xrefs: 00406F38
name, xrefs: 00406FEB

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427576,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00427576,74DF23A0,00000000), ref: 00406A73

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
F, xrefs: 00406858
F, xrefs: 00406A7F

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

PSAPI.DLL, xrefs: 00406490
Unknown, xrefs: 00406528
Module32NextW, xrefs: 0040660A
Process32NextW, xrefs: 004065F4
Process32FirstW, xrefs: 004065E9
Module32FirstW, xrefs: 004065FF
CreateToolhelp32Snapshot, xrefs: 004065E1
Kernel32.DLL, xrefs: 004065C7
GetModuleBaseNameW, xrefs: 004064C0
EnumProcessModules, xrefs: 004064B6
EnumProcesses, xrefs: 004064AE

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

N, xrefs: 00404298
F, xrefs: 004042D3
open, xrefs: 0040430B

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

plF, xrefs: 00406B54
^F, xrefs: 00406ACF
NUL, xrefs: 00406ACA
%s=%s, xrefs: 00406B6F
[Rename], xrefs: 00406BF4, 00406C03

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427576,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
`G, xrefs: 0040246E
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427576,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00427576,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00092400,00000064,00188ACD), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(007A7808), ref: 00402387

Strings

165, xrefs: 00401EFB, 00401F00, 00401F1A
Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: 165$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-3629818402
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(007A7808), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

%02x%c, xrefs: 0040629C
..., xrefs: 004062BF

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Skipping section: "%s", xrefs: 004050E1
Section: "%s", xrefs: 004050A5

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427576,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.1757249681.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1757233817.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757267651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757282921.00000000004C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1757403015.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AxoPac.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: Essex.comPID: 4296, Parent PID: 5720COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	56

Executed Functions

Function 00345FC8 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00345FF7

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

GetCurrentProcess.KERNEL32(?,003DDC2C,00000000,?,?), ref: 00346123
IsWow64Process.KERNEL32(00000000,?,?), ref: 0034612A
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00346155
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00346167
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00346175
FreeLibrary.KERNEL32(00000000,?,?), ref: 0034617C
GetSystemInfo.KERNEL32(?,?,?), ref: 003461A1

Strings

kernel32.dll, xrefs: 00346150
|O, xrefs: 003850F7
GetNativeSystemInfo, xrefs: 00346161

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: b0c4e8995b695f680f3192cf789dedf5e8acbabb1b2a554c3af4eecd94988f2a
Instruction ID: 309c493881575a6a4054c06d921b8e31202b62451efaca52e7803afd66e1ad57
Opcode Fuzzy Hash: b0c4e8995b695f680f3192cf789dedf5e8acbabb1b2a554c3af4eecd94988f2a
Instruction Fuzzy Hash: E9A1706180A3CCDFC717DB787E451D57F946B26300B08C8BAD8A1D7222D6AD5578CB3A

Function 0034338B Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00343368,?), ref: 003433BB
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00343368,?), ref: 003433CE
GetFullPathNameW.KERNEL32(00007FFF,?,?,00412418,00412400,?,?,?,?,?,?,00343368,?), ref: 0034343A

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

Part of subcall function 0034425F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00343462,00412418,?,?,?,?,?,?,?,00343368,?), ref: 003442A0

SetCurrentDirectoryW.KERNEL32(?,00000001,00412418,?,?,?,?,?,?,?,00343368,?), ref: 003434BB
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00383CB0
SetCurrentDirectoryW.KERNEL32(?,00412418,?,?,?,?,?,?,?,00343368,?), ref: 00383CF1
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,004031F4,00412418,?,?,?,?,?,?,?,00343368), ref: 00383D7A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00383D81

Part of subcall function 003434D3: GetSysColorBrush.USER32(0000000F), ref: 003434DE
Part of subcall function 003434D3: LoadCursorW.USER32(00000000,00007F00), ref: 003434ED
Part of subcall function 003434D3: LoadIconW.USER32(00000063), ref: 00343503
Part of subcall function 003434D3: LoadIconW.USER32(000000A4), ref: 00343515
Part of subcall function 003434D3: LoadIconW.USER32(000000A2), ref: 00343527
Part of subcall function 003434D3: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 0034353F
Part of subcall function 003434D3: RegisterClassExW.USER32(?), ref: 00343590

Part of subcall function 003435B3: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 003435E1
Part of subcall function 003435B3: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00343602
Part of subcall function 003435B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00343368,?), ref: 00343616
Part of subcall function 003435B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00343368,?), ref: 0034361F

Part of subcall function 0034396B: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00343A3C

Strings

AutoIt, xrefs: 00383CA5
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00383CAA
runas, xrefs: 00383D75
0$A, xrefs: 00343495

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
String ID: 0$A$AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 683915450-116921796
Opcode ID: 72b44f7e2c4d3f2f46d5721a386af8de8d47b48069e1270a44de3cd5448c985e
Instruction ID: 0f7754c533939fa469cfb7884b9e2c6ce7ec3f361cb7b881144bbd3155972a89
Opcode Fuzzy Hash: 72b44f7e2c4d3f2f46d5721a386af8de8d47b48069e1270a44de3cd5448c985e
Instruction Fuzzy Hash: F451D6701083446AD703FF709D01DEE7BE8AF95740F00447AF5929F2A2DB74A6598B66

Function 003ADC54 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00345851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003455D1,?,?,00384B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00345871

Part of subcall function 003AEAB0: GetFileAttributesW.KERNEL32(?,003AD840), ref: 003AEAB1

FindFirstFileW.KERNEL32(?,?), ref: 003ADCCB
DeleteFileW.KERNEL32(?,?,?,?), ref: 003ADD1B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 003ADD2C
FindClose.KERNEL32(00000000), ref: 003ADD43
FindClose.KERNEL32(00000000), ref: 003ADD4C

Strings

\*.*, xrefs: 003ADC9D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 69b0dc455b79229a98ce9308083bf5c6589884252c41146b94d24035c562db99
Instruction ID: 7d5ce8a491e29579f9316ac3d0328531c8d5629138e1013ee33572b18415aca4
Opcode Fuzzy Hash: 69b0dc455b79229a98ce9308083bf5c6589884252c41146b94d24035c562db99
Instruction Fuzzy Hash: EC3162314093459BC302EF64D8958AFB7ECBE96310F404D6DF4D69A191EB21E909CB53

Function 003BA570 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 003BA5BD
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 003BA6D0

Part of subcall function 003B42B9: GetInputState.USER32 ref: 003B4310
Part of subcall function 003B42B9: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003B43AB

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 003BA5ED
FindNextFileW.KERNELBASE(?,?,?,00000000,00000000), ref: 003BA6BA

Strings

*.*, xrefs: 003BA5A2

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 3e736ac36c3fac52e707c349e904ce17604bac02aa80f5630d42023874907528
Instruction ID: e164c435df37935f26770c58d03441f4e420d1c0e9c54bcab280c047185d778c
Opcode Fuzzy Hash: 3e736ac36c3fac52e707c349e904ce17604bac02aa80f5630d42023874907528
Instruction Fuzzy Hash: B44163B190060AAFCF16DF64DC4ABEEBBB8EF05314F144056E905A7591EB31AE44CF61

Function 003ADD87 Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 003ADDAC
Process32FirstW.KERNEL32(00000000,?), ref: 003ADDBA
Process32NextW.KERNEL32(00000000,?), ref: 003ADDDA
CloseHandle.KERNEL32(00000000), ref: 003ADE87

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e8bbc4713ceef9cf715634e5f57d78ab9fe5545f52384a124ce8a2dcb2128d2e
Instruction ID: c4226499c93c09c32ed5e997dae418a6ef4e8bd0f97c24c6cb6bd140c0b9eaf4
Opcode Fuzzy Hash: e8bbc4713ceef9cf715634e5f57d78ab9fe5545f52384a124ce8a2dcb2128d2e
Instruction Fuzzy Hash: 253141711083019FD312EF60D885AAFBBE8EF96354F44092DF5868B1A1DB71E949CB92

Function 0035AC3E Relevance: 37.4, APIs: 1, Strings: 20, Instructions: 671
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@=, xrefs: 0035ADED
(A, xrefs: 0035AD4D
e#A, xrefs: 0035AFA9
d1b, xrefs: 0035AD55, 0035AE8E
=, xrefs: 0035AD8A
P=, xrefs: 0035AD3D
t=, xrefs: 0035ADCC
d0b, xrefs: 0035AC96, 0035AD10, 0035AEA7
d5m0, xrefs: 0035AE75
=, xrefs: 0035AD74
(A, xrefs: 0035ADC1
4=, xrefs: 0035AD45
d10m0, xrefs: 0035ACF0
d1r0,2, xrefs: 0035ACA9
`=, xrefs: 0035ADE2
i, xrefs: 0035B0A3
(A, xrefs: 0035AD65
t=, xrefs: 0035AD35
`*A, xrefs: 0035AFF9
(A, xrefs: 0035ADD7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID: 4=$@=$P=$`*A$`=$d0b$d10m0$d1b$d1r0,2$d5m0$e#A$i$t=$t=$(A$(A$(A$(A$=$=
API String ID: 0-22905888
Opcode ID: 019ff4c901cf5319849f37cc421eae381a180e719180b3f416bfb5815d390a44
Instruction ID: a4890a5f9db4f1e0e7b4ad6f75367de6a2ed244cc1588a6ba09d076fc11b2d65
Opcode Fuzzy Hash: 019ff4c901cf5319849f37cc421eae381a180e719180b3f416bfb5815d390a44
Instruction Fuzzy Hash: F9624B755083418FC726DF24C084A9AFBE1FF89304F14895EE8998B361DB71E949CF92

Function 00343624 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00343657
RegisterClassExW.USER32(00000030), ref: 00343681
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00343692
InitCommonControlsEx.COMCTL32(?), ref: 003436AF
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003436BF
LoadIconW.USER32(000000A9), ref: 003436D5
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003436E4

Strings

AutoIt v3 GUI, xrefs: 00343673
TaskbarCreated, xrefs: 00343687
0+m"4, xrefs: 0034366C
+, xrefs: 00343640
0, xrefs: 00343639

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$0+m"4$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1866920554
Opcode ID: 99c029bdd8facc5b1c23ed54f6e2376e46272a2cc51972bd70189d3c50a65f4c
Instruction ID: 10c8d56f247c4f28fa948307d2ad2dcdb08f545b781cd0a47e14c861d42650c6
Opcode Fuzzy Hash: 99c029bdd8facc5b1c23ed54f6e2376e46272a2cc51972bd70189d3c50a65f4c
Instruction Fuzzy Hash: B221E5B5E12219AFDB01DFA8ED89BDDBBB8FB08710F00812AF511E62A0D7B445548F94

Function 003A52AA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000400), ref: 003A52E6
GetWindowTextW.USER32(?,?,00000400), ref: 003A5328
_wcslen.LIBCMT ref: 003A5339
CharUpperBuffW.USER32(?,00000000), ref: 003A5345
_wcsstr.LIBVCRUNTIME ref: 003A537A
GetClassNameW.USER32(00000018,?,00000400), ref: 003A53B2
GetWindowTextW.USER32(?,?,00000400), ref: 003A53EB
GetClassNameW.USER32(00000018,?,00000400), ref: 003A5445
GetClassNameW.USER32(?,?,00000400), ref: 003A5477
GetWindowRect.USER32(?,?), ref: 003A54EF

Strings

ThumbnailClass, xrefs: 003A53BD, 003A5450

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 7f62968a5f790c93c31309e48d79216aeb388496c1593ee726f1b5226d287654
Instruction ID: 7ffdd84883d4509fadc15359aa3f263b990bce72bda948403edd16832dbf0a2f
Opcode Fuzzy Hash: 7f62968a5f790c93c31309e48d79216aeb388496c1593ee726f1b5226d287654
Instruction Fuzzy Hash: BE912671504B06AFDB0ACF24D894BAAB7E9FF47304F014529FA8B86090EB31ED55CB91

Function 0034370F Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00343709,?,?), ref: 00343777
KillTimer.USER32(?,00000001,?,?,?,?,?,00343709,?,?), ref: 003437A3
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 003437C6
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00343709,?,?), ref: 003437D1
CreatePopupMenu.USER32 ref: 003437E5
PostQuitMessage.USER32(00000000), ref: 00343806

Strings

0$A, xrefs: 00383DA9
TaskbarCreated, xrefs: 003437CC
0$A, xrefs: 00383DF7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: 0$A$0$A$TaskbarCreated
API String ID: 129472671-1653794324
Opcode ID: ed9874c32a42b7d7d845bd65e431c28707d7c6bfd34b9c558ca76004119fe1fb
Instruction ID: e47d0bb120f20e5a61624a032c05e5f14f55874d90ab855b08c20cb9835a7b67
Opcode Fuzzy Hash: ed9874c32a42b7d7d845bd65e431c28707d7c6bfd34b9c558ca76004119fe1fb
Instruction Fuzzy Hash: 9B41C3F1240244BBDB172B3C9D49BB93FE9E705310F018126F941CF2A1DAB8BB588765

Function 003809DB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0038071A: CreateFileW.KERNEL32(00000000,00000000,?,00380A84,?,?,00000000,?,00380A84,00000000,0000000C), ref: 00380737

GetLastError.KERNEL32 ref: 00380AEF
__dosmaperr.LIBCMT ref: 00380AF6
GetFileType.KERNEL32(00000000), ref: 00380B02
GetLastError.KERNEL32 ref: 00380B0C
__dosmaperr.LIBCMT ref: 00380B15
CloseHandle.KERNEL32(00000000), ref: 00380B35
CloseHandle.KERNEL32(?), ref: 00380C7F
GetLastError.KERNEL32 ref: 00380CB1
__dosmaperr.LIBCMT ref: 00380CB8

Strings

H, xrefs: 00380C3D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 6a360a53d97dce0b2d1e438a3193fe3439b64d1b52e3585571a69d57aabe8411
Instruction ID: 1275897b05a326d8482b6b26393d250c4818168ee6074417c4dda7746972f8e1
Opcode Fuzzy Hash: 6a360a53d97dce0b2d1e438a3193fe3439b64d1b52e3585571a69d57aabe8411
Instruction Fuzzy Hash: EBA12532A042088FDF1EEF68D892BAD7BA4AB06324F154199F811DF2E1D7359D16CB51

Function 003452A7 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00345594: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00384B76,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 003455B2

Part of subcall function 00345238: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0034525A

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 003453C4
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00384BFD
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00384C3E
RegCloseKey.ADVAPI32(?), ref: 00384C80
_wcslen.LIBCMT ref: 00384CE7
_wcslen.LIBCMT ref: 00384CF6

Strings

\Include\, xrefs: 00345381
Software\AutoIt v3\AutoIt, xrefs: 003453BA
Include, xrefs: 00384BF4, 00384C35
\, xrefs: 00384CFC

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: bac72fff6612c743133b6804d031a9b23923342d0de5d8db17d8bf1007361f38
Instruction ID: 21b9ec172064fd7704f3460a04d14d364a3dca0007a96bfe7d21a2a01eada22e
Opcode Fuzzy Hash: bac72fff6612c743133b6804d031a9b23923342d0de5d8db17d8bf1007361f38
Instruction Fuzzy Hash: DE71AE71504305ABC706EF65EC819DABBE8FF49340F80843EF4518B161DB71AA48CB5A

Function 003434D3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 003434DE
LoadCursorW.USER32(00000000,00007F00), ref: 003434ED
LoadIconW.USER32(00000063), ref: 00343503
LoadIconW.USER32(000000A4), ref: 00343515
LoadIconW.USER32(000000A2), ref: 00343527
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 0034353F
RegisterClassExW.USER32(?), ref: 00343590

Part of subcall function 00343624: GetSysColorBrush.USER32(0000000F), ref: 00343657
Part of subcall function 00343624: RegisterClassExW.USER32(00000030), ref: 00343681
Part of subcall function 00343624: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00343692
Part of subcall function 00343624: InitCommonControlsEx.COMCTL32(?), ref: 003436AF
Part of subcall function 00343624: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003436BF
Part of subcall function 00343624: LoadIconW.USER32(000000A9), ref: 003436D5
Part of subcall function 00343624: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003436E4

Strings

0, xrefs: 0034355F
AutoIt v3, xrefs: 0034357F
#, xrefs: 00343566

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 032cf09ef8043158e12bdb0f2a48497e7714095397f130906a931914898262f0
Instruction ID: 3a76d6117dd94eb327d256e306022e572ff3ed3bba6cbba956c67136d072a16f
Opcode Fuzzy Hash: 032cf09ef8043158e12bdb0f2a48497e7714095397f130906a931914898262f0
Instruction Fuzzy Hash: 3A213D70E00318ABDB119FA5ED45AD9BFB8FB08750F00802AEA14E62A0C3F905548F98

Function 003C0FB8 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 003C1019
inet_addr.WSOCK32(?), ref: 003C1079
gethostbyname.WS2_32(?), ref: 003C1085
IcmpCreateFile.IPHLPAPI ref: 003C1093
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 003C1123
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 003C1142
IcmpCloseHandle.IPHLPAPI(?), ref: 003C1216
WSACleanup.WSOCK32 ref: 003C121C

Strings

Ping, xrefs: 003C10D3

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: af63c651c7b8f7ea11cbc9c8075a71e74b18e9f75aa2135384d199b2dfa9a065
Instruction ID: 013ab5d91757153bb707e1057518f5951ebca8193608b4b44d437872e6ada50b
Opcode Fuzzy Hash: af63c651c7b8f7ea11cbc9c8075a71e74b18e9f75aa2135384d199b2dfa9a065
Instruction Fuzzy Hash: 0991BC31604201AFD322DF25C888F16BBE4AF46318F1989ADE569CF6A2C734ED45DB81

Function 0034F6D0 Relevance: 15.4, APIs: 2, Strings: 6, Instructions: 1414COMMON

Download Yara Rule

Strings

t5A, xrefs: 0034F8E0
t5A, xrefs: 0039463C
Variable must be of type 'Object'., xrefs: 003948C6
t5A, xrefs: 003945E9
t5A, xrefs: 0034FBB1
t5At5A, xrefs: 0034F97E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.$t5A$t5A$t5A$t5A$t5At5A
API String ID: 0-3573732262
Opcode ID: 7203a38b6139174b119678f4768fd6bc557f03103c22031f6062b2a8f319fc4b
Instruction ID: 300db6ef06b8dc84f10c43e16151bc8eab93cd446217caec49fcf1b25d21f9c0
Opcode Fuzzy Hash: 7203a38b6139174b119678f4768fd6bc557f03103c22031f6062b2a8f319fc4b
Instruction Fuzzy Hash: A7C28A75E00214DFCB26CF58C881AAEB7F5FF09300F298569E945AF2A1D335AD42CB91

Function 00350340 Relevance: 15.2, APIs: 3, Strings: 5, Instructions: 1236COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 003515F2

Strings

t5A, xrefs: 00350A6A
t5A, xrefs: 003506B7
t5At5A, xrefs: 0035075B
t5A, xrefs: 0039604D
t5A, xrefs: 00395FF9

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Init_thread_footer
String ID: t5A$t5A$t5A$t5A$t5At5A
API String ID: 1385522511-1207869359
Opcode ID: b13df15e14d18c104ffe210617b447a2cd69c51053c862f4224b23c4cbfc943a
Instruction ID: d011850c59cd22d283e7ea7a8b374d1cc33ee39d0ab46d319ed355d4b2c8b84d
Opcode Fuzzy Hash: b13df15e14d18c104ffe210617b447a2cd69c51053c862f4224b23c4cbfc943a
Instruction Fuzzy Hash: B1B27B74A08341CFCB2ACF14C480A2AB7E1BB99301F15895DED999B361D772ED49CF92

Function 00342793 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 153
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0034327E: MapVirtualKeyW.USER32(0000005B,00000000), ref: 003432AF
Part of subcall function 0034327E: MapVirtualKeyW.USER32(00000010,00000000), ref: 003432B7
Part of subcall function 0034327E: MapVirtualKeyW.USER32(000000A0,00000000), ref: 003432C2
Part of subcall function 0034327E: MapVirtualKeyW.USER32(000000A1,00000000), ref: 003432CD
Part of subcall function 0034327E: MapVirtualKeyW.USER32(00000011,00000000), ref: 003432D5
Part of subcall function 0034327E: MapVirtualKeyW.USER32(00000012,00000000), ref: 003432DD

Part of subcall function 00343205: RegisterWindowMessageW.USER32(00000004,?,00342964), ref: 0034325D

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00342A0A
OleInitialize.OLE32 ref: 00342A28
CloseHandle.KERNEL32(00000000,00000000), ref: 00383A0D

Strings

(&A, xrefs: 00342932
d(A, xrefs: 00342964
4'A, xrefs: 00342948
0$A, xrefs: 00342A2E
$A, xrefs: 0034280A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: (&A$0$A$4'A$d(A$$A
API String ID: 1986988660-2176147290
Opcode ID: 14b9b56af07dfa70dfb802a1cf48670ddc07f85d3a3d158bf5900f70a62c85de
Instruction ID: e7ceaf06a30c5eb06cd9bf476418dbec2faf45b192981a70799f460ae13ffac7
Opcode Fuzzy Hash: 14b9b56af07dfa70dfb802a1cf48670ddc07f85d3a3d158bf5900f70a62c85de
Instruction Fuzzy Hash: B6719FB4901200AFC789EF79AFA56957BE6FB48344340C23AE008DB361EBF055658F5C

Function 003790C5 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53224ade55b2239bbc5fdd0e7cdac000801f9c62c0961e15f662fd1f21e77783
Instruction ID: aa75cf804265e1fe7b5a23e194548a385eca16f5e87b4330459f2e73ecd783b7
Opcode Fuzzy Hash: 53224ade55b2239bbc5fdd0e7cdac000801f9c62c0961e15f662fd1f21e77783
Instruction Fuzzy Hash: EDC10A75A042499FDF23DFA9D841BAD7BB4AF09310F05C256E518AB392C7389942CB61

Function 003435B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 003435E1
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00343602
ShowWindow.USER32(00000000,?,?,?,?,?,?,00343368,?), ref: 00343616
ShowWindow.USER32(00000000,?,?,?,?,?,?,00343368,?), ref: 0034361F

Strings

AutoIt v3, xrefs: 003435D9, 003435DE, 003435DF
edit, xrefs: 003435FC

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: eb393ebca4bab54a8ccae525050ad00d00903c32c06696c6f72cb94d221d5c81
Instruction ID: 9f364c6bad72db70be9c9ac2cd66e5ae004b174712ee5752bca7751d01ec6c34
Opcode Fuzzy Hash: eb393ebca4bab54a8ccae525050ad00d00903c32c06696c6f72cb94d221d5c81
Instruction Fuzzy Hash: 0AF017716802997AE7220B237D08EB73EBDD7C6F10F00802ABD14E6260C2A90861DAB4

Function 003461A9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00385287

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00346299

Strings

Line %d: , xrefs: 00385305
AutoIt - , xrefs: 0034620D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line %d: $AutoIt -
API String ID: 2289894680-4094128768
Opcode ID: cff6cfdc8981ff024b224899fd0ad40fef45f3b8ee7b09f39c06736bdbf622a2
Instruction ID: efaeab328a530f08a5ccea00b49e1ac09f7550f6c2f67e4cec69f8b3bc9dd5ea
Opcode Fuzzy Hash: cff6cfdc8981ff024b224899fd0ad40fef45f3b8ee7b09f39c06736bdbf622a2
Instruction Fuzzy Hash: 73419471408304AAC713EB60EC46ADF77ECAF45310F10492EF9959A1A1EF74A649C797

Function 00378A2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,OV8,0037894C,?,00409CE8,0000000C,003789AB,?,OV8,?,0038564F), ref: 00378A84
GetLastError.KERNEL32 ref: 00378A8E
__dosmaperr.LIBCMT ref: 00378AB9

Strings

OV8, xrefs: 00378A30

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID: OV8
API String ID: 2583163307-1080316323
Opcode ID: e30a45d324b8d754a99b04f6fd814e06a0a99c3bdff3bb09b3c3fc03c1798233
Instruction ID: ecc41e196db135bbb0b256f12322f37128e4f20428c62eb8a2408279218d3de5
Opcode Fuzzy Hash: e30a45d324b8d754a99b04f6fd814e06a0a99c3bdff3bb09b3c3fc03c1798233
Instruction Fuzzy Hash: D6012B326461A05AC6BB6338AC8E77E67494B96734F2B811BF91C8F1D2DF788D818190

Function 003458CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,003458BE,SwapMouseButtons,00000004,?), ref: 003458EF
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,003458BE,SwapMouseButtons,00000004,?), ref: 00345910
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,003458BE,SwapMouseButtons,00000004,?), ref: 00345932

Strings

Control Panel\Mouse, xrefs: 003458ED

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: eed9ad6f094e1b4d947ba660f696f3453d087a04d9c4d8795ee799848a019812
Instruction ID: 31ec7e3a0f81172e2942211dd552e97aa04ec4d424c5397f28ed9546ff58c0b8
Opcode Fuzzy Hash: eed9ad6f094e1b4d947ba660f696f3453d087a04d9c4d8795ee799848a019812
Instruction Fuzzy Hash: D3112A75911618FFDB228F64DC84AAE7BFCEF45760F108459F805EB210E731AE459760

Function 00352B20 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00353006

Strings

bn:, xrefs: 00352B36, 00352E8D
CALL, xrefs: 00352FD6

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL$bn:
API String ID: 1385522511-2628035401
Opcode ID: 49b7118026337bf78a8b8fd84b9ff493b9f97ce4ee0e1eff276ea155f019a1e7
Instruction ID: ec09668ef51a4fb0985c2da6269e2c2cb40e921427b2a443615d08495ee1cb8a
Opcode Fuzzy Hash: 49b7118026337bf78a8b8fd84b9ff493b9f97ce4ee0e1eff276ea155f019a1e7
Instruction Fuzzy Hash: 28229A706082019FC716DF24C881E2BBBF5BF86305F15895DF8968B7A2D731E949CB82

Function 00343A95 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 0038413B

Part of subcall function 00345851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003455D1,?,?,00384B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00345871

Part of subcall function 00343A57: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00343A76

Strings

`u@, xrefs: 00384134
X, xrefs: 00384109

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`u@
API String ID: 779396738-2370980989
Opcode ID: bb58d4b9ef6261c622927fcd30520812df512812ba236d245c06b72d53dff580
Instruction ID: c1837262f2afd35783e1d6d850dbd59a07a5081614194af691b1e09927963dd8
Opcode Fuzzy Hash: bb58d4b9ef6261c622927fcd30520812df512812ba236d245c06b72d53dff580
Instruction Fuzzy Hash: 79218471E002589BCB02DF94CC057EE7BFC9F45314F00805AE545BB281DBF8AA898F65

Function 0036014B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 003609D8

Part of subcall function 00363614: RaiseException.KERNEL32(?,?,?,003609FA,?,00000000,?,?,?,?,?,?,003609FA,00000000,00409758,00000000), ref: 00363674

__CxxThrowException@8.LIBVCRUNTIME ref: 003609F5

Strings

Unknown exception, xrefs: 00360A02

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 79a6c684fa5ee67220a1902e2bc14d4a3be19b8be10341dfa4695a5c47a957ae
Instruction ID: d8f3415dc0e40e81a2bc354279fc0c73763ad21581db35ec1e94125233ce24c2
Opcode Fuzzy Hash: 79a6c684fa5ee67220a1902e2bc14d4a3be19b8be10341dfa4695a5c47a957ae
Instruction Fuzzy Hash: C0F0C83890020CB7CF0BBBA8DC4799F77AC5E01354B60C531B924AA5EAFB70EA55C6D0

Function 003C89B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 003C8D52
TerminateProcess.KERNEL32(00000000), ref: 003C8D59
FreeLibrary.KERNEL32(?,?,?,?), ref: 003C8F3A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: d8fd7fb0229ec5d075099c415833fae1316dbdf739db1f7f6b65c07123424e06
Instruction ID: cc43a25a3014867533e6827bf2d294a789a9ad7825ddf7f4b62752c808fe6cda
Opcode Fuzzy Hash: d8fd7fb0229ec5d075099c415833fae1316dbdf739db1f7f6b65c07123424e06
Instruction Fuzzy Hash: 7B126971A083419FC715DF28C484B6ABBE5FF89318F15895DE889CB292CB31ED45CB92

Function 0035FCAD Relevance: 4.6, APIs: 3, Instructions: 75timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 003461A9: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00346299

KillTimer.USER32(?,00000001,?,?), ref: 0035FD36
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0035FD45
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0039FE33

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 7f7f6960b5d55f4155cfe0168d652a68b1812c33fb9ab31c0706bfd2d5675e66
Instruction ID: 3c45d29fdb5e8b33e9068419bd194cdd051956ae1ee2022d8f1324f8462d92ff
Opcode Fuzzy Hash: 7f7f6960b5d55f4155cfe0168d652a68b1812c33fb9ab31c0706bfd2d5675e66
Instruction Fuzzy Hash: 24318471904744AFEB238F249855BE7BBFC9B02308F0044AED59997242D7745A85CB51

Function 0037970B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,003797BA,FF8BC369,00000000,00000002,00000000), ref: 00379744
GetLastError.KERNEL32(?,003797BA,FF8BC369,00000000,00000002,00000000,?,00375ED4,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,00366F41), ref: 0037974E
__dosmaperr.LIBCMT ref: 00379755

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: b750fdff6c8b2739eaba64bc0c46be7b4095e89c135ce7ede57573476e64e6dd
Instruction ID: 38e7c26e0016adfb40057e3d7ff117550e8cb49b7b9597f84a68c7b8a708fc44
Opcode Fuzzy Hash: b750fdff6c8b2739eaba64bc0c46be7b4095e89c135ce7ede57573476e64e6dd
Instruction Fuzzy Hash: A9014032620554AFCB1B9F99EC45D6E3B2DDB89330F258356F8158B190E670DD419790

Function 003D2976 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

GetWindowTextW.USER32(?,?,00007FFF), ref: 003D2ADF

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Strings

all, xrefs: 003D29A5

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$TextWindow
String ID: all
API String ID: 4161112387-991457757
Opcode ID: 742d914c5261b110cb8c27e1ca0ee5e2dc346fbde82fc876f65b9c2fe56a9b1f
Instruction ID: 24656006cf015a12453ba32d54c05af2b061d25bf867b0b5770fdbcf5ba2797e
Opcode Fuzzy Hash: 742d914c5261b110cb8c27e1ca0ee5e2dc346fbde82fc876f65b9c2fe56a9b1f
Instruction Fuzzy Hash: C4517A71604201AFC70AEF24D886E6AB7E4FF94300F00891EF95A9F292DB71E945CB91

Function 003B4BFA Relevance: 3.2, APIs: 2, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

SetErrorMode.KERNEL32(00000001), ref: 003B4C5B
SetErrorMode.KERNEL32(00000000), ref: 003B4E1E

Part of subcall function 003AEAB0: GetFileAttributesW.KERNEL32(?,003AD840), ref: 003AEAB1

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorMode$AttributesFile_wcslen
String ID:
API String ID: 4203446100-0
Opcode ID: 7206cc1148eea3b6f54f00e943e179867e835a04435593fcfb06da2271677b15
Instruction ID: 50b2c21cedd86f4979713d9f5b6363e9ec1f5475c74c40eae12ede1ec3a57384
Opcode Fuzzy Hash: 7206cc1148eea3b6f54f00e943e179867e835a04435593fcfb06da2271677b15
Instruction Fuzzy Hash: 91613771608340AFC301EF18C48196AFBE4FF85718F44895EF9998B362D771E945CB92

Function 0034396B Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00343A3C

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 23b6a65dbf014594dac9810e466ed075ced76628f0839d9b551575f3aad8dd08
Instruction ID: 33a508387bca1dd155689dc2a3e55a612c9541d288cec164beb84494feab01e5
Opcode Fuzzy Hash: 23b6a65dbf014594dac9810e466ed075ced76628f0839d9b551575f3aad8dd08
Instruction Fuzzy Hash: F83181B06047058FD762DF34D885797BBF8FB49308F00092EE9D98B241E7B5AA58CB52

Function 0034331B Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 0034333D

Part of subcall function 003432E6: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 003432FB
Part of subcall function 003432E6: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00343312

Part of subcall function 0034338B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00343368,?), ref: 003433BB
Part of subcall function 0034338B: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00343368,?), ref: 003433CE
Part of subcall function 0034338B: GetFullPathNameW.KERNEL32(00007FFF,?,?,00412418,00412400,?,?,?,?,?,?,00343368,?), ref: 0034343A
Part of subcall function 0034338B: SetCurrentDirectoryW.KERNEL32(?,00000001,00412418,?,?,?,?,?,?,?,00343368,?), ref: 003434BB

SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 00343377

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
String ID:
API String ID: 1550534281-0
Opcode ID: 5e8480ab350f31442708837ba348dfa4d4f1f121539498a7729f4ad92dd2cea0
Instruction ID: fe7046824f0530e1c2dfa6f839bfe220acc7bdf84bcea83029408210941ba31b
Opcode Fuzzy Hash: 5e8480ab350f31442708837ba348dfa4d4f1f121539498a7729f4ad92dd2cea0
Instruction Fuzzy Hash: 0BF05431554349AFE7026F70FE0BBA477E4E704B09F008825B914CE1E2CBF951608B48

Function 0035F950 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0035F96C
Sleep.KERNEL32(00000000), ref: 0039FB22

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: fdc90127c063c27a7badf2209a975cb6cae20207f2ede8a76c0e7b0715b5f447
Instruction ID: d194594ae6b94dc934581d8e070b5900ddf11d4cf22664175050c7d21da3e6e4
Opcode Fuzzy Hash: fdc90127c063c27a7badf2209a975cb6cae20207f2ede8a76c0e7b0715b5f447
Instruction Fuzzy Hash: 75F05831210606AFC355AF79D815FA6BBE9BB447A1F00402AF81ACB260DB60B800CBA0

Function 0035FFE0 Relevance: 2.6, APIs: 2, Instructions: 94sleepCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 0036007D
Sleep.KERNEL32 ref: 0036008F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CloseHandleSleep
String ID:
API String ID: 252777609-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 0a29869553b5e49927aaaf0a6f34d116790716e92ce22bc65b802d9a738cd358
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: B031D270A00105DFC71ACF58D482A6AFBB6FB59300B25C6A5E40ACB65AD732EDC1CBC0

Function 0034CAB0 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0034CEEE

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 118319e9069e1d358e8fafdad2e4e8ca40c9269e383b6b924e88f04d06a2f992
Instruction ID: d18c1fec4baa15efe0c08ed797a9157d374c1929659123dc1fc23b9f70baf66f
Opcode Fuzzy Hash: 118319e9069e1d358e8fafdad2e4e8ca40c9269e383b6b924e88f04d06a2f992
Instruction Fuzzy Hash: 0432AE75A0020A9FCF26CF54C884ABAB7F9EF45314F168069ED16AF261C734BD45CB54

Function 003C7AF9 Relevance: 1.8, APIs: 1, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 25e4b812b3cd312f116cdb04e5125488d23de162759f0ffa6b14139953b8136f
Instruction ID: ebb98ad2b9966758d917835218b35c2bc6371f1758126904c202b0d1f9aad2ca
Opcode Fuzzy Hash: 25e4b812b3cd312f116cdb04e5125488d23de162759f0ffa6b14139953b8136f
Instruction Fuzzy Hash: B6D14C75A0420ADFCB16EF98C491EEDBBB5FF48310F158159E915AB291DB30AD81CF90

Function 0036F106 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e2160448c7dfe19b52a9cbf19e38b79c03569d36a0ca0bd6d025c2af88b4de
Instruction ID: 942b6840529bf6926fbcad4655bf54517bfe19046083150446fb47696cfcff91
Opcode Fuzzy Hash: f1e2160448c7dfe19b52a9cbf19e38b79c03569d36a0ca0bd6d025c2af88b4de
Instruction Fuzzy Hash: B451F739A00108AFDB12DF68E850AB97BA5EF85364F1AC578E8189F395C731ED42CF50

Function 003AFCB5 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 003AFCCE

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: 9cae7290cf454c170ca917dff7cf00d959755d1d92bb5537f9bd46efd781c78a
Instruction ID: 6a58acca8bc6fb4104e5d1714b7147d5e5a6af71369884779968a5ab913eba16
Opcode Fuzzy Hash: 9cae7290cf454c170ca917dff7cf00d959755d1d92bb5537f9bd46efd781c78a
Instruction Fuzzy Hash: EB41E676500209AFCB17EFA8C8819AEB7F8EF46314B11853EE516DB255EB70DE00CB50

Function 00346679 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0034663E: LoadLibraryA.KERNEL32(kernel32.dll,?,?,0034668B,?,?,003462FA,?,00000001,?,?,00000000), ref: 0034664A
Part of subcall function 0034663E: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0034665C
Part of subcall function 0034663E: FreeLibrary.KERNEL32(00000000,?,?,0034668B,?,?,003462FA,?,00000001,?,?,00000000), ref: 0034666E

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,003462FA,?,00000001,?,?,00000000), ref: 003466AB

Part of subcall function 00346607: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00385657,?,?,003462FA,?,00000001,?,?,00000000), ref: 00346610
Part of subcall function 00346607: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00346622
Part of subcall function 00346607: FreeLibrary.KERNEL32(00000000,?,?,00385657,?,?,003462FA,?,00000001,?,?,00000000), ref: 00346635

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: ad033fc7aba58f0ed1970749c7d551e30018314c3cee5f8f5ae2ff171912d1ea
Instruction ID: 74f77bd05253ee94238d542a5abdef3b200305a93820cffcf69633396228cd78
Opcode Fuzzy Hash: ad033fc7aba58f0ed1970749c7d551e30018314c3cee5f8f5ae2ff171912d1ea
Instruction Fuzzy Hash: FA11E372640205ABCF16BF20C803BAD7BE59F51711F11882EF442AE1C2EF79EA059B52

Function 00378782 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 003787C0

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: d3bdfacce6ee48344bed95b6a9009e80f6649e26ee0c2317bb1991434c2e439d
Instruction ID: 2df22461237a010f5dc2fcefb394cb6e8cc18dfa1a392a577edaa8cf7bb256ec
Opcode Fuzzy Hash: d3bdfacce6ee48344bed95b6a9009e80f6649e26ee0c2317bb1991434c2e439d
Instruction Fuzzy Hash: 64112E75904209AFCF16DF58E9459DE7BF4EF48310F118069F809AB311D631EA15CB65

Function 00375373 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00374FF0: RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,0037319C,00000001,00000364,?,?,?,0000000A,00000000), ref: 00375031

_free.LIBCMT ref: 003753DF

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
Instruction ID: 8bc6623e50e792e691b4bd02492c2489bdd8ef8106000b54cd9dd3db3d54baf5
Opcode Fuzzy Hash: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
Instruction Fuzzy Hash: 6F014976200344ABE3368F69D881E5AFBEDEB85370F25461DE58897280EBB4A805C774

Function 0036E972 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1dcaca3f7520121673565f353bd58828d6484f0fca4c940b7c4def7923b9e8
Instruction ID: 3b60852cb7bfd7242cff1198c7b2b18b1c293ea662dcf855d15e11afc79a8d04
Opcode Fuzzy Hash: eb1dcaca3f7520121673565f353bd58828d6484f0fca4c940b7c4def7923b9e8
Instruction Fuzzy Hash: 6DF02D36500A205AD6333A67DC05B5A33D88F43334F15C716F5299B1D5EB7CD80686E2

Function 0034B329 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0034B333

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: bcfcb4e327e4372ab8848b18da03ecb44131a267fd0d90256b2ef8f3d011388e
Instruction ID: 9a9338ebac98dc04757251c8360f83fc3d2931ae3f2f87a2555365a3d28ea610
Opcode Fuzzy Hash: bcfcb4e327e4372ab8848b18da03ecb44131a267fd0d90256b2ef8f3d011388e
Instruction Fuzzy Hash: 3AF0A4B66016046ED7159F29D806A66BB98EB44360F10C52AFA19CF6D5DB31E5108AA0

Function 003BF94A Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 003BF987

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 92692fa8fedd2aa2355e4b3c6d0853349f7ce477fc907e1a7f120320bfb000a3
Instruction ID: 0891be89b818291db41d8c1837ec493a1e41dcf7ccdadfad4ef3bb130eeacf96
Opcode Fuzzy Hash: 92692fa8fedd2aa2355e4b3c6d0853349f7ce477fc907e1a7f120320bfb000a3
Instruction Fuzzy Hash: 7EF03C76600204BFCB06EBA5DC4AE9F77BCEF4A724F004455F5059F261EA70AA41C761

Function 00374FF0 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,0037319C,00000001,00000364,?,?,?,0000000A,00000000), ref: 00375031

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 10f7379771083018e6063a9d95f4d01a5a1bba06080a7557cb63a587d28004c2
Instruction ID: 5b48e1ddbfdd7cc73d1c54d956cf4a408eb345df0b1b410e09d65f6f4a9757fd
Opcode Fuzzy Hash: 10f7379771083018e6063a9d95f4d01a5a1bba06080a7557cb63a587d28004c2
Instruction Fuzzy Hash: 11F0B436551E24A6DB3B1A26DC01B5A3748BF517A0F16C021B81CDB194DAA8D80186E0

Function 00373B93 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00366A79,?,0000015D,?,?,?,?,003685B0,000000FF,00000000,?,?), ref: 00373BC5

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f7c04bfbec8ef2676d922a58030f83f37b3a93c0c7b63297faab8a5a0ee1fc9d
Instruction ID: 55c2f08ece006ee454cad9a6de1b0aecdf5d2839e14c688134d98ae2c256b7f2
Opcode Fuzzy Hash: f7c04bfbec8ef2676d922a58030f83f37b3a93c0c7b63297faab8a5a0ee1fc9d
Instruction Fuzzy Hash: CCE0ED21260A20A6DA332672AC01B6A3A4CAF813A0F16C121EC4CAA590CB78CE00A5A0

Function 003466E7 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863b14ddb26f86859c2337c900449e65ff38a0ad3a15933f34d2eefb9708c679
Instruction ID: 6d8a1593558ee5216aee2b9cc59b1a07ffe819118796dc7cefe8c162b8c2cf6b
Opcode Fuzzy Hash: 863b14ddb26f86859c2337c900449e65ff38a0ad3a15933f34d2eefb9708c679
Instruction Fuzzy Hash: 7DF06DB5105B02CFCB3A9F64D8A1816BBF8FF15329325897EE1D78AA10C735A844DF11

Function 0034684A Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00346868

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
Instruction ID: 053d568d94a0c8ee5b2282b98b8bf13922bdebf6c666794bf8fa3f9f90ade9b5
Opcode Fuzzy Hash: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
Instruction Fuzzy Hash: 92F0F87550020DFFDF05DF90C941E9E7BB9FB04318F208485F9159A151C336EA21ABA1

Function 003D34F1 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 003D3502

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 71a687b6f41df92048f2e772810bef442be3b1b4f02b6f62d4f62deb3d0ae161
Instruction ID: 16e7c54f48dd86939eb894cf87d0a040617a53b78e1362529b6ff08f25c497d4
Opcode Fuzzy Hash: 71a687b6f41df92048f2e772810bef442be3b1b4f02b6f62d4f62deb3d0ae161
Instruction Fuzzy Hash: 6BE0DF32242012EAC702EA34FC809FA738DEB863907000537E816C6110DB208F9186E1

Function 00343907 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00343963

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 536b614c1029d86ffeab0de2657a83bc19940d91f9417d6e4ed004dbcb793184
Instruction ID: 9cf4428b7c2b296e26dac5e7a2d877582c8ee94c4ad4508df23fa28ec8602d07
Opcode Fuzzy Hash: 536b614c1029d86ffeab0de2657a83bc19940d91f9417d6e4ed004dbcb793184
Instruction Fuzzy Hash: 74F0A7709003089FE7539F24DC457D67BFCA701708F0040A9A644D7185DBB45798CF45

Function 00343A57 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00343A76

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: bf73e776176a88cd13bbb49be387028b9a573970cf441485542e9c94a6c75bbc
Instruction ID: dd63bf65fa97e80f4473ec9b7742f5e17de9cec3756667315e4e6af06cc8e316
Opcode Fuzzy Hash: bf73e776176a88cd13bbb49be387028b9a573970cf441485542e9c94a6c75bbc
Instruction Fuzzy Hash: 88E0CD7290022457C711A358AC05FEE77DDDFC87A0F0440B1FC05DB254D960ED808690

Function 0038071A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00380A84,?,?,00000000,?,00380A84,00000000,0000000C), ref: 00380737

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7278645c7cb13212b2d9cf679cbdd0b1de87f3ffdd4b2a8890139aae8da441b4
Instruction ID: f0587562f189e2a3a83125a7b0d1c44a80829992418354c086a0b0856d3d3192
Opcode Fuzzy Hash: 7278645c7cb13212b2d9cf679cbdd0b1de87f3ffdd4b2a8890139aae8da441b4
Instruction Fuzzy Hash: C9D06C3200010DBBDF028F84ED06EDA3BAAFB48714F014000BE1856020C732E821AB90

Function 003AEAB0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,003AD840), ref: 003AEAB1

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a166c871a601a0d5c545cb4d094e15902076a7a0a29532e24ad9f6ccb64e892b
Instruction ID: eedce30bb1a3cf42f1d491566b4992f1886438ab8e7a1d856ef0dddcc6a02d4f
Opcode Fuzzy Hash: a166c871a601a0d5c545cb4d094e15902076a7a0a29532e24ad9f6ccb64e892b
Instruction Fuzzy Hash: ACB0922400161005AD2A0A7C6A0D9AA3304B8833A5BDE1FC0E479850E1C339881FA950

Function 003B664C Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 003ADC54: FindFirstFileW.KERNEL32(?,?), ref: 003ADCCB
Part of subcall function 003ADC54: DeleteFileW.KERNEL32(?,?,?,?), ref: 003ADD1B
Part of subcall function 003ADC54: FindNextFileW.KERNELBASE(00000000,00000010), ref: 003ADD2C
Part of subcall function 003ADC54: FindClose.KERNEL32(00000000), ref: 003ADD43

GetLastError.KERNEL32 ref: 003B666E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 98dd231c08694893f83342346e55e011f9e6662f15e28cca6b57c4bc7815bb7b
Instruction ID: 3953b01089deae5a0eb0d614d58ddc3dbcd8f4da97f6825461adb51d46f84e6f
Opcode Fuzzy Hash: 98dd231c08694893f83342346e55e011f9e6662f15e28cca6b57c4bc7815bb7b
Instruction Fuzzy Hash: F1F08C366002008FCB15EF58D845BAEB7E9EF88320F058409F90A8F352CB74BC01CB90

Non-executed Functions

Function 003A14AE Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003A1A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 003A1A60
Part of subcall function 003A1A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,003A14E7,?,?,?), ref: 003A1A6C
Part of subcall function 003A1A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,003A14E7,?,?,?), ref: 003A1A7B
Part of subcall function 003A1A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,003A14E7,?,?,?), ref: 003A1A82
Part of subcall function 003A1A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 003A1A99

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 003A1518
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 003A154C
GetLengthSid.ADVAPI32(?), ref: 003A1563
GetAce.ADVAPI32(?,00000000,?), ref: 003A159D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003A15B9
GetLengthSid.ADVAPI32(?), ref: 003A15D0
GetProcessHeap.KERNEL32(00000008,00000008), ref: 003A15D8
HeapAlloc.KERNEL32(00000000), ref: 003A15DF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 003A1600
CopySid.ADVAPI32(00000000), ref: 003A1607
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 003A1636
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 003A1658
SetUserObjectSecurity.USER32(?,00000004,?), ref: 003A166A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A1691
HeapFree.KERNEL32(00000000), ref: 003A1698
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A16A1
HeapFree.KERNEL32(00000000), ref: 003A16A8
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A16B1
HeapFree.KERNEL32(00000000), ref: 003A16B8
GetProcessHeap.KERNEL32(00000000,?), ref: 003A16C4
HeapFree.KERNEL32(00000000), ref: 003A16CB

Part of subcall function 003A1ADF: GetProcessHeap.KERNEL32(00000008,003A14FD,?,00000000,?,003A14FD,?), ref: 003A1AED
Part of subcall function 003A1ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,003A14FD,?), ref: 003A1AF4
Part of subcall function 003A1ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,003A14FD,?), ref: 003A1B03

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 33ef78ba44b1f6bb9fae7cb8824a68197315e40723d4aba9f88357f27786b007
Instruction ID: f0dbb444967add4278333310a675a84e6e2a7996a6de6bd01d858f65054a894c
Opcode Fuzzy Hash: 33ef78ba44b1f6bb9fae7cb8824a68197315e40723d4aba9f88357f27786b007
Instruction Fuzzy Hash: 9B715BB2901209BBDF129FA5EC48FAEBBBCFF45340F094516E915E61A0D7719905CBA0

Function 003BF55C Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(003DDCD0), ref: 003BF586
IsClipboardFormatAvailable.USER32(0000000D), ref: 003BF594
GetClipboardData.USER32(0000000D), ref: 003BF5A0
CloseClipboard.USER32 ref: 003BF5AC
GlobalLock.KERNEL32(00000000), ref: 003BF5E4
CloseClipboard.USER32 ref: 003BF5EE
GlobalUnlock.KERNEL32(00000000), ref: 003BF619
IsClipboardFormatAvailable.USER32(00000001), ref: 003BF626
GetClipboardData.USER32(00000001), ref: 003BF62E
GlobalLock.KERNEL32(00000000), ref: 003BF63F
GlobalUnlock.KERNEL32(00000000), ref: 003BF67F
IsClipboardFormatAvailable.USER32(0000000F), ref: 003BF695
GetClipboardData.USER32(0000000F), ref: 003BF6A1
GlobalLock.KERNEL32(00000000), ref: 003BF6B2
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 003BF6D4
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 003BF6F1
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 003BF72F
GlobalUnlock.KERNEL32(00000000), ref: 003BF750
CountClipboardFormats.USER32 ref: 003BF771
CloseClipboard.USER32 ref: 003BF7B6

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 58e58ec3250bf9132f5a725cf729cd7c7de3d5c7ebba7cc587cd0cb12cd39413
Instruction ID: d0184ea90a9b40e4590aaea5654609a829ec148a547acd000ea64f5312abfabe
Opcode Fuzzy Hash: 58e58ec3250bf9132f5a725cf729cd7c7de3d5c7ebba7cc587cd0cb12cd39413
Instruction Fuzzy Hash: 9761D3312042019FD312EF20EC85FAAB7E8EF45348F04556EF5468B6A2DB31ED45CBA2

Function 003B73D4 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 003B7403
FindClose.KERNEL32(00000000), ref: 003B7457
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 003B7493
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 003B74BA

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

FileTimeToSystemTime.KERNEL32(?,?), ref: 003B74F7
FileTimeToSystemTime.KERNEL32(?,?), ref: 003B7524

Strings

%4d, xrefs: 003B75F6
%02d, xrefs: 003B7645, 003B764F, 003B769F, 003B76EF, 003B773F, 003B778F
%4d%02d%02d%02d%02d%02d, xrefs: 003B75AF
%03d, xrefs: 003B77E7
%4d%02d%02d%02d%02d%02d%03d, xrefs: 003B7577

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: d78f50ce359b24498591b93aa654434fd7468b809439fd2a541e7f2a6e3d2b87
Instruction ID: 5f1ec74926705781ab08ad17c228db1d9fe56b5c9f6264d43d97a87eeddf0719
Opcode Fuzzy Hash: d78f50ce359b24498591b93aa654434fd7468b809439fd2a541e7f2a6e3d2b87
Instruction Fuzzy Hash: E3D15172508344AEC311EF64C886EAFB7ECEF89704F44491DF585DA191EB74EA48CB62

Function 003BA087 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 003BA0A8
GetFileAttributesW.KERNEL32(?), ref: 003BA0E6
SetFileAttributesW.KERNEL32(?,?), ref: 003BA100
FindNextFileW.KERNEL32(00000000,?), ref: 003BA118
FindClose.KERNEL32(00000000), ref: 003BA123
FindFirstFileW.KERNEL32(*.*,?), ref: 003BA13F
SetCurrentDirectoryW.KERNEL32(?), ref: 003BA18F
SetCurrentDirectoryW.KERNEL32(00407B94), ref: 003BA1AD
FindNextFileW.KERNEL32(00000000,00000010), ref: 003BA1B7
FindClose.KERNEL32(00000000), ref: 003BA1C4
FindClose.KERNEL32(00000000), ref: 003BA1D4

Strings

*.*, xrefs: 003BA13A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: efd35205f273a0096f2abfef77c82fad1b961b5d54134781dafcf139a0aaea10
Instruction ID: 0117d3515e72b95354bfe83dfe44f8cc1a027517b532d206ad9e884649afc4b1
Opcode Fuzzy Hash: efd35205f273a0096f2abfef77c82fad1b961b5d54134781dafcf139a0aaea10
Instruction Fuzzy Hash: BC312932601A096BDB12AFB8EC4AADE73AC9F05324F104462FA15E3090EB74DE458A25

Function 003B4763 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 003B4785
_wcslen.LIBCMT ref: 003B47B2
CreateDirectoryW.KERNEL32(?,00000000), ref: 003B47E2
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 003B4803
RemoveDirectoryW.KERNEL32(?), ref: 003B4813
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 003B489A
CloseHandle.KERNEL32(00000000), ref: 003B48A5
CloseHandle.KERNEL32(00000000), ref: 003B48B0

Strings

:, xrefs: 003B47C7
\, xrefs: 003B47BC
\??\%s, xrefs: 003B47A0

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: abe3f67e9e1ddbe62367c1ad5abc08bdd2458056cc614ac7f1290b14809f4a8d
Instruction ID: f2e3b605a3baecb2b187dd1a903ea9079c61aaa0b0ab09f19a0aa44917d68be9
Opcode Fuzzy Hash: abe3f67e9e1ddbe62367c1ad5abc08bdd2458056cc614ac7f1290b14809f4a8d
Instruction Fuzzy Hash: 3D31C575A00249ABDB229FA0DC49FEF37BCEF89704F1040B6F619D6461EB709644CB64

Function 003BA1E2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 003BA203
FindNextFileW.KERNEL32(00000000,?), ref: 003BA25E
FindClose.KERNEL32(00000000), ref: 003BA269
FindFirstFileW.KERNEL32(*.*,?), ref: 003BA285
SetCurrentDirectoryW.KERNEL32(?), ref: 003BA2D5
SetCurrentDirectoryW.KERNEL32(00407B94), ref: 003BA2F3
FindNextFileW.KERNEL32(00000000,00000010), ref: 003BA2FD
FindClose.KERNEL32(00000000), ref: 003BA30A
FindClose.KERNEL32(00000000), ref: 003BA31A

Part of subcall function 003AE399: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 003AE3B4

Strings

*.*, xrefs: 003BA280

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: ec34dcbb4b0b1e0d6103f1781d2bd6d45deec4cfcc541e774c4531193433ac53
Instruction ID: 299b10951309f540440b1b978c27c70c93c8dda3b3866edc7118c9a33f0357f0
Opcode Fuzzy Hash: ec34dcbb4b0b1e0d6103f1781d2bd6d45deec4cfcc541e774c4531193433ac53
Instruction Fuzzy Hash: 27314436501E096ECF22AFB4EC09ADE77AC9F05328F1144A2EA05A7090DB71DE85CA25

Function 003CC8A4 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CC10E,?,?), ref: 003CD415
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD451
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD4C8
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CC99E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 003CCA09
RegCloseKey.ADVAPI32(00000000), ref: 003CCA2D
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 003CCA8C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 003CCB47
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 003CCBB4
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 003CCC49
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 003CCC9A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 003CCD43
RegCloseKey.ADVAPI32(?,?,00000000), ref: 003CCDE2
RegCloseKey.ADVAPI32(00000000), ref: 003CCDEF

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 36040d2c2a3ec7a4262d933874a52ea6588cf6dfd8021d33b9daea015e7f6944
Instruction ID: c1037c82bf13c5aba3906d77b1f9882da01294e3985cfd256c652f4425bcdbbf
Opcode Fuzzy Hash: 36040d2c2a3ec7a4262d933874a52ea6588cf6dfd8021d33b9daea015e7f6944
Instruction Fuzzy Hash: 06023D716142009FC716DF24C895F2ABBE5EF89314F1984ADE84ACF2A2DB31ED46CB51

Function 003AD921 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00345851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003455D1,?,?,00384B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00345871

Part of subcall function 003AEAB0: GetFileAttributesW.KERNEL32(?,003AD840), ref: 003AEAB1

FindFirstFileW.KERNEL32(?,?), ref: 003AD9CD
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 003ADA88
MoveFileW.KERNEL32(?,?), ref: 003ADA9B
DeleteFileW.KERNEL32(?,?,?,?), ref: 003ADAB8
FindNextFileW.KERNEL32(00000000,00000010), ref: 003ADAE2

Part of subcall function 003ADB47: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,003ADAC7,?,?), ref: 003ADB5D

FindClose.KERNEL32(00000000,?,?,?), ref: 003ADAFE
FindClose.KERNEL32(00000000), ref: 003ADB0F

Strings

\*.*, xrefs: 003AD978, 003AD981, 003AD996

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: b845c222fbde00bd20895c1e6d9343d1413131020886dd46bdaac1f3f163c7d3
Instruction ID: f90a55dc32a39ce856324be8090ded437b42515966454519a23b4340612a6ee4
Opcode Fuzzy Hash: b845c222fbde00bd20895c1e6d9343d1413131020886dd46bdaac1f3f163c7d3
Instruction Fuzzy Hash: 7A61093190510DAACF06EFA0D9929EDB7B9EF16304F2441A9E4467B191EB31AF09CF61

Function 003BF7C7 Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 003BF7EE
EmptyClipboard.USER32 ref: 003BF7F4
GlobalAlloc.KERNEL32(00000002,?), ref: 003BF809
CloseClipboard.USER32 ref: 003BF900

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: f2ddc351ff3824cf0d69952cdb51d76543c6f8726bf2b0150f04e83d349c7650
Instruction ID: 20cb70594f86670b711eb7b92579bd7e56284c9fcb3381a9c33e61626d5a1b6e
Opcode Fuzzy Hash: f2ddc351ff3824cf0d69952cdb51d76543c6f8726bf2b0150f04e83d349c7650
Instruction Fuzzy Hash: 32417C31605611AFD312CF25E888B55BBE8FF44318F15C4A9E9198FA62CB35ED41CB90

Function 003AF20D Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 003A2010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003A205A
Part of subcall function 003A2010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003A2087
Part of subcall function 003A2010: GetLastError.KERNEL32 ref: 003A2097

ExitWindowsEx.USER32(?,00000000), ref: 003AF249

Strings

, xrefs: 003AF273
@, xrefs: 003AF23C
SeShutdownPrivilege, xrefs: 003AF219
, xrefs: 003AF237

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 599fddbe9451a4941d8496582f77fe4f8167088911fef2a3850278145343dae5
Instruction ID: 2e4f7f14f7181656c2ee7bcf0d05a722669c93ce8541834183efc0174126e35b
Opcode Fuzzy Hash: 599fddbe9451a4941d8496582f77fe4f8167088911fef2a3850278145343dae5
Instruction Fuzzy Hash: EE01D67E6112146FEB2666F8AC8ABBB736CDB0A344F154D31FD03E61D1D6645D009190

Function 003422AD Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 308COMMON

Download Yara Rule

APIs

DefDlgProcW.USER32(?,?), ref: 0034233E
GetSysColor.USER32(0000000F), ref: 00342421
SetBkColor.GDI32(?,00000000), ref: 00342434

Strings

(A, xrefs: 0034240A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Color$Proc
String ID: (A
API String ID: 929743424-3099020080
Opcode ID: 0261332c523c4c86c18e354845a27fd99d4a218b793fa1b52041016204ffa5be
Instruction ID: 76c8ebdfb29328aa6d823152679bae6bcbd84bf5a54586dcdba9fb93ed718651
Opcode Fuzzy Hash: 0261332c523c4c86c18e354845a27fd99d4a218b793fa1b52041016204ffa5be
Instruction Fuzzy Hash: 8E8138B5114500BAE22B7A3C9C98F7F25EEDB42700F56015AF102EEB91C959EF419376

Function 003B3A0E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,003856C2,?,?,00000000,00000000), ref: 003B3A1E
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,003856C2,?,?,00000000,00000000), ref: 003B3A35
LoadResource.KERNEL32(?,00000000,?,?,003856C2,?,?,00000000,00000000,?,?,?,?,?,?,003466CE), ref: 003B3A45
SizeofResource.KERNEL32(?,00000000,?,?,003856C2,?,?,00000000,00000000,?,?,?,?,?,?,003466CE), ref: 003B3A56
LockResource.KERNEL32(003856C2,?,?,003856C2,?,?,00000000,00000000,?,?,?,?,?,?,003466CE,?), ref: 003B3A65

Strings

SCRIPT, xrefs: 003B3A2B

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 6331f661024b4db9442f93902b53dde386f2250bf5e4e259b380f99c16a1961a
Instruction ID: fcfd85c42b4e20eeeeba390386239205e8cf47e5bbcf57738e9da58d2d65d578
Opcode Fuzzy Hash: 6331f661024b4db9442f93902b53dde386f2250bf5e4e259b380f99c16a1961a
Instruction Fuzzy Hash: 0C117570601701BFE7228B69EC48F677BBDEBC5B44F24466DB542966A0DB71E9008A30

Function 003A20AA Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003A1900: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003A1916
Part of subcall function 003A1900: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003A1922
Part of subcall function 003A1900: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003A1931
Part of subcall function 003A1900: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003A1938
Part of subcall function 003A1900: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003A194E

GetLengthSid.ADVAPI32(?,00000000,003A1C81), ref: 003A20FB
GetProcessHeap.KERNEL32(00000008,00000000), ref: 003A2107
HeapAlloc.KERNEL32(00000000), ref: 003A210E
CopySid.ADVAPI32(00000000,00000000,?), ref: 003A2127
GetProcessHeap.KERNEL32(00000000,00000000,003A1C81), ref: 003A213B
HeapFree.KERNEL32(00000000), ref: 003A2142

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 95f562a2aeeed57c92539eadb1e81d6ad83e22c5becdf87f5001c6ee0bf5e184
Instruction ID: 8598479bb43b7bc9afb07cb7db67d93dae84e207acbd5c40df62c6c5f9990046
Opcode Fuzzy Hash: 95f562a2aeeed57c92539eadb1e81d6ad83e22c5becdf87f5001c6ee0bf5e184
Instruction Fuzzy Hash: 4711BE71601205FFDB529F68DC09FAF7BBDEF46356F158019E94197120C7359940CB60

Function 003C2263 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003C3AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 003C3AD7
Part of subcall function 003C3AAB: _wcslen.LIBCMT ref: 003C3AF8

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 003C22BA
WSAGetLastError.WSOCK32 ref: 003C22E1
bind.WSOCK32(00000000,?,00000010), ref: 003C2338
WSAGetLastError.WSOCK32 ref: 003C2343
closesocket.WSOCK32(00000000), ref: 003C2372

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 926ac3d6405ad6cae0dbae979030a17668be08da0593464d074fbc2014e96f75
Instruction ID: d4ec27142f6283f966e431d949bfd8192a4edf36709ad37f1a6808dfe6fa89f1
Opcode Fuzzy Hash: 926ac3d6405ad6cae0dbae979030a17668be08da0593464d074fbc2014e96f75
Instruction Fuzzy Hash: 0E51C275A00200AFE712AF24C886F2A77E9EB45714F09849CF9459F3D3CB75AD428BA1

Function 003D26DD Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 003D275C
IsWindowEnabled.USER32 ref: 003D276A
GetForegroundWindow.USER32(?,?,00000001,?), ref: 003D2777
IsIconic.USER32 ref: 003D2785
IsZoomed.USER32 ref: 003D2793

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 6cbb24c23e8cc1a4a087d4a0a9040d3ca124b690fbf0b7aef52254462e6c9e53
Instruction ID: 58d001e32ce056f3f9270d2f979c9402c938bdfe1701948ce2aa934c9c791f84
Opcode Fuzzy Hash: 6cbb24c23e8cc1a4a087d4a0a9040d3ca124b690fbf0b7aef52254462e6c9e53
Instruction Fuzzy Hash: E221F7327012108FD7239F26E844B5B7BE9FFA5314F5A806AE8498B352C771ED42CB91

Function 003BD889 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 003BD8CE
GetLastError.KERNEL32(?,00000000), ref: 003BD92F
SetEvent.KERNEL32(?,?,00000000), ref: 003BD943

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: c6cbe1aba72f10770ef8166c44b1c336ca7091cd7215d53ff3fffb18556ee516
Instruction ID: 80addf619700e6ab42f853ddef4857d03c07803c3822bc7a7bc6df49d9cd22ad
Opcode Fuzzy Hash: c6cbe1aba72f10770ef8166c44b1c336ca7091cd7215d53ff3fffb18556ee516
Instruction Fuzzy Hash: 0721AFB1A00705EFE7329F65D884BAAB7FCEF40318F10442EE646E6951E774EA04CB60

Function 003AE472 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,003846AC), ref: 003AE482
GetFileAttributesW.KERNEL32(?), ref: 003AE491
FindFirstFileW.KERNEL32(?,?), ref: 003AE4A2
FindClose.KERNEL32(00000000), ref: 003AE4AE

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 99ee26fcecac450b76a2dd7d2647b8eb2bcbe18ae730d38c29301ca3ccafe9d6
Instruction ID: 28faddc3bf449db93a610728da91173da3e05380328bce028bc75f155848df74
Opcode Fuzzy Hash: 99ee26fcecac450b76a2dd7d2647b8eb2bcbe18ae730d38c29301ca3ccafe9d6
Instruction Fuzzy Hash: 0BF0A030411A2057D2126738BC0D8AA776DEE07335F504B02F876C20E0D77899A58695

Function 0039E5F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0039E5F8

Strings

%.3d, xrefs: 0039E603
X64, xrefs: 0039E680

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 00d794c8eed1f2c6ebf13ffb754a2c4246a3154d86a9379e2628bba3453e5845
Instruction ID: 7a35d102624e404b1bd0765ec93a2f2e5e28924d90aabbfff688dafb0df431be
Opcode Fuzzy Hash: 00d794c8eed1f2c6ebf13ffb754a2c4246a3154d86a9379e2628bba3453e5845
Instruction Fuzzy Hash: 86D05BF1C04108DACFC3D7909D49DB9737CBB18701F204867FD46E1450F63499089721

Function 00372992 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0000000A), ref: 00372A8A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0000000A), ref: 00372A94
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0000000A), ref: 00372AA1

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c15f8d78e4c01a67937f6ea3b21af35b490b4b21caa3acc6b19d03ed168944c3
Instruction ID: 6272c6024a609f619c5583ea46fe6ec68c0b9f9d9ffa6915d3bde22eafe041eb
Opcode Fuzzy Hash: c15f8d78e4c01a67937f6ea3b21af35b490b4b21caa3acc6b19d03ed168944c3
Instruction Fuzzy Hash: 1C31C87590121C9BCB22DF68D9897DDBBB8AF18310F5082DAE40CA7251E7749F858F45

Function 003A2010 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0036014B: __CxxThrowException@8.LIBVCRUNTIME ref: 003609D8
Part of subcall function 0036014B: __CxxThrowException@8.LIBVCRUNTIME ref: 003609F5

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003A205A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003A2087
GetLastError.KERNEL32 ref: 003A2097

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 359e78048e9337fd98e8b40ee53493908f17391091223b478a88e1f8e630c138
Instruction ID: af40cdc5976e61457e70c99f0e927e8cd977202e88b104b43b94776cf8e2a56a
Opcode Fuzzy Hash: 359e78048e9337fd98e8b40ee53493908f17391091223b478a88e1f8e630c138
Instruction Fuzzy Hash: 0211BCB2810204AFD719EF64EC86E6BBBBCFB46710F20C42EE04657651EB70BC41CA20

Function 00365058 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0036502E,?,004098D8,0000000C,00365185,?,00000002,00000000), ref: 00365079
TerminateProcess.KERNEL32(00000000,?,0036502E,?,004098D8,0000000C,00365185,?,00000002,00000000), ref: 00365080
ExitProcess.KERNEL32 ref: 00365092

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4de036688aa4298b384da258d506ec5b14887fe528a7f43064243d826e66c2c1
Instruction ID: 1a41e47e74bbf2d2481513313c1a3fd7780f5aff75438f6bef2c5aaa9f65ec72
Opcode Fuzzy Hash: 4de036688aa4298b384da258d506ec5b14887fe528a7f43064243d826e66c2c1
Instruction Fuzzy Hash: 44E0EC31012548AFCF236F54ED09E583B6DEF51381F118025F9499A131DB35DD42DBC0

Function 0039E652 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0039E664

Strings

X64, xrefs: 0039E680

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 035b7706001c7ce696dab1590a1ac3a2412851ada2bab990c3554d39c61b0dfe
Instruction ID: 6202a43d422290ef8c98050df3add48d0ea0b9e85645c488a101623a215a63b6
Opcode Fuzzy Hash: 035b7706001c7ce696dab1590a1ac3a2412851ada2bab990c3554d39c61b0dfe
Instruction Fuzzy Hash: EAD0C9F480111DEACF81CB90EC88DD9737CBB04304F110652F506A2000D73096488B10

Function 003B41FA Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,003C52EE,?,?,00000035,?), ref: 003B4229
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,003C52EE,?,?,00000035,?), ref: 003B4239

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 0c90f6c65679204833b93f9040e7b4c98e031e2ece79307b378677ffce90dd2c
Instruction ID: b9e409a2565e35f84e090240166d8ba1c7f998cd2344d23fca6b99178c854afa
Opcode Fuzzy Hash: 0c90f6c65679204833b93f9040e7b4c98e031e2ece79307b378677ffce90dd2c
Instruction Fuzzy Hash: E1F0E5346003286AE7222666AC4DFEB76ADEFC5765F000576F605D7581D9709A00C7B1

Function 003A1A0B Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,003A1B48), ref: 003A1A20
CloseHandle.KERNEL32(?,?,003A1B48), ref: 003A1A35

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 22d787f5d6e6a7ba730c322ca71c0fa1b18d5fb016150ae32b1e765158c14d49
Instruction ID: 6312757af0170b6617dd7d5a73a0a280bcecd62563c5d7d35e4209b6c0bc14de
Opcode Fuzzy Hash: 22d787f5d6e6a7ba730c322ca71c0fa1b18d5fb016150ae32b1e765158c14d49
Instruction Fuzzy Hash: 76E04F76005610AFE72A2B20FC06F7377ADFB05310F14881EF4A684470DB626C90DB10

Function 003BF4FF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 003BF51A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 435dcfcb4b38243d8ca6f40f695b707477099dbdaeb52188830d17c6373b64b4
Instruction ID: 55af7bc9bd95f04b2c7bbb11ef1368ad33344efaa6359811bc7bb2003942f892
Opcode Fuzzy Hash: 435dcfcb4b38243d8ca6f40f695b707477099dbdaeb52188830d17c6373b64b4
Instruction Fuzzy Hash: 2AE048313102045FC711AF69D804996F7DCFFA5765F058426F949CB751D670F9408BA0

Function 003AEC6C Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 003AEC95

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: d969b72225d354c357333a2d3e3e95aa4498c5eaeef15b48c9000edd060013de
Instruction ID: 6b8006f96860d9bb00347080a6f003da2b0d459133efecb4ec78a8073c73222a
Opcode Fuzzy Hash: d969b72225d354c357333a2d3e3e95aa4498c5eaeef15b48c9000edd060013de
Instruction Fuzzy Hash: 13D05EB619420079E81F0A3C9F2FF761A4EF303761F815349F102D9995E5C1A9009121

Function 00360D45 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020D51,0036075E), ref: 00360D4A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 356e0c2168d685523166336cc94a054589f8b5db5918223f21b38ae7076d2e6c
Instruction ID: 791285ede61b59965b494985509814196a0b2953981828004911d4cc012f0fb0
Opcode Fuzzy Hash: 356e0c2168d685523166336cc94a054589f8b5db5918223f21b38ae7076d2e6c
Instruction Fuzzy Hash:

Function 003C353B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 003C358D
DeleteObject.GDI32(00000000), ref: 003C35A0
DestroyWindow.USER32 ref: 003C35AF
GetDesktopWindow.USER32 ref: 003C35CA
GetWindowRect.USER32(00000000), ref: 003C35D1
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 003C3700
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 003C370E
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C3755
GetClientRect.USER32(00000000,?), ref: 003C3761
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 003C379D
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C37BF
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C37D2
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C37DD
GlobalLock.KERNEL32(00000000), ref: 003C37E6
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C37F5
GlobalUnlock.KERNEL32(00000000), ref: 003C37FE
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C3805
GlobalFree.KERNEL32(00000000), ref: 003C3810
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C3822
OleLoadPicture.OLEAUT32(?,00000000,00000000,003E0C04,00000000), ref: 003C3838
GlobalFree.KERNEL32(00000000), ref: 003C3848
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 003C386E
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 003C388D
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C38AF
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003C3A9C

Strings

AutoIt v3, xrefs: 003C374F
static, xrefs: 003C3797, 003C38EE
DISPLAY, xrefs: 003C38FF
, xrefs: 003C3A22

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 901ad4a39a4b3d78be83d062173e4deaced88c018e47464f63ccb01cc99ac8b6
Instruction ID: de8f32f5818ae920b758f2afb326ea3385f67aae968d1b35b7c34493628cff1b
Opcode Fuzzy Hash: 901ad4a39a4b3d78be83d062173e4deaced88c018e47464f63ccb01cc99ac8b6
Instruction Fuzzy Hash: 6E027C71911209AFDB16DF64DD89EAEBBB9FB48310F048159F915EB2A0CB74ED01CB60

Function 00341625 Relevance: 53.0, APIs: 26, Strings: 4, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 003416B4
SendMessageW.USER32(?,00001308,?,00000000), ref: 00382B07
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00382B40
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00382F85

Part of subcall function 00341802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00341488,?,00000000,?,?,?,?,0034145A,00000000,?), ref: 00341865

SendMessageW.USER32(?,00001053), ref: 00382FC1
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00382FD8
ImageList_Destroy.COMCTL32(00000000,?), ref: 00382FEE
ImageList_Destroy.COMCTL32(00000000,?), ref: 00382FF9

Strings

(A, xrefs: 00382B86
0, xrefs: 00382E11
(A, xrefs: 00383035
(A, xrefs: 00382CA1

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0$(A$(A$(A
API String ID: 2760611726-916929092
Opcode ID: 0c882690157758bbf8b151921c1af4445a5e471a165693b93470ee524af1d645
Instruction ID: a7553a13975b1ff3d8587861eeaa3a19f0dbd450e428206553e57f6f06bf8396
Opcode Fuzzy Hash: 0c882690157758bbf8b151921c1af4445a5e471a165693b93470ee524af1d645
Instruction Fuzzy Hash: B412CE702017019FC727EF18D944BAABBF5FB44300F1A85AAF895DB661C735E896CB81

Function 003D7B0D Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 003D7B67
GetSysColorBrush.USER32(0000000F), ref: 003D7B98
GetSysColor.USER32(0000000F), ref: 003D7BA4
SetBkColor.GDI32(?,000000FF), ref: 003D7BBE
SelectObject.GDI32(?,?), ref: 003D7BCD
InflateRect.USER32(?,000000FF,000000FF), ref: 003D7BF8
GetSysColor.USER32(00000010), ref: 003D7C00
CreateSolidBrush.GDI32(00000000), ref: 003D7C07
FrameRect.USER32(?,?,00000000), ref: 003D7C16
DeleteObject.GDI32(00000000), ref: 003D7C1D
InflateRect.USER32(?,000000FE,000000FE), ref: 003D7C68
FillRect.USER32(?,?,?), ref: 003D7C9A
GetWindowLongW.USER32(?,000000F0), ref: 003D7CBC

Part of subcall function 003D7E22: GetSysColor.USER32(00000012), ref: 003D7E5B
Part of subcall function 003D7E22: SetTextColor.GDI32(?,003D7B2D), ref: 003D7E5F
Part of subcall function 003D7E22: GetSysColorBrush.USER32(0000000F), ref: 003D7E75
Part of subcall function 003D7E22: GetSysColor.USER32(0000000F), ref: 003D7E80
Part of subcall function 003D7E22: GetSysColor.USER32(00000011), ref: 003D7E9D
Part of subcall function 003D7E22: CreatePen.GDI32(00000000,00000001,00743C00), ref: 003D7EAB
Part of subcall function 003D7E22: SelectObject.GDI32(?,00000000), ref: 003D7EBC
Part of subcall function 003D7E22: SetBkColor.GDI32(?,?), ref: 003D7EC5
Part of subcall function 003D7E22: SelectObject.GDI32(?,?), ref: 003D7ED2
Part of subcall function 003D7E22: InflateRect.USER32(?,000000FF,000000FF), ref: 003D7EF1
Part of subcall function 003D7E22: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 003D7F08
Part of subcall function 003D7E22: GetWindowLongW.USER32(?,000000F0), ref: 003D7F15

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 9375e783c668f7ad76f88f31ede72ea44178744e9f40b922c0a5eee64929f6cb
Instruction ID: 7d5740a6a671527618439e86795d1036296b9a9e48b3d1739fc539d3abc97dd1
Opcode Fuzzy Hash: 9375e783c668f7ad76f88f31ede72ea44178744e9f40b922c0a5eee64929f6cb
Instruction Fuzzy Hash: 74A17072009301BFD7129F64EC49E6BBBAEFF49324F100A1AF962962E0E775D944CB51

Function 003C316E Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 003C319B
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 003C32C7
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 003C3306
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 003C3316
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 003C335D
GetClientRect.USER32(00000000,?), ref: 003C3369
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 003C33B2
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 003C33C1
GetStockObject.GDI32(00000011), ref: 003C33D1
SelectObject.GDI32(00000000,00000000), ref: 003C33D5
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 003C33E5
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003C33EE
DeleteDC.GDI32(00000000), ref: 003C33F7
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 003C3423
SendMessageW.USER32(00000030,00000000,00000001), ref: 003C343A
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 003C347A
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 003C348E
SendMessageW.USER32(00000404,00000001,00000000), ref: 003C349F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 003C34D4
GetStockObject.GDI32(00000011), ref: 003C34DF
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 003C34EA
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 003C34F4

Strings

msctls_progress32, xrefs: 003C3470
AutoIt v3, xrefs: 003C3355
static, xrefs: 003C33AC, 003C34CE
DISPLAY, xrefs: 003C33B7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: dcba23d602b63df7687207dc73c144fa03c2fb561f4fd71a87bebe19d2a99af9
Instruction ID: e55c3a8174b2c8be499c7f5c4f9e99fa7f979fa19f6d2f2331e76d8a6bcfd4ec
Opcode Fuzzy Hash: dcba23d602b63df7687207dc73c144fa03c2fb561f4fd71a87bebe19d2a99af9
Instruction Fuzzy Hash: 79B16E71A40209AFDB15DFB8DD45FAEBBB9EB08710F008519F915EB290C7B4AD40CBA4

Function 003B5524 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003B5532
GetDriveTypeW.KERNEL32(?,003DDC30,?,\\.\,003DDCD0), ref: 003B560F
SetErrorMode.KERNEL32(00000000,003DDC30,?,\\.\,003DDCD0), ref: 003B577B

Strings

Removable, xrefs: 003B5655, 003B565A
SATA, xrefs: 003B5715
ATAPI, xrefs: 003B56D6
PhysicalDrive, xrefs: 003B55BB
1394, xrefs: 003B56E4
iSCSI, xrefs: 003B5707
Unknown, xrefs: 003B5632, 003B56C8
Fibre, xrefs: 003B56F2
MMC, xrefs: 003B5723
ATA, xrefs: 003B56DD
\\.\, xrefs: 003B5584
Virtual, xrefs: 003B572A
USB, xrefs: 003B56F9
SAS, xrefs: 003B570E
Network, xrefs: 003B5647
SSA, xrefs: 003B56EB
Fixed, xrefs: 003B564E
SSD, xrefs: 003B568F
RAMDisk, xrefs: 003B5639
RAID, xrefs: 003B5700
FileBackedVirtual, xrefs: 003B5731
CDROM, xrefs: 003B5640
SCSI, xrefs: 003B56CF

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: c6b254f817bf348f264e328de6ceb381fa15040aa1e646242c95a4793b780922
Instruction ID: bfe357ec9bc47e800e7b304f9ece81aa041032f07e5fb0fc59238e45418cec70
Opcode Fuzzy Hash: c6b254f817bf348f264e328de6ceb381fa15040aa1e646242c95a4793b780922
Instruction Fuzzy Hash: DA61E430B04905DFC726DF24C992BF873A5EF25358B248026E506AFA91CB35EE03DB52

Function 00342521 Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003425F8
GetSystemMetrics.USER32(00000007), ref: 00342600
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0034262B
GetSystemMetrics.USER32(00000008), ref: 00342633
GetSystemMetrics.USER32(00000004), ref: 00342658
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00342675
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00342685
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 003426B8
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 003426CC
GetClientRect.USER32(00000000,000000FF), ref: 003426EA
GetStockObject.GDI32(00000011), ref: 00342706
SendMessageW.USER32(00000000,00000030,00000000), ref: 00342711

Part of subcall function 003419CD: GetCursorPos.USER32(?), ref: 003419E1
Part of subcall function 003419CD: ScreenToClient.USER32(00000000,?), ref: 003419FE
Part of subcall function 003419CD: GetAsyncKeyState.USER32(00000001), ref: 00341A23
Part of subcall function 003419CD: GetAsyncKeyState.USER32(00000002), ref: 00341A3D

SetTimer.USER32(00000000,00000000,00000028,0034199C), ref: 00342738

Strings

(A, xrefs: 0034271A
AutoIt v3 GUI, xrefs: 003426B0
<)A, xrefs: 003839A6
<)A, xrefs: 0034255C
(A, xrefs: 00383909
(A, xrefs: 00342749

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: <)A$<)A$AutoIt v3 GUI$(A$(A$(A
API String ID: 1458621304-717371513
Opcode ID: ae07acb4553c75e5f6fa3c4e7f685ea8ea206e30baaa07774a0bd7fb44fabf67
Instruction ID: 8abc76d7eba0aec90ed52bca6455c8006350be4a125c3fc4fa73c24ddbbd3303
Opcode Fuzzy Hash: ae07acb4553c75e5f6fa3c4e7f685ea8ea206e30baaa07774a0bd7fb44fabf67
Instruction Fuzzy Hash: AFB19F716002099FCB16DFA8DD45BEE7BB9FB48714F11416AFA05EB2A0D7B4E840CB54

Function 003D1A8F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 003D1BC4
GetDesktopWindow.USER32 ref: 003D1BD9
GetWindowRect.USER32(00000000), ref: 003D1BE0
GetWindowLongW.USER32(?,000000F0), ref: 003D1C35
DestroyWindow.USER32(?), ref: 003D1C55
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 003D1C89
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003D1CA7
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 003D1CB9
SendMessageW.USER32(00000000,00000421,?,?), ref: 003D1CCE
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 003D1CE1
IsWindowVisible.USER32(00000000), ref: 003D1D3D
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 003D1D58
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 003D1D6C
GetWindowRect.USER32(00000000,?), ref: 003D1D84
MonitorFromPoint.USER32(?,?,00000002), ref: 003D1DAA
GetMonitorInfoW.USER32(00000000,?), ref: 003D1DC4
CopyRect.USER32(?,?), ref: 003D1DDB
SendMessageW.USER32(00000000,00000412,00000000), ref: 003D1E46

Strings

0, xrefs: 003D1B6F
tooltips_class32, xrefs: 003D1C82
(, xrefs: 003D1DB7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 04424a2fa3f34d42dcf426dd1d0829efcd23b3d88ded6541f3c3b60f4f3ae21d
Instruction ID: e1561b58044f8fd516cdcc568bbfab4cd16e5e58254e9048bb4a251b5c52c96a
Opcode Fuzzy Hash: 04424a2fa3f34d42dcf426dd1d0829efcd23b3d88ded6541f3c3b60f4f3ae21d
Instruction Fuzzy Hash: 63B18D72614301AFD715DF64D884B6AFBE9FF84310F00891EF9999B2A1D731E844CBA2

Function 003D0CDD Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 003D0D81
_wcslen.LIBCMT ref: 003D0DBB
_wcslen.LIBCMT ref: 003D0E25
_wcslen.LIBCMT ref: 003D0E8D
_wcslen.LIBCMT ref: 003D0F11
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 003D0F61
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 003D0FA0

Part of subcall function 0035FD52: _wcslen.LIBCMT ref: 0035FD5D

Part of subcall function 003A2B8C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 003A2BA5
Part of subcall function 003A2B8C: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 003A2BD7

Strings

SELECTALL, xrefs: 003D0FB1
GETSUBITEMCOUNT, xrefs: 003D0E20, 003D0E3B
SELECTCLEAR, xrefs: 003D0FC9
GETSELECTED, xrefs: 003D107D
DESELECT, xrefs: 003D1038
GETITEMCOUNT, xrefs: 003D0DB2, 003D0DD3
FINDITEM, xrefs: 003D10C3
VIEWCHANGE, xrefs: 003D1111
ISSELECTED, xrefs: 003D0F79
SELECT, xrefs: 003D0FE4
SELECTINVERT, xrefs: 003D101A
GETSELECTEDCOUNT, xrefs: 003D0F0C, 003D0F27
GETTEXT, xrefs: 003D0E88, 003D0EA3

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: bc17880c9ab94ba003c00c74f8f87391105e9cc577d960c33ee765b2fa561f9c
Instruction ID: ab97ed4bb095f17b927ef37891d6c8e0d13d1fde33151931cf0bf582a2f76860
Opcode Fuzzy Hash: bc17880c9ab94ba003c00c74f8f87391105e9cc577d960c33ee765b2fa561f9c
Instruction Fuzzy Hash: 84E1F0322182019FC71AEF24D95092AB3E6FF84714F15896EF8969B7A1CB30ED45CB91

Function 003A16D7 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003A1A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 003A1A60
Part of subcall function 003A1A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,003A14E7,?,?,?), ref: 003A1A6C
Part of subcall function 003A1A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,003A14E7,?,?,?), ref: 003A1A7B
Part of subcall function 003A1A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,003A14E7,?,?,?), ref: 003A1A82
Part of subcall function 003A1A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 003A1A99

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 003A1741
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 003A1775
GetLengthSid.ADVAPI32(?), ref: 003A178C
GetAce.ADVAPI32(?,00000000,?), ref: 003A17C6
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003A17E2
GetLengthSid.ADVAPI32(?), ref: 003A17F9
GetProcessHeap.KERNEL32(00000008,00000008), ref: 003A1801
HeapAlloc.KERNEL32(00000000), ref: 003A1808
GetLengthSid.ADVAPI32(?,00000008,?), ref: 003A1829
CopySid.ADVAPI32(00000000), ref: 003A1830
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 003A185F
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 003A1881
SetUserObjectSecurity.USER32(?,00000004,?), ref: 003A1893
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A18BA
HeapFree.KERNEL32(00000000), ref: 003A18C1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A18CA
HeapFree.KERNEL32(00000000), ref: 003A18D1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003A18DA
HeapFree.KERNEL32(00000000), ref: 003A18E1
GetProcessHeap.KERNEL32(00000000,?), ref: 003A18ED
HeapFree.KERNEL32(00000000), ref: 003A18F4

Part of subcall function 003A1ADF: GetProcessHeap.KERNEL32(00000008,003A14FD,?,00000000,?,003A14FD,?), ref: 003A1AED
Part of subcall function 003A1ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,003A14FD,?), ref: 003A1AF4
Part of subcall function 003A1ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,003A14FD,?), ref: 003A1B03

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 042545d0a3c6207c492cd1b01d9aba811d3b0b0478a8b6c55e404eb35a7140b9
Instruction ID: 8f18dc5f704d5ba51f0d64a1d293df17269ec2327635a0355f6de3cfdd7114d4
Opcode Fuzzy Hash: 042545d0a3c6207c492cd1b01d9aba811d3b0b0478a8b6c55e404eb35a7140b9
Instruction Fuzzy Hash: 897158B2D0120ABBDB12DFA5EC48FAEBBBDEF45300F158126E915A7190D7359A05CB60

Function 003CCE17 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CCF1D
RegCreateKeyExW.ADVAPI32(?,?,00000000,003DDCD0,00000000,?,00000000,?,?), ref: 003CCFA4
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 003CD004
_wcslen.LIBCMT ref: 003CD054
_wcslen.LIBCMT ref: 003CD0CF
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 003CD112
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 003CD221
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 003CD2AD
RegCloseKey.ADVAPI32(?), ref: 003CD2E1
RegCloseKey.ADVAPI32(00000000), ref: 003CD2EE
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 003CD3C0

Strings

REG_DWORD, xrefs: 003CD264
REG_BINARY, xrefs: 003CD373
REG_MULTI_SZ, xrefs: 003CD155
REG_SZ, xrefs: 003CD0A4
REG_QWORD, xrefs: 003CD323
REG_EXPAND_SZ, xrefs: 003CD02D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: de04ddc612d7730a5855b802615ea4a77b1eb7c21a90784c848ea6f02db87a54
Instruction ID: 1c65ef1cfa794c461c3c00d0f0ded1cf08f57b65b5a7343992fc8829dfbb5bdc
Opcode Fuzzy Hash: de04ddc612d7730a5855b802615ea4a77b1eb7c21a90784c848ea6f02db87a54
Instruction Fuzzy Hash: 2C12F4356042019FD716EF14C881F2AB7E5AF88714F1588ADF99A9F2A2CB35FD41CB81

Function 003D13BA Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 003D1462
_wcslen.LIBCMT ref: 003D149D
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 003D14F0
_wcslen.LIBCMT ref: 003D1526
_wcslen.LIBCMT ref: 003D15A2
_wcslen.LIBCMT ref: 003D161D

Part of subcall function 0035FD52: _wcslen.LIBCMT ref: 0035FD5D

Part of subcall function 003A3535: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003A3547

Strings

ISCHECKED, xrefs: 003D177D
GETTOTALCOUNT, xrefs: 003D148E, 003D14B3
SELECT, xrefs: 003D17AD
EXISTS, xrefs: 003D1618, 003D1633
COLLAPSE, xrefs: 003D159D, 003D15B8
UNCHECK, xrefs: 003D17DA
GETTEXT, xrefs: 003D1733
GETSELECTED, xrefs: 003D16EA
CHECK, xrefs: 003D1521, 003D153C
GETITEMCOUNT, xrefs: 003D16BA
EXPAND, xrefs: 003D1694

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: da1b1b835f4b7f3a53e112bf2adbe2132d067ed363360a62b613055123eef976
Instruction ID: f7d9369fe92eaf0fafd0f579e172341d2b984ec1e9a9099178464908c88afa4f
Opcode Fuzzy Hash: da1b1b835f4b7f3a53e112bf2adbe2132d067ed363360a62b613055123eef976
Instruction Fuzzy Hash: 0AE1BF32608301AFC712EF24D55082AB7F6FF95314B15895EF8969B7A2CB34ED49CB81

Function 003CD3F8 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CC10E,?,?), ref: 003CD415
_wcslen.LIBCMT ref: 003CD451
_wcslen.LIBCMT ref: 003CD4C8
_wcslen.LIBCMT ref: 003CD4FE
_wcslen.LIBCMT ref: 003CD559
_wcslen.LIBCMT ref: 003CD58F
_wcslen.LIBCMT ref: 003CD5DF

Strings

HKCR, xrefs: 003CD589, 003CD58E
HKEY_CURRENT_CONFIG, xrefs: 003CD5D9, 003CD5DE
HKU, xrefs: 003CD650
HKEY_LOCAL_MACHINE, xrefs: 003CD4C2, 003CD4C7
HKEY_USERS, xrefs: 003CD63F
HKCC, xrefs: 003CD60C
HKLM, xrefs: 003CD4F8, 003CD4FD
HKEY_CLASSES_ROOT, xrefs: 003CD553, 003CD558
HKEY_CURRENT_USER, xrefs: 003CD61D
HKCU, xrefs: 003CD62E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 1c7cc0b353b57be17a99e957c42b3a587465587b28c9b68debe0b51301803be5
Instruction ID: d2ae9aa7e6729f5fcf95e28929202d04b2c939b10cb4e5f7a4ac8633b5655d3e
Opcode Fuzzy Hash: 1c7cc0b353b57be17a99e957c42b3a587465587b28c9b68debe0b51301803be5
Instruction Fuzzy Hash: 5B71D632A0051A8BCB129E38CE40FBB33A5AB61754F63413DF856EB298EB35DD55C790

Function 003D8D97 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003D8DB5
_wcslen.LIBCMT ref: 003D8DC9
_wcslen.LIBCMT ref: 003D8DEC
_wcslen.LIBCMT ref: 003D8E0F
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 003D8E4D
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,003D6691), ref: 003D8EA9
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 003D8EE2
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 003D8F25
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 003D8F5C
FreeLibrary.KERNEL32(?), ref: 003D8F68
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 003D8F78
DestroyIcon.USER32(?,?,?,?,?,003D6691), ref: 003D8F87
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 003D8FA4
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 003D8FB0

Strings

.exe, xrefs: 003D8DE3
.dll, xrefs: 003D8E06
.icl, xrefs: 003D8DC3

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 3629678ee043c641e5aff847359ff5eb46e3da25f53f5bb381b9376a57c6460c
Instruction ID: 909932628215a621863fa9f20d3bbae50bbd695cff38dbc37f6d3616259e1126
Opcode Fuzzy Hash: 3629678ee043c641e5aff847359ff5eb46e3da25f53f5bb381b9376a57c6460c
Instruction Fuzzy Hash: 9061C072900215BEEB16DF64EC45BBE77ACBF08B10F108517F915EA2D1DB74A990CBA0

Function 003B48BE Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 003B493D
_wcslen.LIBCMT ref: 003B4948
_wcslen.LIBCMT ref: 003B499F
_wcslen.LIBCMT ref: 003B49DD
GetDriveTypeW.KERNEL32(?), ref: 003B4A1B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003B4A63
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003B4A9E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003B4ACC

Strings

set cd door , xrefs: 003B4A6D
wait, xrefs: 003B4A89
type cdaudio alias cd wait, xrefs: 003B4A46
open , xrefs: 003B4A2A
close, xrefs: 003B4943, 003B495D
close cd wait, xrefs: 003B4AB7
closed, xrefs: 003B494D, 003B4972, 003B498B, 003B49C3, 003B49DC
open, xrefs: 003B4999, 003B499E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 65d0da7cc25b0074f863b3d299c7d99bff044bb1bf3a5afb0c81740ab9a42aa8
Instruction ID: 9b4a691adf9d4d587a4b5e6ab73f22195275d880e1ef1d3e5064c98bff6b9725
Opcode Fuzzy Hash: 65d0da7cc25b0074f863b3d299c7d99bff044bb1bf3a5afb0c81740ab9a42aa8
Instruction Fuzzy Hash: CE710432A083019FC702EF24C8409ABB7E4EF95758F10492DF9969B692EB30ED45CB95

Function 003A6382 Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 003A6395
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 003A63A7
SetWindowTextW.USER32(?,?), ref: 003A63BE
GetDlgItem.USER32(?,000003EA), ref: 003A63D3
SetWindowTextW.USER32(00000000,?), ref: 003A63D9
GetDlgItem.USER32(?,000003E9), ref: 003A63E9
SetWindowTextW.USER32(00000000,?), ref: 003A63EF
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 003A6410
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 003A642A
GetWindowRect.USER32(?,?), ref: 003A6433
_wcslen.LIBCMT ref: 003A649A
SetWindowTextW.USER32(?,?), ref: 003A64D6
GetDesktopWindow.USER32 ref: 003A64DC
GetWindowRect.USER32(00000000), ref: 003A64E3
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 003A653A
GetClientRect.USER32(?,?), ref: 003A6547
PostMessageW.USER32(?,00000005,00000000,?), ref: 003A656C
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 003A6596

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 84ee9a4e4979ef5622cb85becbc2be794a6777ad1076b34c9bffed24a7e39b6d
Instruction ID: e1fb5e73be8d5271b0a951dcc3db8bc9005a2fa58de48a98b1cb8e2b8674c8c7
Opcode Fuzzy Hash: 84ee9a4e4979ef5622cb85becbc2be794a6777ad1076b34c9bffed24a7e39b6d
Instruction Fuzzy Hash: F371CF31900705EFDB22DFA9CE46BAEBBF9FF48704F140919E186A25A0C774E944CB50

Function 003C086B Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 003C0884
LoadCursorW.USER32(00000000,00007F8A), ref: 003C088F
LoadCursorW.USER32(00000000,00007F00), ref: 003C089A
LoadCursorW.USER32(00000000,00007F03), ref: 003C08A5
LoadCursorW.USER32(00000000,00007F8B), ref: 003C08B0
LoadCursorW.USER32(00000000,00007F01), ref: 003C08BB
LoadCursorW.USER32(00000000,00007F81), ref: 003C08C6
LoadCursorW.USER32(00000000,00007F88), ref: 003C08D1
LoadCursorW.USER32(00000000,00007F80), ref: 003C08DC
LoadCursorW.USER32(00000000,00007F86), ref: 003C08E7
LoadCursorW.USER32(00000000,00007F83), ref: 003C08F2
LoadCursorW.USER32(00000000,00007F85), ref: 003C08FD
LoadCursorW.USER32(00000000,00007F82), ref: 003C0908
LoadCursorW.USER32(00000000,00007F84), ref: 003C0913
LoadCursorW.USER32(00000000,00007F04), ref: 003C091E
LoadCursorW.USER32(00000000,00007F02), ref: 003C0929
GetCursorInfo.USER32(?), ref: 003C0939
GetLastError.KERNEL32 ref: 003C097B

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: fa6dc0b8a7ee198ef2206721834639da341436552cc94052a44b87e1f7f104b9
Instruction ID: 33c480622c3926a192603ad17dfd5b6c59af3a4b84f244b4cd30f13b86cefdeb
Opcode Fuzzy Hash: fa6dc0b8a7ee198ef2206721834639da341436552cc94052a44b87e1f7f104b9
Instruction Fuzzy Hash: 44417470D08319AADB119FBA8C85D5EBFE8FF04750B50452AE15CEB291DB78E801CF91

Function 003A3A43 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003A3AD9
_wcslen.LIBCMT ref: 003A3B44

Strings

CLASSNN, xrefs: 003A3B3F, 003A3B50
TEXT, xrefs: 003A3DC8
REGEXPCLASS, xrefs: 003A3BA1, 003A3BB2
INSTANCE, xrefs: 003A3D9F
k@, xrefs: 003A3CE6
CLASS, xrefs: 003A3AD4, 003A3AF1
NAME, xrefs: 003A3C81, 003A3C92

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$k@
API String ID: 176396367-1235492893
Opcode ID: 23e9bf4129c3dbbb353cd8a9e1fc94aa109522144b4e1fe3578a23b9c33da8ba
Instruction ID: 63c7103227d182486c98d5da421497d55d89339e52b8873f979959e0f19c1cbd
Opcode Fuzzy Hash: 23e9bf4129c3dbbb353cd8a9e1fc94aa109522144b4e1fe3578a23b9c33da8ba
Instruction Fuzzy Hash: FCE1E332E00516ABCB169F74C841AEDFBB5FF16710F12812AF456FB250DB30AE5587A0

Function 003D9B7A Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

DragQueryPoint.SHELL32(?,?), ref: 003D9BA3

Part of subcall function 003D80AE: ClientToScreen.USER32(?,?), ref: 003D80D4
Part of subcall function 003D80AE: GetWindowRect.USER32(?,?), ref: 003D814A
Part of subcall function 003D80AE: PtInRect.USER32(?,?,?), ref: 003D815A

SendMessageW.USER32(?,000000B0,?,?), ref: 003D9C0C
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 003D9C17
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 003D9C3A
SendMessageW.USER32(?,000000C2,00000001,?), ref: 003D9C81
SendMessageW.USER32(?,000000B0,?,?), ref: 003D9C9A
SendMessageW.USER32(?,000000B1,?,?), ref: 003D9CB1
SendMessageW.USER32(?,000000B1,?,?), ref: 003D9CD3
DragFinish.SHELL32(?), ref: 003D9CDA
DefDlgProcW.USER32(?,00000233,?,00000000), ref: 003D9DCD

Strings

@GUI_DRAGID, xrefs: 003D9D45
(A, xrefs: 003D9DAB
(A, xrefs: 003D9B8C
@GUI_DRAGFILE, xrefs: 003D9D7C
@GUI_DROPID, xrefs: 003D9CFA

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$(A$(A
API String ID: 221274066-1888315361
Opcode ID: f75e13a13b7e821145fcced7570f3301bcc3cf35496e63b71096fd0b4c71734d
Instruction ID: db971758d8baea4b9e4ab5edb41fd1817aecbb7b0e8611dca49abdfdf430f1e8
Opcode Fuzzy Hash: f75e13a13b7e821145fcced7570f3301bcc3cf35496e63b71096fd0b4c71734d
Instruction Fuzzy Hash: E4617E71108305AFC302EF64DC85E9FBBE8FF89750F40092EF5919A2A1DB70A649CB52

Function 00360436 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00360436

Part of subcall function 0036045D: InitializeCriticalSectionAndSpinCount.KERNEL32(0041170C,00000FA0,0228154B,?,?,?,?,00382733,000000FF), ref: 0036048C
Part of subcall function 0036045D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00382733,000000FF), ref: 00360497
Part of subcall function 0036045D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00382733,000000FF), ref: 003604A8
Part of subcall function 0036045D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 003604BE
Part of subcall function 0036045D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 003604CC
Part of subcall function 0036045D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 003604DA
Part of subcall function 0036045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00360505
Part of subcall function 0036045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00360510

___scrt_fastfail.LIBCMT ref: 00360457

Part of subcall function 00360413: __onexit.LIBCMT ref: 00360419

Strings

InitializeConditionVariable, xrefs: 003604B8
WakeAllConditionVariable, xrefs: 003604D2
kernel32.dll, xrefs: 003604A3
SleepConditionVariableCS, xrefs: 003604C4
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00360492

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 329fa45fb7a8bf5ea1b5abd74316306fb182b279591c59aec666fc60280a6859
Instruction ID: a352622e13aa4e0d8cbf3bb8834be86157be132eaf94bed9d3cd1a15ce58e8e8
Opcode Fuzzy Hash: 329fa45fb7a8bf5ea1b5abd74316306fb182b279591c59aec666fc60280a6859
Instruction Fuzzy Hash: CD213B32A453156BD72B2BE5AC07BAB3798EB05B61F018126FA01972D4DFB48C408A64

Function 003B4F05 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,003DDCD0), ref: 003B4F6C
_wcslen.LIBCMT ref: 003B4F80
_wcslen.LIBCMT ref: 003B4FDE
_wcslen.LIBCMT ref: 003B5039
_wcslen.LIBCMT ref: 003B5084
_wcslen.LIBCMT ref: 003B50EC

Part of subcall function 0035FD52: _wcslen.LIBCMT ref: 0035FD5D

GetDriveTypeW.KERNEL32(?,00407C10,00000061), ref: 003B5188

Strings

network, xrefs: 003B50E2, 003B50E7
cdrom, xrefs: 003B4FD4, 003B4FD9
removable, xrefs: 003B502F, 003B5034
ramdisk, xrefs: 003B5136
fixed, xrefs: 003B507A, 003B507F
unknown, xrefs: 003B514D
all, xrefs: 003B4F76, 003B4F7B

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: f3e8225cde9f0a577cf624d8fa4ee5725fdbbbcc3da1f9d9b53226d3c655f9f3
Instruction ID: cf6e25768bf241f7db65fb0c4bab2d3b35b9ab135a0b8c83010116192bb51789
Opcode Fuzzy Hash: f3e8225cde9f0a577cf624d8fa4ee5725fdbbbcc3da1f9d9b53226d3c655f9f3
Instruction Fuzzy Hash: 44B1E5316087029FC712EF28C890BAAB7E5BFA4718F51491DF6968B691D730EC44CB92

Function 003CBA59 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003CBBF8
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 003CBC10
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 003CBC34
_wcslen.LIBCMT ref: 003CBC60
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003CBC74
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003CBC96
_wcslen.LIBCMT ref: 003CBD92

Part of subcall function 003B0F4E: GetStdHandle.KERNEL32(000000F6), ref: 003B0F6D

_wcslen.LIBCMT ref: 003CBDAB
_wcslen.LIBCMT ref: 003CBDC6
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 003CBE16
GetLastError.KERNEL32(00000000), ref: 003CBE67
CloseHandle.KERNEL32(?), ref: 003CBE99
CloseHandle.KERNEL32(00000000), ref: 003CBEAA
CloseHandle.KERNEL32(00000000), ref: 003CBEBC
CloseHandle.KERNEL32(00000000), ref: 003CBECE
CloseHandle.KERNEL32(?), ref: 003CBF43

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 5ebb462d7e3e41f2ce2c583bea147a4cdaaa6b6477570325c51a7637ad7dbe43
Instruction ID: ba156f0cb7fe53d7092243bcdc5f12c92f84dbdb96c388142b51c22658384d2e
Opcode Fuzzy Hash: 5ebb462d7e3e41f2ce2c583bea147a4cdaaa6b6477570325c51a7637ad7dbe43
Instruction Fuzzy Hash: D0F18C356043009FC716EF24C896F6ABBE5AF85314F19895DF4868F2A2CB71EC45CB92

Function 003C4A46 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,003DDCD0), ref: 003C4B18
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 003C4B2A
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,003DDCD0), ref: 003C4B4F
FreeLibrary.KERNEL32(00000000,?,003DDCD0), ref: 003C4B9B
StringFromGUID2.OLE32(?,?,00000028,?,003DDCD0), ref: 003C4C05
SysFreeString.OLEAUT32(00000009), ref: 003C4CBF
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 003C4D25
SysFreeString.OLEAUT32(?), ref: 003C4D4F

Strings

GetModuleHandleExW, xrefs: 003C4B24
kernel32.dll, xrefs: 003C4B13

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 7485063ec5e8ea14b8e6a5000662e409c88c011fee9220ac5e5da269aceba2a1
Instruction ID: e521481e814bcc687652db325912c8bec35af5205182b39a1c0af278914bb5a7
Opcode Fuzzy Hash: 7485063ec5e8ea14b8e6a5000662e409c88c011fee9220ac5e5da269aceba2a1
Instruction Fuzzy Hash: C3122971A00105EFDB16DF94C894EAABBB9FF45314F25809CE809EB261D731ED46CBA0

Function 0034381F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(004129C0), ref: 00383F72
GetMenuItemCount.USER32(004129C0), ref: 00384022
GetCursorPos.USER32(?), ref: 00384066
SetForegroundWindow.USER32(00000000), ref: 0038406F
TrackPopupMenuEx.USER32(004129C0,00000000,?,00000000,00000000,00000000), ref: 00384082
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0038408E

Strings

0, xrefs: 0034382D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 40e623fc1efc404a8e40fc7affde35b814b5bd8cfea07bffe54c9af56a83c2e0
Instruction ID: e3a342fadf0f81c893135f995b321165fd8281db3bedb052836734b47cd3f455
Opcode Fuzzy Hash: 40e623fc1efc404a8e40fc7affde35b814b5bd8cfea07bffe54c9af56a83c2e0
Instruction Fuzzy Hash: A8710971A44305BEEB239F28DC49FAAFF69FF05764F100256F6146A2E0C771A914DB90

Function 003D7711 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 003D7823

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 003D7897
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 003D78B9
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003D78CC
DestroyWindow.USER32(?), ref: 003D78ED
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00340000,00000000), ref: 003D791C
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003D7935
GetDesktopWindow.USER32 ref: 003D794E
GetWindowRect.USER32(00000000), ref: 003D7955
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 003D796D
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 003D7985

Part of subcall function 00342234: GetWindowLongW.USER32(?,000000EB), ref: 00342242

Strings

0, xrefs: 003D77D0
tooltips_class32, xrefs: 003D7890, 003D7915

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: f6252090f245e57cbf9409af2c7208486af25789929fa17683388dd40d278d19
Instruction ID: f3c54adc9a42179bac71ab02ff098a23a868db16b95106c9e08c5a797d0827cf
Opcode Fuzzy Hash: f6252090f245e57cbf9409af2c7208486af25789929fa17683388dd40d278d19
Instruction Fuzzy Hash: 7A717972204245AFD722CF28EC48FAABBE9EB89304F04446FF98587361D770A906DB15

Function 0034146D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00341802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00341488,?,00000000,?,?,?,?,0034145A,00000000,?), ref: 00341865

DestroyWindow.USER32(?), ref: 00341521
KillTimer.USER32(00000000,?,?,?,?,0034145A,00000000,?), ref: 003415BB
DestroyAcceleratorTable.USER32(00000000), ref: 003829B4
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,0034145A,00000000,?), ref: 003829E2
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,0034145A,00000000,?), ref: 003829F9
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0034145A,00000000), ref: 00382A15
DeleteObject.GDI32(00000000), ref: 00382A27

Strings

<)A, xrefs: 003415E0

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: <)A
API String ID: 641708696-2544708363
Opcode ID: ae467127cdcb6dfc1cae23aab000f5cc90a601ad5e9fd0cf9fa411961b2bb7d9
Instruction ID: a7e7c6aade2f2724897aa1a05d2fed5be6022cf7adc27f53c20ed7f809bed6d6
Opcode Fuzzy Hash: ae467127cdcb6dfc1cae23aab000f5cc90a601ad5e9fd0cf9fa411961b2bb7d9
Instruction Fuzzy Hash: 5B616C31611B11DFDB3B9F18DA48B6A77F5FF81312F118169E4429AA60C7B4B8A0DB48

Function 003BCEBB Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003BCEF5
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 003BCF08
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 003BCF1C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 003BCF35
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 003BCF78
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 003BCF8E
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003BCF99
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003BCFC9
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 003BD021
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 003BD035
InternetCloseHandle.WININET(00000000), ref: 003BD040

Strings

, xrefs: 003BCFBA

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 683f3c6d633f7b4c4a3b5566a6f3dd9bc5b0bcf3d6fe2bbf5bcdeedf5e5edbc8
Instruction ID: d47657668eb1375ba7778eae2df5d2ff5498502465ac7ffb596163461c381ce9
Opcode Fuzzy Hash: 683f3c6d633f7b4c4a3b5566a6f3dd9bc5b0bcf3d6fe2bbf5bcdeedf5e5edbc8
Instruction Fuzzy Hash: CA515CB1501608BFDB229F60DC88AFB7BBCFF48758F00441AFA4696A50E735D945AB60

Function 003D8FCB Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,003D66D6,?,?), ref: 003D8FEE
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,003D66D6,?,?,00000000,?), ref: 003D8FFE
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,003D66D6,?,?,00000000,?), ref: 003D9009
CloseHandle.KERNEL32(00000000,?,?,?,?,003D66D6,?,?,00000000,?), ref: 003D9016
GlobalLock.KERNEL32(00000000), ref: 003D9024
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,003D66D6,?,?,00000000,?), ref: 003D9033
GlobalUnlock.KERNEL32(00000000), ref: 003D903C
CloseHandle.KERNEL32(00000000,?,?,?,?,003D66D6,?,?,00000000,?), ref: 003D9043
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,003D66D6,?,?,00000000,?), ref: 003D9054
OleLoadPicture.OLEAUT32(?,00000000,00000000,003E0C04,?), ref: 003D906D
GlobalFree.KERNEL32(00000000), ref: 003D907D
GetObjectW.GDI32(00000000,00000018,?), ref: 003D909D
CopyImage.USER32(00000000,00000000,00000000,?,00002000), ref: 003D90CD
DeleteObject.GDI32(00000000), ref: 003D90F5
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 003D910B

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: a74ab519a0398fe1abded87834e0efd4d25da6f1004cb55dbe00009cf66b135f
Instruction ID: d5b46e716de95dd36043b076d5e0236b0ce1242d59caef498f0de5ca532c4e6f
Opcode Fuzzy Hash: a74ab519a0398fe1abded87834e0efd4d25da6f1004cb55dbe00009cf66b135f
Instruction Fuzzy Hash: 0F412875601208BFDB229F65EC88EAA7BBCFF89711F10845AF905EB260D7709D41DB60

Function 003CC06E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003CD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CC10E,?,?), ref: 003CD415
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD451
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD4C8
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CC154
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003CC1D2
RegDeleteValueW.ADVAPI32(?,?), ref: 003CC26A
RegCloseKey.ADVAPI32(?), ref: 003CC2DE
RegCloseKey.ADVAPI32(?), ref: 003CC2FC
LoadLibraryA.KERNEL32(advapi32.dll), ref: 003CC352
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 003CC364
RegDeleteKeyW.ADVAPI32(?,?), ref: 003CC382
FreeLibrary.KERNEL32(00000000), ref: 003CC3E3
RegCloseKey.ADVAPI32(00000000), ref: 003CC3F4

Strings

RegDeleteKeyExW, xrefs: 003CC35E
advapi32.dll, xrefs: 003CC34D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: b54aab426d8bfae6cc4bae7f50d57770f8804fdd484888fae66c5dbef04e7270
Instruction ID: 95b4c29b0d178c4a1940055c1b981a870615d18978320a346d0685d792cc51c7
Opcode Fuzzy Hash: b54aab426d8bfae6cc4bae7f50d57770f8804fdd484888fae66c5dbef04e7270
Instruction Fuzzy Hash: 41C18C35214241AFD712DF14C894F2ABBE5FF85304F19989CE45A8F2A2CB35EC46CB91

Function 003DA94F Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 271windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

GetSystemMetrics.USER32(0000000F), ref: 003DA990
GetSystemMetrics.USER32(00000011), ref: 003DA9A7
GetSystemMetrics.USER32(00000004), ref: 003DA9B3
GetSystemMetrics.USER32(0000000F), ref: 003DA9C9
MoveWindow.USER32(00000003,?,?,00000001,?,00000000,?,00000000,?,00000000), ref: 003DAC15
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 003DAC33
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 003DAC54
ShowWindow.USER32(00000003,00000000), ref: 003DAC73
InvalidateRect.USER32(?,00000000,00000001), ref: 003DAC95
DefDlgProcW.USER32(?,00000005,?), ref: 003DACBB

Strings

@, xrefs: 003DABD0
(A, xrefs: 003DA95B

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MetricsSystem$Window$MessageSend$InvalidateLongMoveProcRectShow
String ID: @$(A
API String ID: 3962739598-1003442442
Opcode ID: da73482d1a34c4a8f641d58e59eef07abff4f6ab4f1d265beb24bebe1282edf7
Instruction ID: abc73b423d4cd13f0035741d59a256f34b4fadd368db25ddc31816503197b936
Opcode Fuzzy Hash: da73482d1a34c4a8f641d58e59eef07abff4f6ab4f1d265beb24bebe1282edf7
Instruction Fuzzy Hash: 55B1AB72600619EFCF16CF68DA847AE3BF2FF44711F15806AEC449B295D770A990CB51

Function 003D976A Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 003D97B6
GetFocus.USER32 ref: 003D97C6
GetDlgCtrlID.USER32(00000000), ref: 003D97D1
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?), ref: 003D9879
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 003D992B
GetMenuItemCount.USER32(?), ref: 003D9948
GetMenuItemID.USER32(?,00000000), ref: 003D9958
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 003D998A
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 003D99CC
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 003D99FD

Strings

0, xrefs: 003D98FB
(A, xrefs: 003D9779

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0$(A
API String ID: 1026556194-3618079009
Opcode ID: 5b92d321da3885f7a9cecee9583b405f42001820a8c580f1f15a1f97065532d1
Instruction ID: 2bba838b07dcf180548a615613cdc5f26d3825ba5c7c33c4d9128ac1ea73fc38
Opcode Fuzzy Hash: 5b92d321da3885f7a9cecee9583b405f42001820a8c580f1f15a1f97065532d1
Instruction Fuzzy Hash: E9819C72604301ABD712CF24E884BAB7BE8FB89714F014A1FF98597391DB70D905DBA2

Function 003C2FB9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 003C3035
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 003C3045
CreateCompatibleDC.GDI32(?), ref: 003C3051
SelectObject.GDI32(00000000,?), ref: 003C305E
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 003C30CA
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 003C3109
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 003C312D
SelectObject.GDI32(?,?), ref: 003C3135
DeleteObject.GDI32(?), ref: 003C313E
DeleteDC.GDI32(?), ref: 003C3145
ReleaseDC.USER32(00000000,?), ref: 003C3150

Strings

(, xrefs: 003C30EA

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: b38dd26c874898c7dfa60dfee10b254070eb690b4dd650254933c92e29ce96bf
Instruction ID: 7e488b24c6ee5e68106dd2b98232dc9893f3138f8d3ac49399e1e72d5c1da033
Opcode Fuzzy Hash: b38dd26c874898c7dfa60dfee10b254070eb690b4dd650254933c92e29ce96bf
Instruction Fuzzy Hash: 1F61D276D01219AFCF05CFA8D885EAEBBB9FF48310F20851AE556A7250D771AE41CF90

Function 003AC8F7 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(004129C0,000000FF,00000000,00000030), ref: 003AC973
SetMenuItemInfoW.USER32(004129C0,00000004,00000000,00000030), ref: 003AC9A8
Sleep.KERNEL32(000001F4), ref: 003AC9BA
GetMenuItemCount.USER32(?), ref: 003ACA00
GetMenuItemID.USER32(?,00000000), ref: 003ACA1D
GetMenuItemID.USER32(?,-00000001), ref: 003ACA49
GetMenuItemID.USER32(?,?), ref: 003ACA90
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 003ACAD6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003ACAEB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003ACB0C

Strings

0, xrefs: 003AC904

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 87697208d0649927772ad5b9529e732b2d171ac384edb0abcbe00496c66e6ad1
Instruction ID: 614d7ecad14c055b55005784b31677bcef09e1172b569af2ddaedc1966577905
Opcode Fuzzy Hash: 87697208d0649927772ad5b9529e732b2d171ac384edb0abcbe00496c66e6ad1
Instruction Fuzzy Hash: FB619D70920249AFDF12CFA8DD89AFEBBB9FB06344F045159E812A7251D731AD14CB60

Function 003AE4C2 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 003AE4D4
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 003AE4FA
_wcslen.LIBCMT ref: 003AE504
_wcsstr.LIBVCRUNTIME ref: 003AE554
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 003AE570

Strings

StringFileInfo\, xrefs: 003AE543
\VarFileInfo\Translation, xrefs: 003AE568
%u.%u.%u.%u, xrefs: 003AE64E
04090000, xrefs: 003AE5A6
DefaultLangCodepage, xrefs: 003AE5D3

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: b5d4c8a79513afdd5d38ba432c0fe5f7895a862b8ef53669647acbb0454f2324
Instruction ID: 869fca14d5f845959d9690fd74e3e5411a24548074a5b71d15b68bfef58fc84b
Opcode Fuzzy Hash: b5d4c8a79513afdd5d38ba432c0fe5f7895a862b8ef53669647acbb0454f2324
Instruction Fuzzy Hash: F04118729402047ADB07BB64DC47FBF77ACDF56710F108066F901AA192FB78EA0192A5

Function 003CD694 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 003CD6C4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 003CD6ED
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 003CD7A8

Part of subcall function 003CD694: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 003CD70A
Part of subcall function 003CD694: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 003CD71D
Part of subcall function 003CD694: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 003CD72F
Part of subcall function 003CD694: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 003CD765
Part of subcall function 003CD694: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 003CD788

RegDeleteKeyW.ADVAPI32(?,?), ref: 003CD753

Strings

RegDeleteKeyExW, xrefs: 003CD729
advapi32.dll, xrefs: 003CD718

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 25bf4a4240cceeba522e7b9fc402f8b2ebc1ae55dc7e36899d6f3c20a901572b
Instruction ID: f5e379c0920532ceab520a547102bbbaccc87a51362a7371c9fe59b771287cac
Opcode Fuzzy Hash: 25bf4a4240cceeba522e7b9fc402f8b2ebc1ae55dc7e36899d6f3c20a901572b
Instruction Fuzzy Hash: 7C315E72902129BBD7229F50DC88EFFBB7CEF45750F01016AB806E2140DA349E459BA0

Function 003AEFC7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 003AEFCB

Part of subcall function 0035F215: timeGetTime.WINMM(?,?,003AEFEB), ref: 0035F219

Sleep.KERNEL32(0000000A), ref: 003AEFF8
EnumThreadWindows.USER32(?,Function_0006EF7C,00000000), ref: 003AF01C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 003AF03E
SetActiveWindow.USER32 ref: 003AF05D
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 003AF06B
SendMessageW.USER32(00000010,00000000,00000000), ref: 003AF08A
Sleep.KERNEL32(000000FA), ref: 003AF095
IsWindow.USER32 ref: 003AF0A1
EndDialog.USER32(00000000), ref: 003AF0B2

Strings

BUTTON, xrefs: 003AF030

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: a6bfb255c9e1738e1dd5fc9972d0c343b8432d39cc2d8b3cf1f8ac912196e662
Instruction ID: 54d962f8c8c9997ff222998890b9d070bec51dcd45b2c78eafb41536412b8421
Opcode Fuzzy Hash: a6bfb255c9e1738e1dd5fc9972d0c343b8432d39cc2d8b3cf1f8ac912196e662
Instruction Fuzzy Hash: C7219375501214BFE723AF70FC89BA67B6DF74A74AF014036F50182272CB719C548665

Function 003AF313 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 003AF374
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 003AF38A
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003AF39B
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 003AF3AD
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 003AF3BE

Strings

play PlayMe, xrefs: 003AF3B9
close PlayMe, xrefs: 003AF385, 003AF3B2
status PlayMe mode, xrefs: 003AF36F
open , xrefs: 003AF323
play PlayMe wait, xrefs: 003AF3A8
alias PlayMe, xrefs: 003AF34D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: d3f6b3f5709b70dd53630f3975ae96766b378a2e5955ba30d8c5c52388a41787
Instruction ID: c93c45fe18146e3e9b507f44a36a789229a08fb96f35235fc31770103bf10d16
Opcode Fuzzy Hash: d3f6b3f5709b70dd53630f3975ae96766b378a2e5955ba30d8c5c52388a41787
Instruction Fuzzy Hash: 6C11E775E801587DE711A7A28C4AFFFBABCEBD3B00F00043A7401EA0D1DA706905C5B2

Function 00372FF3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00373007

Part of subcall function 00372D38: RtlFreeHeap.NTDLL(00000000,00000000,?,0037DB51,00411DC4,00000000,00411DC4,00000000,?,0037DB78,00411DC4,00000007,00411DC4,?,0037DF75,00411DC4), ref: 00372D4E
Part of subcall function 00372D38: GetLastError.KERNEL32(00411DC4,?,0037DB51,00411DC4,00000000,00411DC4,00000000,?,0037DB78,00411DC4,00000007,00411DC4,?,0037DF75,00411DC4,00411DC4), ref: 00372D60

_free.LIBCMT ref: 00373013
_free.LIBCMT ref: 0037301E
_free.LIBCMT ref: 00373029
_free.LIBCMT ref: 00373034
_free.LIBCMT ref: 0037303F
_free.LIBCMT ref: 0037304A
_free.LIBCMT ref: 00373055
_free.LIBCMT ref: 00373060
_free.LIBCMT ref: 0037306E

Strings

&>, xrefs: 00372FFE

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: &>
API String ID: 776569668-3868068371
Opcode ID: 63487ee84e0b494fa38dd8b07e6b283cf49869266c87269bf230f14a9f36dfa4
Instruction ID: db77c6bf56685ede5071d1bf406b40b465780bb7771b490f829f2561cdc1a851
Opcode Fuzzy Hash: 63487ee84e0b494fa38dd8b07e6b283cf49869266c87269bf230f14a9f36dfa4
Instruction Fuzzy Hash: 94118676500108FFCB22EF94C842DDE3BA5EF09350F9185A5FA1C9F222DA35EE519B90

Function 003AA958 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 003AA9D9
SetKeyboardState.USER32(?), ref: 003AAA44
GetAsyncKeyState.USER32(000000A0), ref: 003AAA64
GetKeyState.USER32(000000A0), ref: 003AAA7B
GetAsyncKeyState.USER32(000000A1), ref: 003AAAAA
GetKeyState.USER32(000000A1), ref: 003AAABB
GetAsyncKeyState.USER32(00000011), ref: 003AAAE7
GetKeyState.USER32(00000011), ref: 003AAAF5
GetAsyncKeyState.USER32(00000012), ref: 003AAB1E
GetKeyState.USER32(00000012), ref: 003AAB2C
GetAsyncKeyState.USER32(0000005B), ref: 003AAB55
GetKeyState.USER32(0000005B), ref: 003AAB63

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: af26516710993bd595140aec3c0b5aa24918227953c65df4fc9e37916d9f3a28
Instruction ID: 3b635c2e873ef58a96d854fdcf3ca57fbd16993e7f8db62067a7b04fb7dcf230
Opcode Fuzzy Hash: af26516710993bd595140aec3c0b5aa24918227953c65df4fc9e37916d9f3a28
Instruction Fuzzy Hash: 7751B561A04B8829EB36DB608954BAABFF5DF13340F09459E85C25B1C2DB649B4CC762

Function 003A662D Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 003A6649
GetWindowRect.USER32(00000000,?), ref: 003A6662
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 003A66C0
GetDlgItem.USER32(?,00000002), ref: 003A66D0
GetWindowRect.USER32(00000000,?), ref: 003A66E2
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 003A6736
GetDlgItem.USER32(?,000003E9), ref: 003A6744
GetWindowRect.USER32(00000000,?), ref: 003A6756
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 003A6798
GetDlgItem.USER32(?,000003EA), ref: 003A67AB
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 003A67C1
InvalidateRect.USER32(?,00000000,00000001), ref: 003A67CE

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: b83d1026b00fe71f934f569ad199c89ee8c0f78342bda505df878223dd052d3b
Instruction ID: 0736baa995c01be66ad8494dbc6ce8913ba8e4d1c3114ee68d7531550907957a
Opcode Fuzzy Hash: b83d1026b00fe71f934f569ad199c89ee8c0f78342bda505df878223dd052d3b
Instruction Fuzzy Hash: 99513FB1B01205AFDF19CF68DD8AAAEBBB9FB48314F548129F519E7290D7719E008B50

Function 00342128 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00342234: GetWindowLongW.USER32(?,000000EB), ref: 00342242

GetSysColor.USER32(0000000F), ref: 00342152

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: b3b263bdba1acade874b05861400645f929ea6b83f5544abc1551932e91afb73
Instruction ID: bff5ec5d23a3ab31be87ce6076b6f68108f5dcc0fa1599dc82415379ec32cb50
Opcode Fuzzy Hash: b3b263bdba1acade874b05861400645f929ea6b83f5544abc1551932e91afb73
Instruction Fuzzy Hash: 1141C531141740AFDB225F38DC84BBA3BA9EB42730F564655FAA29B2E1C731AD42DB11

Function 003413A6 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 003828D1
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 003828EA
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 003828FA
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00382912
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00382933
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,003411F5,00000000,00000000,00000000,000000FF,00000000), ref: 00382942
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0038295F
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,003411F5,00000000,00000000,00000000,000000FF,00000000), ref: 0038296E

Strings

(A, xrefs: 00382885

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: (A
API String ID: 1268354404-3099020080
Opcode ID: 91c0a905748eebe4921fb0539230cfb1f3933ed391803b1fe714d3c37456642f
Instruction ID: c9df01a78c51b381ffb8efd16870634f6ef1682f5d7b008fa4c036c9b2d3ad2b
Opcode Fuzzy Hash: 91c0a905748eebe4921fb0539230cfb1f3933ed391803b1fe714d3c37456642f
Instruction Fuzzy Hash: A3519970600709AFDB26DF26CC45BAA7BF9FF48320F108529F9429B6A0D770E990DB50

Function 003D955E Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

Part of subcall function 003419CD: GetCursorPos.USER32(?), ref: 003419E1
Part of subcall function 003419CD: ScreenToClient.USER32(00000000,?), ref: 003419FE
Part of subcall function 003419CD: GetAsyncKeyState.USER32(00000001), ref: 00341A23
Part of subcall function 003419CD: GetAsyncKeyState.USER32(00000002), ref: 00341A3D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?), ref: 003D95C7
ImageList_EndDrag.COMCTL32 ref: 003D95CD
ReleaseCapture.USER32 ref: 003D95D3
SetWindowTextW.USER32(?,00000000), ref: 003D966E
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 003D9681
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?), ref: 003D975B

Strings

@GUI_DRAGFILE, xrefs: 003D96F6
(A, xrefs: 003D9728
@GUI_DROPID, xrefs: 003D96AD
(A, xrefs: 003D956D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$(A$(A
API String ID: 1924731296-852452532
Opcode ID: 25a8bb141417ab91a806e175b4840cf3affc25fdccf18bbe372a65ca28436c64
Instruction ID: f14d90386e69716ddb95b09ff8abbc9eb74e218613eb5fcf3dc5fb155b921ae7
Opcode Fuzzy Hash: 25a8bb141417ab91a806e175b4840cf3affc25fdccf18bbe372a65ca28436c64
Instruction Fuzzy Hash: F151A175204300AFD705EF24DC56FAA77E4FB88714F40062EF9959B2E1DB74A908CB52

Function 003AA05C Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00390D31,00000001,0000138C,00000001,00000000,00000001,?,003BEEAE,00412430), ref: 003AA091
LoadStringW.USER32(00000000,?,00390D31,00000001), ref: 003AA09A

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00390D31,00000001,0000138C,00000001,00000000,00000001,?,003BEEAE,00412430,?), ref: 003AA0BC
LoadStringW.USER32(00000000,?,00390D31,00000001), ref: 003AA0BF
MessageBoxW.USER32(00000000,?,?,00011010), ref: 003AA1E0

Strings

^ ERROR, xrefs: 003AA175
Line %d:, xrefs: 003AA11A
%s (%d) : ==> %s: %s %s, xrefs: 003AA1C4
Line %d (File "%s"):, xrefs: 003AA109
Error: , xrefs: 003AA197

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: f8dd86a7210e137e61de547fd1b806fc3a0e6cdf120eaab575665695b01db5ce
Instruction ID: c5aeeab708705b217c1aebaf857c3ef123c7c7f0df29a2be423fe2c0295bd9e1
Opcode Fuzzy Hash: f8dd86a7210e137e61de547fd1b806fc3a0e6cdf120eaab575665695b01db5ce
Instruction Fuzzy Hash: 4F413272800509AACF06FFE0DD46DEEB7B8EF15340F500065B505BA092DB75AF49CB62

Function 003A0FCF Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003A1093
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003A10AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003A10CB
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 003A10F5
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 003A111D
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 003A1128
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 003A112D

Strings

SOFTWARE\Classes\, xrefs: 003A0FFF
\IPC$, xrefs: 003A1075
\CLSID, xrefs: 003A1015

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 483cddf11a3a0ab2402c395b8e865ad6055968fa69b3f5017f5c160987621c9a
Instruction ID: 680bd819cd4c4d1ffaf0578c500bf85e5d910202e02f8ad8c45af5e852f4b6c9
Opcode Fuzzy Hash: 483cddf11a3a0ab2402c395b8e865ad6055968fa69b3f5017f5c160987621c9a
Instruction Fuzzy Hash: F841FA72C10229ABCF16EFA4DC45DEEB7B8FF04750F01416AE901AA161EB31AE04CF50

Function 003D4A34 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 003D4AD9
CreateCompatibleDC.GDI32(00000000), ref: 003D4AE0
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 003D4AF3
SelectObject.GDI32(00000000,00000000), ref: 003D4AFB
GetPixel.GDI32(00000000,00000000,00000000), ref: 003D4B06
DeleteDC.GDI32(00000000), ref: 003D4B10
GetWindowLongW.USER32(?,000000EC), ref: 003D4B1A
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 003D4B30
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 003D4B3C

Strings

static, xrefs: 003D4A71

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 487a20b3f85f63ebbacfd4b1ceecd88a0abf93905b1396169c8f5e23b2523219
Instruction ID: bb54231962aeee1901bff7c9fdf8843339d266d2dc75ff95c9f9d8e0051131cd
Opcode Fuzzy Hash: 487a20b3f85f63ebbacfd4b1ceecd88a0abf93905b1396169c8f5e23b2523219
Instruction Fuzzy Hash: 2D316E32141215BBDF139FA4EC09FDA3BADFF09324F110212FA59A62A0C775D860DB94

Function 003C468D Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003C46B9
CoInitialize.OLE32(00000000), ref: 003C46E7
CoUninitialize.OLE32 ref: 003C46F1
_wcslen.LIBCMT ref: 003C478A
GetRunningObjectTable.OLE32(00000000,?), ref: 003C480E
SetErrorMode.KERNEL32(00000001,00000029), ref: 003C4932
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 003C496B
CoGetObject.OLE32(?,00000000,003E0B64,?), ref: 003C498A
SetErrorMode.KERNEL32(00000000), ref: 003C499D
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 003C4A21
VariantClear.OLEAUT32(?), ref: 003C4A35

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 60879e3a0da3c4bde18edb921836e7081539e0897ec963d2c45fa45f77832433
Instruction ID: 7f29feed12ec0617fda9a2b9c361c827f408d500c351a5d9a038f3a2d1fbcd81
Opcode Fuzzy Hash: 60879e3a0da3c4bde18edb921836e7081539e0897ec963d2c45fa45f77832433
Instruction Fuzzy Hash: 21C10F71604305AF9702DF68C894E6ABBE9FF89748F00491DF98ADB250DB31ED45CB52

Function 003B84DB Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 003B8538
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 003B85D4
SHGetDesktopFolder.SHELL32(?), ref: 003B85E8
CoCreateInstance.OLE32(003E0CD4,00000000,00000001,00407E8C,?), ref: 003B8634
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 003B86B9
CoTaskMemFree.OLE32(?,?), ref: 003B8711
SHBrowseForFolderW.SHELL32(?), ref: 003B879C
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 003B87BF
CoTaskMemFree.OLE32(00000000), ref: 003B87C6
CoTaskMemFree.OLE32(00000000), ref: 003B881B
CoUninitialize.OLE32 ref: 003B8821

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 875fdba7553828f0d1cfb1388c5dfc34e8125c2b05ee20586611951cb8d46dbb
Instruction ID: 2daeb827c875f2a030c9275c61003eb1c7ed1acf98372ad192ff9d176a57d279
Opcode Fuzzy Hash: 875fdba7553828f0d1cfb1388c5dfc34e8125c2b05ee20586611951cb8d46dbb
Instruction Fuzzy Hash: EFC11B75A00109AFCB15DFA4C884DAEBBF9FF48308B158499F519DB661DB30EE45CB90

Function 003A0378 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 003A039F
SafeArrayAllocData.OLEAUT32(?), ref: 003A03F8
VariantInit.OLEAUT32(?), ref: 003A040A
SafeArrayAccessData.OLEAUT32(?,?), ref: 003A042A
VariantCopy.OLEAUT32(?,?), ref: 003A047D
SafeArrayUnaccessData.OLEAUT32(?), ref: 003A0491
VariantClear.OLEAUT32(?), ref: 003A04A6
SafeArrayDestroyData.OLEAUT32(?), ref: 003A04B3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003A04BC
VariantClear.OLEAUT32(?), ref: 003A04CE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003A04D9

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 0d58233b5fea10395f3281acd17a825a72d99c2cc021fe9751ae2edd1a901a60
Instruction ID: ab8e5e52e07363efb70ab3b30be0a024731cebfde941528c3d88048460378b09
Opcode Fuzzy Hash: 0d58233b5fea10395f3281acd17a825a72d99c2cc021fe9751ae2edd1a901a60
Instruction Fuzzy Hash: 3F418135A00219EFCF06DFA5D8849EEBBBDFF49344F018069E915AB261CB34A945CF90

Function 003AA635 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 003AA65D
GetAsyncKeyState.USER32(000000A0), ref: 003AA6DE
GetKeyState.USER32(000000A0), ref: 003AA6F9
GetAsyncKeyState.USER32(000000A1), ref: 003AA713
GetKeyState.USER32(000000A1), ref: 003AA728
GetAsyncKeyState.USER32(00000011), ref: 003AA740
GetKeyState.USER32(00000011), ref: 003AA752
GetAsyncKeyState.USER32(00000012), ref: 003AA76A
GetKeyState.USER32(00000012), ref: 003AA77C
GetAsyncKeyState.USER32(0000005B), ref: 003AA794
GetKeyState.USER32(0000005B), ref: 003AA7A6

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: bd9f00d05561338335b7271425135d790e6ce1a98ddee986b66a045b8af3b173
Instruction ID: 4802317ca365a0dc3cadae34bdf561b7aafa0244b6b71d46bf36cee8bcf2ac3b
Opcode Fuzzy Hash: bd9f00d05561338335b7271425135d790e6ce1a98ddee986b66a045b8af3b173
Instruction Fuzzy Hash: 1741D365504FC969FF3386A098043A6BFF0EB13304F0A805AD5C64A1C2EB9599C8CBA3

Function 003C9730 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 003C9750

Part of subcall function 003A9805: _wcslen.LIBCMT ref: 003A9828

_wcslen.LIBCMT ref: 003C97AB
_wcslen.LIBCMT ref: 003C97F9
_wcslen.LIBCMT ref: 003C9839
_wcslen.LIBCMT ref: 003C98CB

Strings

cdecl, xrefs: 003C97A5, 003C97AA
winapi, xrefs: 003C97F3, 003C97F8
none, xrefs: 003C98C2, 003C98C7
stdcall, xrefs: 003C9833, 003C9838

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 5a3ebb148de9bb318983c67122d9b5e0e7b571241c2b5ac3cf3f73597abc19b4
Instruction ID: 9f6d210cada233b7348ac05430ddc1c13f45b9d63e4624e69218158255cf364d
Opcode Fuzzy Hash: 5a3ebb148de9bb318983c67122d9b5e0e7b571241c2b5ac3cf3f73597abc19b4
Instruction Fuzzy Hash: 1851C431A005169BCB15DF68C954FBEB3A5BF15350B23422EF866EB684D735ED40C790

Function 003C4189 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 003C41D1
CoUninitialize.OLE32 ref: 003C41DC
CoCreateInstance.OLE32(?,00000000,00000017,003E0B44,?), ref: 003C4236
IIDFromString.OLE32(?,?), ref: 003C42A9
VariantInit.OLEAUT32(?), ref: 003C4341
VariantClear.OLEAUT32(?), ref: 003C4393

Strings

Failed to create object, xrefs: 003C4241, 003C42F7
Invalid parameter, xrefs: 003C42C2
NULL Pointer assignment, xrefs: 003C427B

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 84b74fccd5f4b57e5c82f1d4047efe19e3c227fe6e39422716f6bfbf2e22ee45
Instruction ID: ce73733a21005a7954d972d54af80b9e1103c04c6d8fe7cbbc72d73442667653
Opcode Fuzzy Hash: 84b74fccd5f4b57e5c82f1d4047efe19e3c227fe6e39422716f6bfbf2e22ee45
Instruction Fuzzy Hash: 2E619E71608701AFC312DF64D899F5ABBE8AF89714F00091EF981DB291D770ED48CB92

Function 003B8BDA Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 003B8C9C
SystemTimeToFileTime.KERNEL32(?,?), ref: 003B8CAC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 003B8CB8
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003B8D55
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8D69
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8D9B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 003B8DD1
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8DDA

Strings

*.*, xrefs: 003B8DE0

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 84c25d88aa8bb8317e4ad089ee9ed4a449a73a7792e96556e934c2cc802b546f
Instruction ID: 3c5a7b47bfc032b85dd99a46cda0fa75f3476387b7583be3ba5c095929a93022
Opcode Fuzzy Hash: 84c25d88aa8bb8317e4ad089ee9ed4a449a73a7792e96556e934c2cc802b546f
Instruction Fuzzy Hash: C8615AB2504305AFCB11EF60C84599EB7ECFF89314F04482EFA898B651DB35E945CBA2

Function 003D46E2 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 003D4715
SetMenu.USER32(?,00000000), ref: 003D4724
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003D47AC
IsMenu.USER32(?), ref: 003D47C0
CreatePopupMenu.USER32 ref: 003D47CA
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003D47F7
DrawMenuBar.USER32 ref: 003D47FF

Strings

0, xrefs: 003D46F0
F, xrefs: 003D47EA

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 399a6752663d63974c76ed2c518c6cdb1c8da188cfa991ef91d1cc9bd0162d4a
Instruction ID: a9df874dc550751ea624f9cf7f8d707f63192c30c9bf6e158a709ac3eacc4c3f
Opcode Fuzzy Hash: 399a6752663d63974c76ed2c518c6cdb1c8da188cfa991ef91d1cc9bd0162d4a
Instruction Fuzzy Hash: A241AB76A02309EFDB16CF64E844EAA7BBAFF0A314F15402AFA4597350C771A924CF50

Function 003A282C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003A45FD: GetClassNameW.USER32(?,?,000000FF), ref: 003A4620

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 003A28B1
GetDlgCtrlID.USER32 ref: 003A28BC
GetParent.USER32 ref: 003A28D8
SendMessageW.USER32(00000000,?,00000111,?), ref: 003A28DB
GetDlgCtrlID.USER32(?), ref: 003A28E4
GetParent.USER32(?), ref: 003A28F8
SendMessageW.USER32(00000000,?,00000111,?), ref: 003A28FB

Strings

ListBox, xrefs: 003A286E
ComboBox, xrefs: 003A2839

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 6466e423c83de49112bf995c4398678d8eec5e2a1a9b1dd759af54b3492f23e9
Instruction ID: 426fa8d7354e716f80126206a8162500acb76c68087f4543b18b7e53993c67a0
Opcode Fuzzy Hash: 6466e423c83de49112bf995c4398678d8eec5e2a1a9b1dd759af54b3492f23e9
Instruction Fuzzy Hash: D221B074D00118BBCF06AFA4DC85EEEBBB8EF06310F500156B951AB2D1DB799818DF60

Function 003A290D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003A45FD: GetClassNameW.USER32(?,?,000000FF), ref: 003A4620

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 003A2990
GetDlgCtrlID.USER32 ref: 003A299B
GetParent.USER32 ref: 003A29B7
SendMessageW.USER32(00000000,?,00000111,?), ref: 003A29BA
GetDlgCtrlID.USER32(?), ref: 003A29C3
GetParent.USER32(?), ref: 003A29D7
SendMessageW.USER32(00000000,?,00000111,?), ref: 003A29DA

Strings

ListBox, xrefs: 003A294F
ComboBox, xrefs: 003A291A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 917607752c643dad2229193549545cd2e12411e0c11575a3f980529037fb8fc7
Instruction ID: dfd9fcfc68507d46e97cb291af4776da4bcbaa4e69ae58ea629489b99136b111
Opcode Fuzzy Hash: 917607752c643dad2229193549545cd2e12411e0c11575a3f980529037fb8fc7
Instruction Fuzzy Hash: AB218E75D00218BBCF06AFA4DC85EEFBBB8EF16700F504056B991AB191CB799819DB60

Function 003D44BF Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 003D4539
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 003D453C
GetWindowLongW.USER32(?,000000F0), ref: 003D4563
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 003D4586
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 003D45FE
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 003D4648
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 003D4663
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 003D467E
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 003D4692
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 003D46AF

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: a9b83100d88ad704a1894b4cf83bb791af6e33d3348c3c391c55293fba827adf
Instruction ID: 15329263ba13184b234236e9b492ee366ca401c5724951950934ed4a9fd66c2c
Opcode Fuzzy Hash: a9b83100d88ad704a1894b4cf83bb791af6e33d3348c3c391c55293fba827adf
Instruction Fuzzy Hash: 19617C75A00208AFDB12DFA8DD81EEE77B8EB09710F10415AFA05EB3A1C7B4A955DB50

Function 003ABAF6 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003ABB18
GetForegroundWindow.USER32(00000000,?,?,?,?,?,003AABA8,?,00000001), ref: 003ABB2C
GetWindowThreadProcessId.USER32(00000000), ref: 003ABB33
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003AABA8,?,00000001), ref: 003ABB42
GetWindowThreadProcessId.USER32(?,00000000), ref: 003ABB54
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,003AABA8,?,00000001), ref: 003ABB6D
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003AABA8,?,00000001), ref: 003ABB7F
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,003AABA8,?,00000001), ref: 003ABBC4
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,003AABA8,?,00000001), ref: 003ABBD9
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,003AABA8,?,00000001), ref: 003ABBE4

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 028a8dd4f790aca23a55f6e7a0d78d387b138c5122f866fb9ce36a174631799f
Instruction ID: 47dc7d29f975bf87683006c163e4d9f7aa812262f62c7e35bc80716f22a7dc2e
Opcode Fuzzy Hash: 028a8dd4f790aca23a55f6e7a0d78d387b138c5122f866fb9ce36a174631799f
Instruction Fuzzy Hash: A331C1B1905204AFDB12DB15EC84FA9BBBDEB8A312F128026FA05C71A1C774D8408B74

Function 00342AB0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00342AF9
OleUninitialize.OLE32(?,00000000), ref: 00342B98
UnregisterHotKey.USER32(?), ref: 00342D7D
DestroyWindow.USER32(?), ref: 00383A1B
FreeLibrary.KERNEL32(?), ref: 00383A80
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00383AAD

Strings

close all, xrefs: 00342AF4

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: df34b1cf13ab95bf7c1fa0909178cf975a831b56b160f13a6f980d468752d32b
Instruction ID: 2ae51bf5a58c222a2c3c7eb395778bba2eeda1aa3a70df027e4c255c107c0995
Opcode Fuzzy Hash: df34b1cf13ab95bf7c1fa0909178cf975a831b56b160f13a6f980d468752d32b
Instruction Fuzzy Hash: 42D138716012129FCB2BEF14D895A6AF7A4EF05B10F5142AEE94A6F261CB31AD12CF44

Function 003B8835 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003B89F2
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8A06
GetFileAttributesW.KERNEL32(?), ref: 003B8A30
SetFileAttributesW.KERNEL32(?,00000000), ref: 003B8A4A
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8A5C
SetCurrentDirectoryW.KERNEL32(?), ref: 003B8AA5
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 003B8AF5

Strings

*.*, xrefs: 003B8AAB

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 683049b7e4f7c99cb7484565989c314a1528ddff6b1c3c84d8b6cad092048306
Instruction ID: d56e571c12dee4c3d86890858f56b4636e52ffd5a471939d99004951520bc2bf
Opcode Fuzzy Hash: 683049b7e4f7c99cb7484565989c314a1528ddff6b1c3c84d8b6cad092048306
Instruction Fuzzy Hash: 6D81AF729043059BCB26EF14C444AFAB3ECBF85314F59481AFA85DB650DF34EA45CB92

Function 003D88F9 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 003D8992
IsWindowEnabled.USER32(00000000), ref: 003D899E
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 003D8A79
SendMessageW.USER32(00000000,000000B0,?,?), ref: 003D8AAC
IsDlgButtonChecked.USER32(?,00000000), ref: 003D8AE4
GetWindowLongW.USER32(00000000,000000EC), ref: 003D8B06
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 003D8B1E

Strings

(A, xrefs: 003D89D5

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: (A
API String ID: 4072528602-3099020080
Opcode ID: c3bfd5a7807616d3af1851630a27438ac0227618235356d8852ae747a3032c75
Instruction ID: 95dd303f06ddb142d4006a82bb433f781c4e10a9f01223643382a7db19bb50f9
Opcode Fuzzy Hash: c3bfd5a7807616d3af1851630a27438ac0227618235356d8852ae747a3032c75
Instruction Fuzzy Hash: 8571BE76605204AFDB229F64E894FFABBB9FF09300F15049BE885A7361CB31B951CB51

Function 00347447 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 003474D7

Part of subcall function 00347567: GetClientRect.USER32(?,?), ref: 0034758D
Part of subcall function 00347567: GetWindowRect.USER32(?,?), ref: 003475CE
Part of subcall function 00347567: ScreenToClient.USER32(?,?), ref: 003475F6

GetDC.USER32 ref: 00386083
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00386096
SelectObject.GDI32(00000000,00000000), ref: 003860A4
SelectObject.GDI32(00000000,00000000), ref: 003860B9
ReleaseDC.USER32(?,00000000), ref: 003860C1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00386152

Strings

U, xrefs: 00386021

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 5712574124be6f3eeb57c632a68ccaa9eef00af96e8cdb3412cd42d553dd39ce
Instruction ID: 83de07a5123e20ceff85f860e0233b2afb2c02db7cbf438e3608dc90fe13fba1
Opcode Fuzzy Hash: 5712574124be6f3eeb57c632a68ccaa9eef00af96e8cdb3412cd42d553dd39ce
Instruction Fuzzy Hash: EE71DE71504305DFCF23AF64C88AABA7BB9FF49320F1542AAE9555A2A7C7319840DF50

Function 003BCC98 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003BCCB7
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003BCCDF
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003BCD0F
GetLastError.KERNEL32 ref: 003BCD67
SetEvent.KERNEL32(?), ref: 003BCD7B
InternetCloseHandle.WININET(00000000), ref: 003BCD86

Strings

, xrefs: 003BCD00

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 976c95319da019c9918dec2747021c6a74f7beab0f89a772a7521f102b16ba53
Instruction ID: 6caffd98e5f31cc6bd840b03e80be2ce9240b00145ff8bec3d0784111d01ec09
Opcode Fuzzy Hash: 976c95319da019c9918dec2747021c6a74f7beab0f89a772a7521f102b16ba53
Instruction Fuzzy Hash: 67318DB5511204AFD732AF649C88AEB7BFCEB44748F10552EF546D6A10DB30DD049B60

Function 003AA215 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,003855AE,?,?,Bad directive syntax error,003DDCD0,00000000,00000010,?,?), ref: 003AA236
LoadStringW.USER32(00000000,?,003855AE,?), ref: 003AA23D

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 003AA301

Strings

., xrefs: 003AA2E7
%s (%d) : ==> %s.: %s %s, xrefs: 003AA26B
Line %d:, xrefs: 003AA28C
Line %d (File "%s"):, xrefs: 003AA2A7
Error: , xrefs: 003AA2CF

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 9ac457c7055f81eb35ac7d9164963042977200a0fd97c827796bcaee9a922818
Instruction ID: 196a4a00de8ede04565c000130bba858dcc02096565f8bca4611efe4ae15e7b0
Opcode Fuzzy Hash: 9ac457c7055f81eb35ac7d9164963042977200a0fd97c827796bcaee9a922818
Instruction Fuzzy Hash: 5B216F3280021EEFCF03AFA0CC06EEE7B79FF19300F004466B515690A2EB75A618DB52

Function 003A29EC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 003A29F8
GetClassNameW.USER32(00000000,?,00000100), ref: 003A2A0D
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 003A2A9A

Strings

smallicons, xrefs: 003A2A62
largeicons, xrefs: 003A2A2E
SHELLDLL_DefView, xrefs: 003A2A19
details, xrefs: 003A2A48
list, xrefs: 003A2A7C

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 87ace618994cfb9bc5c5217d35fd99f72bf9c6c7c7078afb40ad40f11da08656
Instruction ID: 21963713c850a3f7dcb1e515bf216db1a2a2554fdf24f580f58c71ca0deb6f21
Opcode Fuzzy Hash: 87ace618994cfb9bc5c5217d35fd99f72bf9c6c7c7078afb40ad40f11da08656
Instruction Fuzzy Hash: C91106B6A44307B9F6276629EC06DA737ACCF16724F224023F906F40D2FF75E8104558

Function 00347567 Relevance: 13.8, APIs: 9, Instructions: 291COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0034758D
GetWindowRect.USER32(?,?), ref: 003475CE
ScreenToClient.USER32(?,?), ref: 003475F6
GetClientRect.USER32(?,?), ref: 0034773A
GetWindowRect.USER32(?,?), ref: 0034775B

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 8d71b6fa76b782a9a464c19888c92c36780a003c8aa2251f17f02a45ca896756
Instruction ID: 51fc51989669996f386e912a1a34c11e893f6a93a9356448082fa7bf8173e730
Opcode Fuzzy Hash: 8d71b6fa76b782a9a464c19888c92c36780a003c8aa2251f17f02a45ca896756
Instruction Fuzzy Hash: 2CC18C3890460AEFDB11DFA8C444BEDBBF5FF08310F15845AE899A7250DB34B941DBA0

Function 0037D210 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0037D237
_free.LIBCMT ref: 0037D2A2
_free.LIBCMT ref: 0037D2C8
_free.LIBCMT ref: 0037D2F1
_free.LIBCMT ref: 0037D329
_free.LIBCMT ref: 0037D35A
_free.LIBCMT ref: 0037D39B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0037D41C
_free.LIBCMT ref: 0037D435

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: b1ed01ab4d918c7ed1ea4f59b8e194358fb2f6acff3bf57526fd0c311a4dd0d8
Instruction ID: aa7fc1ba2eebc1514e469ffbe88d4f4950facbd3111e7d79abd4926f6f607419
Opcode Fuzzy Hash: b1ed01ab4d918c7ed1ea4f59b8e194358fb2f6acff3bf57526fd0c311a4dd0d8
Instruction Fuzzy Hash: 39613A71A04300AFDB33AF74E881BAE7BB49F05320F15C56DE94DAB296D639D8018751

Function 003D5B72 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 003D5C24
ShowWindow.USER32(?,00000000), ref: 003D5C65
ShowWindow.USER32(?,00000005,?,00000000), ref: 003D5C6B
SetFocus.USER32(?,?,00000005,?,00000000), ref: 003D5C6F

Part of subcall function 003D79F2: DeleteObject.GDI32(00000000), ref: 003D7A1E

GetWindowLongW.USER32(?,000000F0), ref: 003D5CAB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003D5CB8
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 003D5CEB
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 003D5D25
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 003D5D34

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 38fd0369f0f33406bc43a6c7a89ea77320562ffd9a6cff36f34a7b786e6ff58e
Instruction ID: 874f739576d57b33938d372e3bc03173bc9534da1f3b757f2777a0d3121be8e7
Opcode Fuzzy Hash: 38fd0369f0f33406bc43a6c7a89ea77320562ffd9a6cff36f34a7b786e6ff58e
Instruction Fuzzy Hash: BE51AF32691A08BFEF279F64EC49BD87BA6EB04750F104113FA149A3E0C772A990DB51

Function 003BCB88 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003BCBC7
GetLastError.KERNEL32 ref: 003BCBDA
SetEvent.KERNEL32(?), ref: 003BCBEE

Part of subcall function 003BCC98: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003BCCB7
Part of subcall function 003BCC98: GetLastError.KERNEL32 ref: 003BCD67
Part of subcall function 003BCC98: SetEvent.KERNEL32(?), ref: 003BCD7B
Part of subcall function 003BCC98: InternetCloseHandle.WININET(00000000), ref: 003BCD86

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 125dcaaff1c9fdbf1bc81d2db2c1c91c8ee978451b6b0137eacf58566ce2242a
Instruction ID: 42867e3825de3eb18337c17b452d40fa725bc45e2935784269ed92e6c65d43f1
Opcode Fuzzy Hash: 125dcaaff1c9fdbf1bc81d2db2c1c91c8ee978451b6b0137eacf58566ce2242a
Instruction Fuzzy Hash: 8A318971611701AFCB338F65DD44ABABBBCFF54308B04552EFA5A86A10C731E815ABA0

Function 003A2EEF Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 003A4393: GetWindowThreadProcessId.USER32(?,00000000), ref: 003A43AD
Part of subcall function 003A4393: GetCurrentThreadId.KERNEL32 ref: 003A43B4
Part of subcall function 003A4393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,003A2F00), ref: 003A43BB

MapVirtualKeyW.USER32(00000025,00000000), ref: 003A2F0A
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 003A2F28
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 003A2F2C
MapVirtualKeyW.USER32(00000025,00000000), ref: 003A2F36
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 003A2F4E
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 003A2F52
MapVirtualKeyW.USER32(00000025,00000000), ref: 003A2F5C
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 003A2F70
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 003A2F74

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 766153d631b16822b3305e0174d8132305fc3d5bcf6792b42d1b9870ebac0bda
Instruction ID: 23204c7e7a24bfb8633c53ab124d2122ff1cd60161ba52043bf2324b9b0f0a23
Opcode Fuzzy Hash: 766153d631b16822b3305e0174d8132305fc3d5bcf6792b42d1b9870ebac0bda
Instruction Fuzzy Hash: 3201D470784210BBFB116768AC8AF597F5EDB8EB11F100012F318AE1E0C9E264448AA9

Function 003A2150 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,003A1D95,?,?,00000000), ref: 003A2159
HeapAlloc.KERNEL32(00000000,?,003A1D95,?,?,00000000), ref: 003A2160
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,003A1D95,?,?,00000000), ref: 003A2175
GetCurrentProcess.KERNEL32(?,00000000,?,003A1D95,?,?,00000000), ref: 003A217D
DuplicateHandle.KERNEL32(00000000,?,003A1D95,?,?,00000000), ref: 003A2180
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,003A1D95,?,?,00000000), ref: 003A2190
GetCurrentProcess.KERNEL32(003A1D95,00000000,?,003A1D95,?,?,00000000), ref: 003A2198
DuplicateHandle.KERNEL32(00000000,?,003A1D95,?,?,00000000), ref: 003A219B
CreateThread.KERNEL32(00000000,00000000,003A21C1,00000000,00000000,00000000), ref: 003A21B5

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 3075d5280e5bb56ca157dfd8f7da7cbc4be8819faf6c4fd62e0653ae94a273d7
Instruction ID: 596ed0c2bf1b247e19b53a6c29ae6aadf37b35f6f37860f92641bf2f0f52d0ad
Opcode Fuzzy Hash: 3075d5280e5bb56ca157dfd8f7da7cbc4be8819faf6c4fd62e0653ae94a273d7
Instruction Fuzzy Hash: E501BBB5241304BFE751AFA5EC4DF6B7BACEB89711F004412FA05DB1A1CA709800CB20

Function 003ACE7B Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003441EA: _wcslen.LIBCMT ref: 003441EF

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003ACF99
_wcslen.LIBCMT ref: 003ACFE0
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003AD047
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 003AD075

Strings

,*A, xrefs: 003ACF0C
0, xrefs: 003ACF5A
<*A, xrefs: 003ACEF6

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: ,*A$0$<*A
API String ID: 1227352736-1502282591
Opcode ID: c3b80b3b9e61d43dfa07ae20d0f0ca896bb65aa6b7e32b8be72e96a824109087
Instruction ID: 216fc3a831ea0b8e290934d1c9a578dbe8d7a68f19bbfc44eda77a28da026b05
Opcode Fuzzy Hash: c3b80b3b9e61d43dfa07ae20d0f0ca896bb65aa6b7e32b8be72e96a824109087
Instruction Fuzzy Hash: 5F51ED716143009FD726EF38C845BABBBE8EF87314F050A2AF992D75A0DBB4C9458752

Function 003CAB3F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 003ADD87: CreateToolhelp32Snapshot.KERNEL32 ref: 003ADDAC
Part of subcall function 003ADD87: Process32FirstW.KERNEL32(00000000,?), ref: 003ADDBA
Part of subcall function 003ADD87: CloseHandle.KERNEL32(00000000), ref: 003ADE87

OpenProcess.KERNEL32(00000001,00000000,?), ref: 003CABCA
GetLastError.KERNEL32 ref: 003CABDD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 003CAC10
TerminateProcess.KERNEL32(00000000,00000000), ref: 003CACC5
GetLastError.KERNEL32(00000000), ref: 003CACD0
CloseHandle.KERNEL32(00000000), ref: 003CAD21

Strings

SeDebugPrivilege, xrefs: 003CABEC

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 8ddf2aedd5e9d67e0df3e9c076e7719d4f6a53403f24a37e5fb84a423659bb6e
Instruction ID: 0e1510c1af47a75e5735869755c66a98c37ad66b2a72c37095890c78fb146fd1
Opcode Fuzzy Hash: 8ddf2aedd5e9d67e0df3e9c076e7719d4f6a53403f24a37e5fb84a423659bb6e
Instruction Fuzzy Hash: 61619C74208646AFD312DF14C499F25BBE5EF44308F19849CE4668FBA2C775EC45CB92

Function 003D4322 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 003D43C1
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 003D43D6
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 003D43F0
_wcslen.LIBCMT ref: 003D4435
SendMessageW.USER32(?,00001057,00000000,?), ref: 003D4462
SendMessageW.USER32(?,00001061,?,0000000F), ref: 003D4490

Strings

SysListView32, xrefs: 003D4393

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: a88c7949fc420a3e7c29f57b3d68577947e2c569546db8edcb47d486f0660e08
Instruction ID: 39b247b992cd4ec192035999ee1f21e116b725021cadb5f621e7c24d992943e9
Opcode Fuzzy Hash: a88c7949fc420a3e7c29f57b3d68577947e2c569546db8edcb47d486f0660e08
Instruction Fuzzy Hash: 2E41C272A00319ABDF229F64DC49BEA7BA9FF48350F110527F944E7291D7749990CB90

Function 003AC625 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003AC6C4
IsMenu.USER32(00000000), ref: 003AC6E4
CreatePopupMenu.USER32 ref: 003AC71A
GetMenuItemCount.USER32(01197048), ref: 003AC76B
InsertMenuItemW.USER32(01197048,?,00000001,00000030), ref: 003AC793

Strings

0, xrefs: 003AC66F
2, xrefs: 003AC6FE

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 9cec9c674b4ab6493d4285d83608fccdb7d2d55ab0efad421e9c0780cfe24a0c
Instruction ID: 45a375137e2dce6a261e26be31791719d79de31ca22973ed1a86612f89fbef90
Opcode Fuzzy Hash: 9cec9c674b4ab6493d4285d83608fccdb7d2d55ab0efad421e9c0780cfe24a0c
Instruction Fuzzy Hash: 2751DF706102049FDF12CF78D988BAEBBF9FF46314F24511AE812AB291D7729940CF61

Function 003419CD Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 003419E1
ScreenToClient.USER32(00000000,?), ref: 003419FE
GetAsyncKeyState.USER32(00000001), ref: 00341A23
GetAsyncKeyState.USER32(00000002), ref: 00341A3D

Strings

$'4, xrefs: 003419F0, 00341A07, 00383135
$'4, xrefs: 0038318D, 003831C3, 00383164

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID: $'4$$'4
API String ID: 4210589936-66288060
Opcode ID: 0eca600e41f691193edb6f00d6b59fbd78b802883b05a74edcc7667483b8058e
Instruction ID: ea27d7f74ae987613f8357ad0921b84dc8b13d291492dce9369db1cfb5721d5b
Opcode Fuzzy Hash: 0eca600e41f691193edb6f00d6b59fbd78b802883b05a74edcc7667483b8058e
Instruction Fuzzy Hash: E441847560460AFFDF06AF64C848BFDB7B4FF05724F208256E469A6290C7346E90CB51

Function 00341B00 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

BeginPaint.USER32(?,?,?), ref: 00341B35
GetWindowRect.USER32(?,?), ref: 00341B99
ScreenToClient.USER32(?,?), ref: 00341BB6
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00341BC7
EndPaint.USER32(?,?,?,?,?), ref: 00341C15
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00383287

Part of subcall function 00341C2D: BeginPath.GDI32(00000000), ref: 00341C4B

Strings

(A, xrefs: 00341B0F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID: (A
API String ID: 3050599898-3099020080
Opcode ID: 2dac4bae4f2a2c3289d9535cda83ddaff477512c09a5e534b7a80326ee2eeb00
Instruction ID: dd7eeff18fe7094b3753f918e0b5ab80f2cff21e543e76e305569bdb3a88832a
Opcode Fuzzy Hash: 2dac4bae4f2a2c3289d9535cda83ddaff477512c09a5e534b7a80326ee2eeb00
Instruction Fuzzy Hash: 2941B070605700AFCB12EF28DC84FB67BE8EB45720F040669FA55CA2B1C771A994DB62

Function 003D86FC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 003D8740
SetWindowLongW.USER32(00000000,000000F0,?), ref: 003D8765
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 003D877D
GetSystemMetrics.USER32(00000004), ref: 003D87A6
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,003BC1F2,00000000), ref: 003D87C6

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

GetSystemMetrics.USER32(00000004), ref: 003D87B1

Strings

(A, xrefs: 003D8709

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID: (A
API String ID: 2294984445-3099020080
Opcode ID: cd3d281d9621c72f331516e64552f88befeaa466c336036c83bf7a70f290550a
Instruction ID: cda8a799b9333dc1be30b14be2acf709c6796769c42371c7ce5523a707d74a4e
Opcode Fuzzy Hash: cd3d281d9621c72f331516e64552f88befeaa466c336036c83bf7a70f290550a
Instruction Fuzzy Hash: 8021A472611241DFCB165F39EC08A6A37A9EB45325F25462AF926C62E0DF70A850CB10

Function 003AD11F Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 003AD1BE

Strings

stop, xrefs: 003AD18F
warning, xrefs: 003AD1A7
question, xrefs: 003AD177
info, xrefs: 003AD15F
blank, xrefs: 003AD140

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 58352ff47ab782c6de8cf9a24b259a4e4c0a572cc17834b014275751cf6a9933
Instruction ID: 1d007317187bb46dbc964bcb76acc097ca1a19b131e4574183dab1a918c2e0c4
Opcode Fuzzy Hash: 58352ff47ab782c6de8cf9a24b259a4e4c0a572cc17834b014275751cf6a9933
Instruction Fuzzy Hash: 7911EC35A4C306BAE7475B54DC82EBE77ECDF07760F21002BF902AA5C2DBB4BA404165

Function 003AE73E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 003AE759
gethostname.WSOCK32(?,00000100), ref: 003AE773
gethostbyname.WSOCK32(?), ref: 003AE780
inet_ntoa.WSOCK32(?), ref: 003AE7C2
_strcat.LIBCMT ref: 003AE7D0
WSACleanup.WSOCK32 ref: 003AE7F5

Strings

0.0.0.0, xrefs: 003AE79E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 29c5579d426466b1312d57a891cfc25370f879db7539cab45f8f5f0bd1e24e5d
Instruction ID: 476a50a39cf46e7a647a16daf2e0bc6a183e3767c199f2543675b3f08c4dd273
Opcode Fuzzy Hash: 29c5579d426466b1312d57a891cfc25370f879db7539cab45f8f5f0bd1e24e5d
Instruction Fuzzy Hash: 9B11D631900215BFDB27AB70EC4AEDE77ACDF02710F0100A6F515AA095EF759A81D761

Function 003AF630 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 003AF641
_wcslen.LIBCMT ref: 003AF652
_wcslen.LIBCMT ref: 003AF690
_wcslen.LIBCMT ref: 003AF6C6
_wcslen.LIBCMT ref: 003AF6F6
_wcslen.LIBCMT ref: 003AF706
_wcslen.LIBCMT ref: 003AF742
_wcslen.LIBCMT ref: 003AF771

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: de0b73fe73066c75886cd5d38129c4126fc2952e7e2c5403df10790624755712
Instruction ID: 2b7ced97ef2b7f23120ebd2bb28862afd7712569f18202d458f79dbfda07154b
Opcode Fuzzy Hash: de0b73fe73066c75886cd5d38129c4126fc2952e7e2c5403df10790624755712
Instruction Fuzzy Hash: 2741A465C11114BACB12EBF8CC86ACFB7A8EF05350F51C562E508E7125FB35D261C3A6

Function 003D379F Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 003D37B7
GetDC.USER32(00000000), ref: 003D37BF
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003D37CA
ReleaseDC.USER32(00000000,00000000), ref: 003D37D6
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 003D3812
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 003D3823
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,003D6504,?,?,000000FF,00000000,?,000000FF,?), ref: 003D385E
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 003D387D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: d34fee2b0b704b684cce72e0da13f8a233fc04f49aaae0b1a597dc7c10464396
Instruction ID: e5f42fade25ded214e6ac002fa9be04ad4ed0cfd519a9f5c71b7abf61251f8cb
Opcode Fuzzy Hash: d34fee2b0b704b684cce72e0da13f8a233fc04f49aaae0b1a597dc7c10464396
Instruction Fuzzy Hash: 9E31B172201214BFEB124F54EC89FEB3FADEF49711F044066FE089A291C6B59C41C7A0

Function 003C5A0B Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 003C5A64
NULL Pointer assignment, xrefs: 003C5A8B, 003C5DE0

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: a1ea2bc232e6828ce45ac5f2a4ee4c2b356a0b164b456a09e225e1a0808590c4
Instruction ID: 1f1967ea95804c287fa195144bd852cca7c121f030afd4c4996da36bfdfae03e
Opcode Fuzzy Hash: a1ea2bc232e6828ce45ac5f2a4ee4c2b356a0b164b456a09e225e1a0808590c4
Instruction Fuzzy Hash: E3D19C75A0070A9FDB11CF68C885FAEB7B5EB48304F15856DE916EB281E770ED81CB60

Function 003818A2 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00381B7B,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 0038194E
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00381B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 003819D1
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00381B7B,?,00381B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00381A64
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00381B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00381A7B

Part of subcall function 00373B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00366A79,?,0000015D,?,?,?,?,003685B0,000000FF,00000000,?,?), ref: 00373BC5

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00381B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00381AF7
__freea.LIBCMT ref: 00381B22
__freea.LIBCMT ref: 00381B2E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 4690582f7e52c7f4ce525b20f9c6d165d9ba20548b38ae31d1ab37d670e2122f
Instruction ID: db33c47c8c8511144eb49ecb547e70c89ddb9c312fda677e603bcf070d11f31b
Opcode Fuzzy Hash: 4690582f7e52c7f4ce525b20f9c6d165d9ba20548b38ae31d1ab37d670e2122f
Instruction Fuzzy Hash: 0A91C472E00316AADB27AE74C891EEEBBBD9F49310F190199E805E7140E735DD46C7A0

Function 003C4F80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003C50A5
VariantInit.OLEAUT32(?), ref: 003C51A6
VariantClear.OLEAUT32(?), ref: 003C51B0
VariantClear.OLEAUT32(?), ref: 003C520D

Strings

Null Object assignment in FOR..IN loop, xrefs: 003C5035, 003C5163, 003C521B
Incorrect Object type in FOR..IN loop, xrefs: 003C5189

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 6c16efb4b6504286de5a745317b5857b1274ef55b7c0d7c05a37a828811a8ba6
Instruction ID: 997c55408be2feaabc935c0d399b17c6e7b2696b487ade7bfa6df36cdd5fe274
Opcode Fuzzy Hash: 6c16efb4b6504286de5a745317b5857b1274ef55b7c0d7c05a37a828811a8ba6
Instruction Fuzzy Hash: 0C917D71A00619ABDF258FA5CC88FAEBBB8EF45714F14851DE505EB280D770AD85CBA0

Function 003C43A4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003C43C8
CharUpperBuffW.USER32(?,?), ref: 003C44D7
_wcslen.LIBCMT ref: 003C44E7
VariantClear.OLEAUT32(?), ref: 003C467C

Part of subcall function 003B169E: VariantInit.OLEAUT32(00000000), ref: 003B16DE
Part of subcall function 003B169E: VariantCopy.OLEAUT32(?,?), ref: 003B16E7
Part of subcall function 003B169E: VariantClear.OLEAUT32(?), ref: 003B16F3

Strings

Incorrect Parameter format, xrefs: 003C4403, 003C45FE
AUTOIT.ERROR, xrefs: 003C44DD, 003C44E2

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 633abb7a44284277d9dd0df428964ff036593abe4c8f4d30b2507c83e3449f03
Instruction ID: 2d658723a6e72eda09edd3ffd9d91fc1045eec4584b2e33e85b99404c483b3ba
Opcode Fuzzy Hash: 633abb7a44284277d9dd0df428964ff036593abe4c8f4d30b2507c83e3449f03
Instruction Fuzzy Hash: 80915774A083019FC715EF24C490A6AB7E9FF89714F14892EF8899B351DB31ED46CB82

Function 003C560A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 003A08FE: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,003A0831,80070057,?,?,?,003A0C4E), ref: 003A091B
Part of subcall function 003A08FE: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003A0831,80070057,?,?), ref: 003A0936
Part of subcall function 003A08FE: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003A0831,80070057,?,?), ref: 003A0944
Part of subcall function 003A08FE: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003A0831,80070057,?), ref: 003A0954

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 003C56AE
_wcslen.LIBCMT ref: 003C57B6
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 003C582C
CoTaskMemFree.OLE32(?), ref: 003C5837

Strings

NULL Pointer assignment, xrefs: 003C5880, 003C58AF

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 824a739ffaf904c44abf4bbf2be7ba44a8867c3dc35a863d259257eb51349f30
Instruction ID: 4c700d0d5acc81fef2f7751512700ee2d85a7c888d3f5a328d43abff6605c6b7
Opcode Fuzzy Hash: 824a739ffaf904c44abf4bbf2be7ba44a8867c3dc35a863d259257eb51349f30
Instruction Fuzzy Hash: 8891F571D00219AFDF16DFA4D881EEEB7B9AF08304F10456AE915AB251DB70AE84CF60

Function 003D2B99 Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 003D2C1F
GetMenuItemCount.USER32(00000000), ref: 003D2C51
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 003D2C79
_wcslen.LIBCMT ref: 003D2CAF
GetMenuItemID.USER32(?,?), ref: 003D2CE9
GetSubMenu.USER32(?,?), ref: 003D2CF7

Part of subcall function 003A4393: GetWindowThreadProcessId.USER32(?,00000000), ref: 003A43AD
Part of subcall function 003A4393: GetCurrentThreadId.KERNEL32 ref: 003A43B4
Part of subcall function 003A4393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,003A2F00), ref: 003A43BB

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 003D2D7F

Part of subcall function 003AF292: Sleep.KERNEL32 ref: 003AF30A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: f47da2c494ca33c5e6afae77a3e44b43c97922fdbef89c0b4f888cc1aed7463e
Instruction ID: e8906b85c65c92e9d233597fa94f803ba08da72e6ae4174e025b4cf8c2250c23
Opcode Fuzzy Hash: f47da2c494ca33c5e6afae77a3e44b43c97922fdbef89c0b4f888cc1aed7463e
Instruction Fuzzy Hash: 6F719E76E00205AFCB02EF64D841AAEB7F5EF59310F11845AE816EB351DB34EE41CB90

Function 003AB881 Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 003AB8C0
GetKeyboardState.USER32(?), ref: 003AB8D5
SetKeyboardState.USER32(?), ref: 003AB936
PostMessageW.USER32(?,00000101,00000010,?), ref: 003AB964
PostMessageW.USER32(?,00000101,00000011,?), ref: 003AB983
PostMessageW.USER32(?,00000101,00000012,?), ref: 003AB9C4
PostMessageW.USER32(?,00000101,0000005B,?), ref: 003AB9E7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: ad12cbff27e8fe1d2b7193f7d723bc66a9dda5762b9de514fc0a74b4c963b147
Instruction ID: cf9291ca161a4a8dc8ab0b501155d00af960236971ca8d7295cbc72f2eee3862
Opcode Fuzzy Hash: ad12cbff27e8fe1d2b7193f7d723bc66a9dda5762b9de514fc0a74b4c963b147
Instruction Fuzzy Hash: DC51AEA06087D53EFB3746388855BBAFEA99B07704F09848DE1D9498D3C3A8ADD4D760

Function 003AB6A1 Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 003AB6E0
GetKeyboardState.USER32(?), ref: 003AB6F5
SetKeyboardState.USER32(?), ref: 003AB756
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 003AB782
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 003AB79F
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 003AB7DE
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 003AB7FF

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 86c36e3163b23043193127d1863f12956d5a1d4cd9bebf1b277ec080fbeab8db
Instruction ID: 3ba08cf08aa115e8fa22bc36c2d895a05a604750eb001628f67aa056c1ba89e6
Opcode Fuzzy Hash: 86c36e3163b23043193127d1863f12956d5a1d4cd9bebf1b277ec080fbeab8db
Instruction Fuzzy Hash: 1451EFA09086D53EFB3782248C15B7AFEACEF47704F088589E0D95A893D3D9E894D760

Function 003757A1 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,00375F16,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 003757E3
__fassign.LIBCMT ref: 0037585E
__fassign.LIBCMT ref: 00375879
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0037589F
WriteFile.KERNEL32(?,FF8BC35D,00000000,00375F16,00000000,?,?,?,?,?,?,?,?,?,00375F16,?), ref: 003758BE
WriteFile.KERNEL32(?,?,00000001,00375F16,00000000,?,?,?,?,?,?,?,?,?,00375F16,?), ref: 003758F7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 89b00c3549039b1d921834ccaa9db0c7ed3262ec75ab6efaed5087bdcf177d6b
Instruction ID: da8093986856ddb33e06d545f1acac69b2b31e6beb15b02675e9bfea95882162
Opcode Fuzzy Hash: 89b00c3549039b1d921834ccaa9db0c7ed3262ec75ab6efaed5087bdcf177d6b
Instruction Fuzzy Hash: 4651D671A00649DFCB25CFA8D881BEEBBF8EF09310F14811AE959E7291D7749941CB61

Function 00363090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 003630BB
___except_validate_context_record.LIBVCRUNTIME ref: 003630C3
_ValidateLocalCookies.LIBCMT ref: 00363151
__IsNonwritableInCurrentImage.LIBCMT ref: 0036317C
_ValidateLocalCookies.LIBCMT ref: 003631D1

Strings

csm, xrefs: 00363166

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5f2eaa0befcfa8dd537b916dc34faa05b17a477827c9dc700f93f216f726fbd4
Instruction ID: 88196dcde19229414df275f7ed5a8de62c2c4c545ce5cceaa7d240f313db19fe
Opcode Fuzzy Hash: 5f2eaa0befcfa8dd537b916dc34faa05b17a477827c9dc700f93f216f726fbd4
Instruction Fuzzy Hash: A341F374E002089BCF12EF68C881AAEBBB5AF46328F14C155E815AF396D731DB15CB91

Function 003C1B15 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003C3AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 003C3AD7
Part of subcall function 003C3AAB: _wcslen.LIBCMT ref: 003C3AF8

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 003C1B6F
WSAGetLastError.WSOCK32 ref: 003C1B7E
WSAGetLastError.WSOCK32 ref: 003C1C26
closesocket.WSOCK32(00000000), ref: 003C1C56

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: b39f7766a75561a597718f38de064dd9077724d4818c2d118d23a9a649df4a6e
Instruction ID: fbdfe4c6edb9b403dce11b778bfeb35816ff7d5dd60aa208a3572300a938f064
Opcode Fuzzy Hash: b39f7766a75561a597718f38de064dd9077724d4818c2d118d23a9a649df4a6e
Instruction Fuzzy Hash: DE41CF31600204AFDB129F24D884FAABBEDEF46324F158059F819DF292D774AD81DBA1

Function 003AD7AB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003AE6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003AD7CD,?), ref: 003AE714

Part of subcall function 003AE6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003AD7CD,?), ref: 003AE72D

lstrcmpiW.KERNEL32(?,?), ref: 003AD7F0
MoveFileW.KERNEL32(?,?), ref: 003AD82A
_wcslen.LIBCMT ref: 003AD8B0
_wcslen.LIBCMT ref: 003AD8C6
SHFileOperationW.SHELL32(?), ref: 003AD90C

Strings

\*.*, xrefs: 003AD89E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 13c470c7d4df8eb685346721cce1ad42cb036b512fe6b9b9f6751a74f73438a9
Instruction ID: 776c207e840e870d07b838edcc53eda60b0f1715d2108c3152cc246dcd679a02
Opcode Fuzzy Hash: 13c470c7d4df8eb685346721cce1ad42cb036b512fe6b9b9f6751a74f73438a9
Instruction Fuzzy Hash: 2A413571D052189EDF13EBA4D985ADE77BCEF09340F1104EAA506EB541EB39A788CB50

Function 003B42B9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 003B4310
TranslateAcceleratorW.USER32(?,00000000,?), ref: 003B4367
TranslateMessage.USER32(?), ref: 003B4390
DispatchMessageW.USER32(?), ref: 003B439A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003B43AB

Strings

(A, xrefs: 003B437D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID: (A
API String ID: 2256411358-3099020080
Opcode ID: 9aa3602410a5f203182927f93100f10d40f22f2676820f907bf06bca2ab66a04
Instruction ID: 21f7384eeef659c16d71a6283fca79d0a764cff877ce458ea609f55674750937
Opcode Fuzzy Hash: 9aa3602410a5f203182927f93100f10d40f22f2676820f907bf06bca2ab66a04
Instruction Fuzzy Hash: B1311974604345DEEB37CB34E948BF637ECAB0030CF094569D666C29A2E3A49565CB1D

Function 003D3899 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 003D38B8
GetWindowLongW.USER32(?,000000F0), ref: 003D38EB
GetWindowLongW.USER32(?,000000F0), ref: 003D3920
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 003D3952
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 003D397C
GetWindowLongW.USER32(?,000000F0), ref: 003D398D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003D39A7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 792268a2912d905a2a0ad419b19f4ce78cc570ca3d66ab61ba82d29fedbf6279
Instruction ID: 069a19d251fa3a4ff98daff8fce4618b7f66707205b5cda7ad03139c231d3969
Opcode Fuzzy Hash: 792268a2912d905a2a0ad419b19f4ce78cc570ca3d66ab61ba82d29fedbf6279
Instruction Fuzzy Hash: C3314232705241AFDB228F58EC94FA437A4FB8A310F1A01A6F540CB2B1CBB0AD44DB42

Function 003A808D Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003A80D0
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003A80F6
SysAllocString.OLEAUT32(00000000), ref: 003A80F9
SysAllocString.OLEAUT32(?), ref: 003A8117
SysFreeString.OLEAUT32(?), ref: 003A8120
StringFromGUID2.OLE32(?,?,00000028), ref: 003A8145
SysAllocString.OLEAUT32(?), ref: 003A8153

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9e4c37761935c53d6554027858eca5fa265a71e0edd8921f143abca428ed3b35
Instruction ID: cd2002ec479358240b8bb01b4befc274d5678ef07153150e5aa80d12e841273a
Opcode Fuzzy Hash: 9e4c37761935c53d6554027858eca5fa265a71e0edd8921f143abca428ed3b35
Instruction Fuzzy Hash: CA21B876601219BFDF16DFA8DC88CBB73ACEB0A364B058425F905DB290DA70DC468760

Function 003A8164 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003A81A9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003A81CF
SysAllocString.OLEAUT32(00000000), ref: 003A81D2
SysAllocString.OLEAUT32 ref: 003A81F3
SysFreeString.OLEAUT32 ref: 003A81FC
StringFromGUID2.OLE32(?,?,00000028), ref: 003A8216
SysAllocString.OLEAUT32(?), ref: 003A8224

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: babf742b3594db4d91a2aaadb8c2558ec99bf7a93601d0e549df5da84ba40151
Instruction ID: cbf2c9a4b9281362ef60e16ce752c809014a7d8136842e79c22a4620d3343466
Opcode Fuzzy Hash: babf742b3594db4d91a2aaadb8c2558ec99bf7a93601d0e549df5da84ba40151
Instruction Fuzzy Hash: 88217475601108BF9B169BB8EC89DBA77ECFB4A360B058525F905CB1A0EE74EC41C764

Function 003B0E79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 003B0E99
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003B0ED5

Strings

nul, xrefs: 003B0F0E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 865d9cec5010e47cbbe3291d2cfb9b57e8a9d3355ea62c49d3fa6f98b05e0335
Instruction ID: 41ee4a99f9006a40a69dd808e34b383afc4b030740274209d556f819c8718c31
Opcode Fuzzy Hash: 865d9cec5010e47cbbe3291d2cfb9b57e8a9d3355ea62c49d3fa6f98b05e0335
Instruction Fuzzy Hash: E2215E70604309ABDB258F64D804AEB77A8AF95728F204A19FEA5E76D0D770D940CB50

Function 003B0F4E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 003B0F6D
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003B0FA8

Strings

nul, xrefs: 003B0FE0

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 320e399c03899618a4ecb382b2fcd65c7e83f1e913152fb25b8e29cb78a9d05c
Instruction ID: 0dc6e05b26ce9816479b36d56efd67bcedaa0ab2a9b967608683fd9b08ec2b6e
Opcode Fuzzy Hash: 320e399c03899618a4ecb382b2fcd65c7e83f1e913152fb25b8e29cb78a9d05c
Instruction Fuzzy Hash: 3C218E717003459BDB329F68DC04ADA77A8BF55728F200A19FAA1E76D0D7709890DB50

Function 003D4B4B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00347873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 003478B1
Part of subcall function 00347873: GetStockObject.GDI32(00000011), ref: 003478C5
Part of subcall function 00347873: SendMessageW.USER32(00000000,00000030,00000000), ref: 003478CF

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 003D4BB0
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 003D4BBD
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 003D4BC8
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 003D4BD7
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 003D4BE3

Strings

Msctls_Progress32, xrefs: 003D4B81

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 8e6ef9b1bf6d7f7f77d27b33168348988fec216af7b8348d257f62021b4f2d33
Instruction ID: 9987dfe255f7c2317170c2bbabfd37e3c1adeeac7bf9e78cbea18f6e294f7013
Opcode Fuzzy Hash: 8e6ef9b1bf6d7f7f77d27b33168348988fec216af7b8348d257f62021b4f2d33
Instruction Fuzzy Hash: FA1193B2150219BEEF119FA4DC85EE77FADEF08758F014112B648A6190CB72DC219BA4

Function 0037DB5F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0037DB23: _free.LIBCMT ref: 0037DB4C

_free.LIBCMT ref: 0037DBAD

Part of subcall function 00372D38: RtlFreeHeap.NTDLL(00000000,00000000,?,0037DB51,00411DC4,00000000,00411DC4,00000000,?,0037DB78,00411DC4,00000007,00411DC4,?,0037DF75,00411DC4), ref: 00372D4E
Part of subcall function 00372D38: GetLastError.KERNEL32(00411DC4,?,0037DB51,00411DC4,00000000,00411DC4,00000000,?,0037DB78,00411DC4,00000007,00411DC4,?,0037DF75,00411DC4,00411DC4), ref: 00372D60

_free.LIBCMT ref: 0037DBB8
_free.LIBCMT ref: 0037DBC3
_free.LIBCMT ref: 0037DC17
_free.LIBCMT ref: 0037DC22
_free.LIBCMT ref: 0037DC2D
_free.LIBCMT ref: 0037DC38

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
Instruction ID: e28ab064d2ed3503b2d6d5fb9f44aa7c378751d3c41d979725f1044b80735328
Opcode Fuzzy Hash: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
Instruction Fuzzy Hash: 9911BF72541B04EAD532BBB0CC47FCB77EC9F15701F418C19B2ADAE152DA79B5188690

Function 003A6078 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 003A608D
_memcmp.LIBVCRUNTIME ref: 003A60AB
_memcmp.LIBVCRUNTIME ref: 003A60BE
_memcmp.LIBVCRUNTIME ref: 003A60D6
_memcmp.LIBVCRUNTIME ref: 003A60EE

Strings

j`:, xrefs: 003A609B

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _memcmp
String ID: j`:
API String ID: 2931989736-435168753
Opcode ID: 82835dd9fef73b76540212d728fc89d1f44d4b27764a3c31a3b719081512de47
Instruction ID: 6d22dadb52920ac0057578f14392232651950a2e98fc675bf716d9cf4d0cbf4b
Opcode Fuzzy Hash: 82835dd9fef73b76540212d728fc89d1f44d4b27764a3c31a3b719081512de47
Instruction Fuzzy Hash: D601F5F26083197BD71796219C43FAB731DDE22399B094420FD059E281E761ED90C2A0

Function 003AE30E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 003AE328
LoadStringW.USER32(00000000), ref: 003AE32F
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 003AE345
LoadStringW.USER32(00000000), ref: 003AE34C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 003AE390

Strings

%s (%d) : ==> %s: %s %s, xrefs: 003AE36D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: e1c32df8f8c708a8b773887bda79f4420de9df1af0e13822c70d54040ac63288
Instruction ID: d1afc5161853ea3524959eaea63c3e0ccc0845d30ff36b23e95c4fdb62e04873
Opcode Fuzzy Hash: e1c32df8f8c708a8b773887bda79f4420de9df1af0e13822c70d54040ac63288
Instruction Fuzzy Hash: 150136F69002087FE75297A4AD89EFB776CDB09300F414592B745E6081E7749E848B75

Function 003B1312 Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 003B1322
EnterCriticalSection.KERNEL32(00000000,?), ref: 003B1334
TerminateThread.KERNEL32(00000000,000001F6), ref: 003B1342
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 003B1350
CloseHandle.KERNEL32(00000000), ref: 003B135F
InterlockedExchange.KERNEL32(?,000001F6), ref: 003B136F
LeaveCriticalSection.KERNEL32(00000000), ref: 003B1376

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 26e6487b982be3e59030059e8ddea2866d8aab7441edaa2a9b8d36cebe2a32a4
Instruction ID: f7db699e6b9870425edc6ab3e3a468aa0f208708ab2a2dc5ca33fb83c39400f4
Opcode Fuzzy Hash: 26e6487b982be3e59030059e8ddea2866d8aab7441edaa2a9b8d36cebe2a32a4
Instruction Fuzzy Hash: B3F0C932043612ABD7831B54EE49BD6BB79FF05306F801522F20191CA097749461CF90

Function 003C26BD Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 003C281D
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 003C283E
WSAGetLastError.WSOCK32 ref: 003C284F
htons.WSOCK32(?,?,?,?,?), ref: 003C2938
inet_ntoa.WSOCK32(?), ref: 003C28E9

Part of subcall function 003A433E: _strlen.LIBCMT ref: 003A4348

Part of subcall function 003C3C81: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,003BF669), ref: 003C3C9D

_strlen.LIBCMT ref: 003C2992

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 937d3f737378392479eb4eb6564f4464079b9b24d3a63b3e28d9b4e0f252c7ad
Instruction ID: e3c68d8cb74546023a6cd55bc29ee6682fc5eb7665380e9c62ca1dae13f033f4
Opcode Fuzzy Hash: 937d3f737378392479eb4eb6564f4464079b9b24d3a63b3e28d9b4e0f252c7ad
Instruction Fuzzy Hash: 7BB19D35604300AFD326DF24C885F2ABBE9AF85318F55855CF45A8F2A2DB31ED46CB91

Function 00370527 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0037042A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00370446
__allrem.LIBCMT ref: 0037045D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0037047B
__allrem.LIBCMT ref: 00370492
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003704B0

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: f879b393e65d4db2631db90962c4ab5633f4520d067d5efed2ccc62c0ef88ee5
Instruction ID: c28cf32f8bb60dd0b2dcfb06b8f7176d953c26bc1ecb3270c64cfadcf3ea66fd
Opcode Fuzzy Hash: f879b393e65d4db2631db90962c4ab5633f4520d067d5efed2ccc62c0ef88ee5
Instruction Fuzzy Hash: 1C810A76600B05DBE73AAF79CC41B6BB3E8AF44324F15C52AF519DB681E778D9008B50

Function 00376571 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00368649,00368649,?,?,?,003767C2,00000001,00000001,8BE85006), ref: 003765CB
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,003767C2,00000001,00000001,8BE85006,?,?,?), ref: 00376651
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0037674B
__freea.LIBCMT ref: 00376758

Part of subcall function 00373B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00366A79,?,0000015D,?,?,?,?,003685B0,000000FF,00000000,?,?), ref: 00373BC5

__freea.LIBCMT ref: 00376761
__freea.LIBCMT ref: 00376786

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: cf566f5606fc8b69f5a4b52cc9a4290c566f707117c710a08aa7ac347748c85b
Instruction ID: 55388a73c8ce4229f38d2a0f46ae410cfb2750297b844c0f1dfbd6688400d585
Opcode Fuzzy Hash: cf566f5606fc8b69f5a4b52cc9a4290c566f707117c710a08aa7ac347748c85b
Instruction Fuzzy Hash: CA511772600646AFDB3B8F64CCA2EBB77A9EB44754F158669FC0CDA140EB38DC50D660

Function 003CC63B Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003CD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CC10E,?,?), ref: 003CD415
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD451
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD4C8
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CC72A
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003CC785
RegCloseKey.ADVAPI32(00000000), ref: 003CC7CA
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 003CC7F9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 003CC853
RegCloseKey.ADVAPI32(?), ref: 003CC85F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 25c658a507a7efa6a735ca6031709fc9c21841a7637fee76ddc4a3025ea14a4f
Instruction ID: fc5508e0dc6ead40e2995774cb23cf7d184b06c11b1f81d9c387c977d7da69f6
Opcode Fuzzy Hash: 25c658a507a7efa6a735ca6031709fc9c21841a7637fee76ddc4a3025ea14a4f
Instruction Fuzzy Hash: 74817C75118241AFC716DF24C885F2ABBE9FF84308F1495ACF4598B2A2DB31ED45CB92

Function 003A009D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 003A00A9
SysAllocString.OLEAUT32(00000000), ref: 003A0150
VariantCopy.OLEAUT32(003A0354,00000000), ref: 003A0179
VariantClear.OLEAUT32(003A0354), ref: 003A019D
VariantCopy.OLEAUT32(003A0354,00000000), ref: 003A01A1
VariantClear.OLEAUT32(?), ref: 003A01AB

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 01b6d5512a6a87b72a961037616fc9c139fa0fa24ceab841ad0a5c54a6babef0
Instruction ID: 41aea2175522e7bfe58a21eb065c218aacb9a9e5fcd724b569a7c1afdbe74677
Opcode Fuzzy Hash: 01b6d5512a6a87b72a961037616fc9c139fa0fa24ceab841ad0a5c54a6babef0
Instruction Fuzzy Hash: 8C51EC35500310EACF1AAF64D889B69B3E9EF47310F149847F906DF296DB709C44CB56

Function 003B9B51 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 003441EA: _wcslen.LIBCMT ref: 003441EF

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

GetOpenFileNameW.COMDLG32(00000058), ref: 003B9F2A
_wcslen.LIBCMT ref: 003B9F4B
_wcslen.LIBCMT ref: 003B9F72
GetSaveFileNameW.COMDLG32(00000058), ref: 003B9FCA

Strings

X, xrefs: 003B9E57

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: e34cf12ffd4c43689a965177b6450a3a3316592e2072073525ea7c4befad85a5
Instruction ID: 6a9bbb736769218fb5a10aa92366b3e0f9817f0ab59bae9437d9ea7da2b5ea94
Opcode Fuzzy Hash: e34cf12ffd4c43689a965177b6450a3a3316592e2072073525ea7c4befad85a5
Instruction Fuzzy Hash: E8E173316043409FD716EF25C881BAAB7E4BF85314F05856DFA899F2A2DB31ED05CB92

Function 003B6ED3 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003B6F21
CoInitialize.OLE32(00000000), ref: 003B707E
CoCreateInstance.OLE32(003E0CC4,00000000,00000001,003E0B34,?), ref: 003B7095
CoUninitialize.OLE32 ref: 003B7319

Strings

.lnk, xrefs: 003B6EFF, 003B6F69, 003B7025

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 0b8024d4b8bcbea66146c78398d49908839a1b4a4150ce81ec953d232b58f4b9
Instruction ID: 17587a9be1978c1ff47c0d5e548e76e894726e87da128cfd18938282a99a971d
Opcode Fuzzy Hash: 0b8024d4b8bcbea66146c78398d49908839a1b4a4150ce81ec953d232b58f4b9
Instruction Fuzzy Hash: 93D14B71608201AFC305EF24C881EABB7E8FF99708F40496DF5859B262DB71ED45CB92

Function 003B1196 Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 003B11B3
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 003B11EE
EnterCriticalSection.KERNEL32(?), ref: 003B120A
LeaveCriticalSection.KERNEL32(?), ref: 003B1283
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 003B129A
InterlockedExchange.KERNEL32(?,000001F6), ref: 003B12C8

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: b41af17a79eda50a5b31cb689f6e827f6248f3cfba736ab76456d6a6b5211c6d
Instruction ID: 6d495bbed356e4c4dc4a492d31c74243bf408039ede475fe1118dd4821fb76b5
Opcode Fuzzy Hash: b41af17a79eda50a5b31cb689f6e827f6248f3cfba736ab76456d6a6b5211c6d
Instruction Fuzzy Hash: 47418D71900205EFDF06AF54DC85AAAB7B8FF45304F1484A5EE00AF29ADB30DE51CBA0

Function 003D8C36 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0039FBEF,00000000,?,?,00000000,?,003839E2,00000004,00000000,00000000), ref: 003D8CA7
EnableWindow.USER32(?,00000000), ref: 003D8CCD
ShowWindow.USER32(FFFFFFFF,00000000), ref: 003D8D2C
ShowWindow.USER32(?,00000004), ref: 003D8D40
EnableWindow.USER32(?,00000001), ref: 003D8D66
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 003D8D8A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 10aa3e0825a1c31e96a54b1d9e768038c0de30fe6121cd8a5385ec20c8c88065
Instruction ID: a2c30724f92ad5414184e9657e786877fd6fdd25ef5799834225402d474b6212
Opcode Fuzzy Hash: 10aa3e0825a1c31e96a54b1d9e768038c0de30fe6121cd8a5385ec20c8c88065
Instruction Fuzzy Hash: F1417171602244EFDB26DF24E985BE57BE1FB45704F1540AAE5088B2A2CB71A855CB50

Function 003C2D37 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 003C2D45

Part of subcall function 003BEF33: GetWindowRect.USER32(?,?), ref: 003BEF4B

GetDesktopWindow.USER32 ref: 003C2D6F
GetWindowRect.USER32(00000000), ref: 003C2D76
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 003C2DB2
GetCursorPos.USER32(?), ref: 003C2DDE
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 003C2E3C

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 0f5918c1c6b9589a149f2840cc7417d1f3b4e34aa2d9fdbc154a88652e0051ae
Instruction ID: d53e042feb21b4c2dea6834729c0a4f8bcaae3904b2c2f2bab02a1a2ea004937
Opcode Fuzzy Hash: 0f5918c1c6b9589a149f2840cc7417d1f3b4e34aa2d9fdbc154a88652e0051ae
Instruction Fuzzy Hash: 9E31CD72505315AFC722DF189849F9BB7A9FB85314F00091EF896E7191DB30E9098BE2

Function 003A55E1 Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 003A55F9
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 003A5616
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 003A564E
_wcslen.LIBCMT ref: 003A566C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 003A5674
_wcsstr.LIBVCRUNTIME ref: 003A567E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 003f6005eee297f79565463df213407a4c5d87de0cf8706b6536ec67194126aa
Instruction ID: 7d7b61c8af2d26585d2adb93e09dd4f70ff78159f0bf64e556552ce894553331
Opcode Fuzzy Hash: 003f6005eee297f79565463df213407a4c5d87de0cf8706b6536ec67194126aa
Instruction Fuzzy Hash: FB210532604600BBEB1B5B39EC49E7F7BACDF46760F15802AF905CE1A1EB65DC4196A0

Function 003B6263 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00345851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003455D1,?,?,00384B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00345871

_wcslen.LIBCMT ref: 003B62C0
CoInitialize.OLE32(00000000), ref: 003B63DA
CoCreateInstance.OLE32(003E0CC4,00000000,00000001,003E0B34,?), ref: 003B63F3
CoUninitialize.OLE32 ref: 003B6411

Strings

.lnk, xrefs: 003B62BB, 003B6306, 003B63CA

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 215f1a2c238de703e49231f4f9a0df90f0119c8049ced7678fcbe008b14c1e78
Instruction ID: 5faca7944765a2775dbe4719aca2f2df99323ea501c0d0a56d01f373b5196b36
Opcode Fuzzy Hash: 215f1a2c238de703e49231f4f9a0df90f0119c8049ced7678fcbe008b14c1e78
Instruction Fuzzy Hash: F0D16274A043019FC716DF24C481A6ABBE5FF89318F15885DF9899B362CB35EC45CB92

Function 003636F2 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,003636E9,00363355), ref: 00363700
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0036370E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00363727
SetLastError.KERNEL32(00000000,?,003636E9,00363355), ref: 00363779

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3f1a4340facc467a625776cd23d3a522d0609b57f243abbd7d54d19bc674c374
Instruction ID: 07a90856f3e69ac56031ed99171e076774aea2ba42f2c22981fb03d2e09b3860
Opcode Fuzzy Hash: 3f1a4340facc467a625776cd23d3a522d0609b57f243abbd7d54d19bc674c374
Instruction Fuzzy Hash: EE014CB694E3113EE7272BF4BDC65772798EB05775B208339F114590F8EF224D015544

Function 003730E7 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00364D53,00000000,?,?,003668E2,?,?,00000000), ref: 003730EB
_free.LIBCMT ref: 0037311E
_free.LIBCMT ref: 00373146
SetLastError.KERNEL32(00000000,?,00000000), ref: 00373153
SetLastError.KERNEL32(00000000,?,00000000), ref: 0037315F
_abort.LIBCMT ref: 00373165

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6c9e57a1e63136a490bae16226f09108c7b761c4b69cc9699daca0df60c968f8
Instruction ID: 0880e675e2380e1794f878d2d24f62b382a01894bff5933f25bfef5e49e95cf8
Opcode Fuzzy Hash: 6c9e57a1e63136a490bae16226f09108c7b761c4b69cc9699daca0df60c968f8
Instruction Fuzzy Hash: 79F0A97994550076C3333735BC06A5B27599FC5770F65C415F92CDA2D2EE2C89026161

Function 003D9480 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00341F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00341F87
Part of subcall function 00341F2D: SelectObject.GDI32(?,00000000), ref: 00341F96
Part of subcall function 00341F2D: BeginPath.GDI32(?), ref: 00341FAD
Part of subcall function 00341F2D: SelectObject.GDI32(?,00000000), ref: 00341FD6

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 003D94AA
LineTo.GDI32(?,00000003,00000000), ref: 003D94BE
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 003D94CC
LineTo.GDI32(?,00000000,00000003), ref: 003D94DC
EndPath.GDI32(?), ref: 003D94EC
StrokePath.GDI32(?), ref: 003D94FC

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: d53d350a8f14f3ff49c5dafee321ffda859dda530a07638e343b178ba74ec23f
Instruction ID: e607a1d9035c71dfd85747f684d7f40de92318a5b5f529ed5ee8faf06178762f
Opcode Fuzzy Hash: d53d350a8f14f3ff49c5dafee321ffda859dda530a07638e343b178ba74ec23f
Instruction Fuzzy Hash: 57111B7200114DBFDF029F94EC88FEA7F6DEB08360F00C022BA198A1A1C771AD55DBA0

Function 003A5B61 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 003A5B7C
GetDeviceCaps.GDI32(00000000,00000058), ref: 003A5B8D
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003A5B94
ReleaseDC.USER32(00000000,00000000), ref: 003A5B9C
MulDiv.KERNEL32(000009EC,?,00000000), ref: 003A5BB3
MulDiv.KERNEL32(000009EC,00000001,?), ref: 003A5BC5

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 08552dfa4da71a93cc5cb9ea2389dbd168423dad51f75db891fcbf6cf5d71abb
Instruction ID: f9a9b457e0347374217a205e3e4b45d79e4ae502e9cdbd1c4c6e118ee81fd797
Opcode Fuzzy Hash: 08552dfa4da71a93cc5cb9ea2389dbd168423dad51f75db891fcbf6cf5d71abb
Instruction Fuzzy Hash: D2014475A01718BBEB119BA59C49F4E7F7CEB49751F044066FA05A7280D6709C00CBA0

Function 0034327E Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 003432AF
MapVirtualKeyW.USER32(00000010,00000000), ref: 003432B7
MapVirtualKeyW.USER32(000000A0,00000000), ref: 003432C2
MapVirtualKeyW.USER32(000000A1,00000000), ref: 003432CD
MapVirtualKeyW.USER32(00000011,00000000), ref: 003432D5
MapVirtualKeyW.USER32(00000012,00000000), ref: 003432DD

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: fbddcb319069a49eb4b4db6fe5683c672e795f67d7e1e816225786432e9d267d
Instruction ID: 4243ed9ecc7cbcba774dbd892710989096e9a3fb8d74001a1ff23f50e7b0ef91
Opcode Fuzzy Hash: fbddcb319069a49eb4b4db6fe5683c672e795f67d7e1e816225786432e9d267d
Instruction Fuzzy Hash: FD0167B0942B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 003AF437 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 003AF447
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 003AF45D
GetWindowThreadProcessId.USER32(?,?), ref: 003AF46C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003AF47B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003AF485
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003AF48C

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 11409053f9f9b4bf43b722119369ef603d47c9a25f7268b39b8b07574505f1ea
Instruction ID: 501ddc6642a3b034b5efe5b09383d2d6f11a9dd1928eada35a5c0d365af3fd8b
Opcode Fuzzy Hash: 11409053f9f9b4bf43b722119369ef603d47c9a25f7268b39b8b07574505f1ea
Instruction Fuzzy Hash: 89F03A72242158BBE7225BA2AC0EEEF7B7CEFCAB11F00005AF60191090D7A06A01C6B5

Function 003834D6 Relevance: 9.0, APIs: 6, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 003834EF
SendMessageW.USER32(?,00001328,00000000,?), ref: 00383506
GetWindowDC.USER32(?), ref: 00383512
GetPixel.GDI32(00000000,?,?), ref: 00383521
ReleaseDC.USER32(?,00000000), ref: 00383533
GetSysColor.USER32(00000005), ref: 0038354D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 980cae5dbb12575a3950b5921e15a02728897c362beeaf523d77b7238ed3d61b
Instruction ID: 111516fadee6631c321d9a0305647a5984ed6f19b30fa7d8e66dfac3042676eb
Opcode Fuzzy Hash: 980cae5dbb12575a3950b5921e15a02728897c362beeaf523d77b7238ed3d61b
Instruction Fuzzy Hash: FE016D31501215EFDB526F74EC08FEA7BB9FF05721F5101A1F91AA22A0CB311E51AF50

Function 003A21C1 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 003A21CC
UnloadUserProfile.USERENV(?,?), ref: 003A21D8
CloseHandle.KERNEL32(?), ref: 003A21E1
CloseHandle.KERNEL32(?), ref: 003A21E9
GetProcessHeap.KERNEL32(00000000,?), ref: 003A21F2
HeapFree.KERNEL32(00000000), ref: 003A21F9

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 26f96561f714faa40407843af5991a0656ffbf7b45ffa1595ea81082f961b434
Instruction ID: 2a7a67917cec3df2d60ea894e465d56d99547ebbcb33a452306c785e36676360
Opcode Fuzzy Hash: 26f96561f714faa40407843af5991a0656ffbf7b45ffa1595ea81082f961b434
Instruction Fuzzy Hash: 3DE0E576005105FBDB422FA1FC0C90ABF3DFF49322F104222F22582070CB329420DB50

Function 003CB7C4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 003CB903

Part of subcall function 003441EA: _wcslen.LIBCMT ref: 003441EF

GetProcessId.KERNEL32(00000000), ref: 003CB998
CloseHandle.KERNEL32(00000000), ref: 003CB9C7

Strings

<, xrefs: 003CB8CB
@, xrefs: 003CB8D2

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: bb77084761460c64b5ee0b261a260c6dd064d03085271f889aa60a5d6c8772cd
Instruction ID: f7f964001a64391c064acff4a7096c8be5bbfb4382913144cf92a0d0e3279502
Opcode Fuzzy Hash: bb77084761460c64b5ee0b261a260c6dd064d03085271f889aa60a5d6c8772cd
Instruction Fuzzy Hash: F3713575A00215DFCB16EF54C495A9EBBF4FF08310F058499E856AF262CB74ED45CB90

Function 003A7B05 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 003A7B6D
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 003A7BA3
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 003A7BB4
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 003A7C36

Strings

DllGetClassObject, xrefs: 003A7BA9

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 6529e88ff0148a4ffb98aefc61766c79ce61b2e82594ce231cf611ec6c0af4e8
Instruction ID: 6d1462078ba3ff044482523365d8b59ede140f9d7169a27b459d024c6d53a0dc
Opcode Fuzzy Hash: 6529e88ff0148a4ffb98aefc61766c79ce61b2e82594ce231cf611ec6c0af4e8
Instruction Fuzzy Hash: 4C41BFB1604204EFDB16DF64DCC8A9ABBB9EF45320F1480AAED069F245D7B4DD44CBA0

Function 003D4818 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003D48D1
IsMenu.USER32(?), ref: 003D48E6
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003D492E
DrawMenuBar.USER32 ref: 003D4941

Strings

0, xrefs: 003D4825

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 3397f10d4df3df13cd1dba96aa53ffc35b641e557935b43c384bcfc98a26093b
Instruction ID: f0e6ec65b6e0e3c998f498a027749032b51ba1fa31f028598fa13046e0214781
Opcode Fuzzy Hash: 3397f10d4df3df13cd1dba96aa53ffc35b641e557935b43c384bcfc98a26093b
Instruction Fuzzy Hash: EF416CB6A01209EFDB11CF66F894EAA7BB9FF06324F05812AF94597350C330AD54CB60

Function 003A272F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003A45FD: GetClassNameW.USER32(?,?,000000FF), ref: 003A4620

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 003A27B3
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 003A27C6
SendMessageW.USER32(?,00000189,?,00000000), ref: 003A27F6

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

Strings

ListBox, xrefs: 003A2772
ComboBox, xrefs: 003A273D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 50ef57c60282d08ff0814ea662d99ac0a83e692c2f42cd7e4aff743116a1e84e
Instruction ID: fa3e5377496e0e7d5007c29963771d3a9e5c45c4d31b32999a05e390fc612e07
Opcode Fuzzy Hash: 50ef57c60282d08ff0814ea662d99ac0a83e692c2f42cd7e4aff743116a1e84e
Instruction Fuzzy Hash: 1021D375940104BEDB0BABA4D846DFFB7BCDF47360F10412AF462AB1E1CB79590A9A60

Function 003D39B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 003D3A29
LoadLibraryW.KERNEL32(?), ref: 003D3A30
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 003D3A45
DestroyWindow.USER32(?), ref: 003D3A4D

Strings

SysAnimate32, xrefs: 003D3A04

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 3a1628967a86bb640960b26cbeefe436cec3eb2485f5a68952cdb351662c822e
Instruction ID: 0ed35778962d77cee775a7a15704d5ac6c854e788073cb3d1cf2185100ed232a
Opcode Fuzzy Hash: 3a1628967a86bb640960b26cbeefe436cec3eb2485f5a68952cdb351662c822e
Instruction Fuzzy Hash: 5821DE72600205ABEB128F64EC90FBB37ADEF45364F11562AFA90962D0C371CD409762

Function 003D9A25 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

GetCursorPos.USER32(?), ref: 003D9A5D
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 003D9A72
GetCursorPos.USER32(?), ref: 003D9ABA
DefDlgProcW.USER32(?,0000007B,?,?,?,?), ref: 003D9AF0

Strings

(A, xrefs: 003D9A30

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID: (A
API String ID: 2864067406-3099020080
Opcode ID: 89fc94a46ff79d9537988803156b86c9444920d8ea07bfba810099c45c048e49
Instruction ID: 0d371bed3924a38bf14c2a2a94fdcdc99560e7c3acb50f24e90aaceb78c0195f
Opcode Fuzzy Hash: 89fc94a46ff79d9537988803156b86c9444920d8ea07bfba810099c45c048e49
Instruction Fuzzy Hash: 7821D132600018EFCF269F98EC48FFA7BB9EB09310F414167F9059B261D3709950DB60

Function 00341AAC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00341AF4
GetClientRect.USER32(?,?), ref: 003831F9
GetCursorPos.USER32(?), ref: 00383203
ScreenToClient.USER32(?,?), ref: 0038320E

Strings

(A, xrefs: 00341AB2

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID: (A
API String ID: 4127811313-3099020080
Opcode ID: 5f14f44ee334011b3341323069b8a70cc3fb12c73a081b78a3df1a9f3dd23412
Instruction ID: edba3dcbd92a044e0759599075a732d4077cf2d38cbdc79dbd0c098943834b62
Opcode Fuzzy Hash: 5f14f44ee334011b3341323069b8a70cc3fb12c73a081b78a3df1a9f3dd23412
Instruction Fuzzy Hash: 90118C31A02519FBCF12EFA8D9858EE77BCEB05740F400452F902EB640C770BA91CBA1

Function 003650DD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0036508E,?,?,0036502E,?,004098D8,0000000C,00365185,?,00000002), ref: 003650FD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00365110
FreeLibrary.KERNEL32(00000000,?,?,?,0036508E,?,?,0036502E,?,004098D8,0000000C,00365185,?,00000002,00000000), ref: 00365133

Strings

mscoree.dll, xrefs: 003650F6
CorExitProcess, xrefs: 00365108

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d46d1416a3717da2e1365ef4db4f4cde361ce0235b4bd2037531c02917b62759
Instruction ID: 03282e47b246ea86f3d2965518e76552c25f2fb9d49cfe0203c5030b2fae75bb
Opcode Fuzzy Hash: d46d1416a3717da2e1365ef4db4f4cde361ce0235b4bd2037531c02917b62759
Instruction Fuzzy Hash: 1EF0C834901218BBDB135F94DC09B9DBFB8EF08712F004165F806A2160CB305D80CA94

Function 0034663E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,0034668B,?,?,003462FA,?,00000001,?,?,00000000), ref: 0034664A
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0034665C
FreeLibrary.KERNEL32(00000000,?,?,0034668B,?,?,003462FA,?,00000001,?,?,00000000), ref: 0034666E

Strings

Wow64DisableWow64FsRedirection, xrefs: 00346656
kernel32.dll, xrefs: 00346642

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 1f5c1d6773076b60579b311eee67d460be332b7af91234d0d9963440dad7fd1c
Instruction ID: 42bbadd03b10addaf20d3028727de9c289f940076b76c8945617a52e0480c46e
Opcode Fuzzy Hash: 1f5c1d6773076b60579b311eee67d460be332b7af91234d0d9963440dad7fd1c
Instruction Fuzzy Hash: B8E086366026221792631B25BC09B5A766CDF83B22F070116FD01E6250DB68DC0180A5

Function 00346607 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00385657,?,?,003462FA,?,00000001,?,?,00000000), ref: 00346610
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00346622
FreeLibrary.KERNEL32(00000000,?,?,00385657,?,?,003462FA,?,00000001,?,?,00000000), ref: 00346635

Strings

Wow64RevertWow64FsRedirection, xrefs: 0034661C
kernel32.dll, xrefs: 00346609

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 5681f44034227874b941f8a89092bbdba7d92242afe467b960afcf1e5846b711
Instruction ID: 041a1f02841619160f3326f3db4a69ec8ea8d4a156e479ddea736591ea2bd699
Opcode Fuzzy Hash: 5681f44034227874b941f8a89092bbdba7d92242afe467b960afcf1e5846b711
Instruction Fuzzy Hash: C5D012366135326742732B257C19A8E7B5CEED2B517070026F902A6154CF68DD418599

Function 003B3306 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003B35C4
DeleteFileW.KERNEL32(?), ref: 003B3646
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 003B365C
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003B366D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003B367F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: d9e62b3e21b64b304aa9d89b36480197b015218a93da638f9ce65c1d3941d075
Instruction ID: 69b671b5beeb29ef659f55c1a8b30c236aaaa531d6a881d5e7164eacd63c85e4
Opcode Fuzzy Hash: d9e62b3e21b64b304aa9d89b36480197b015218a93da638f9ce65c1d3941d075
Instruction Fuzzy Hash: 18B14071D01129ABDF16DFA4CC85EDEB7BDEF49314F0040A6F609EA145EB34AB448B61

Function 003CADE7 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 003CAE87
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 003CAE95
GetProcessIoCounters.KERNEL32(00000000,?), ref: 003CAEC8
CloseHandle.KERNEL32(?), ref: 003CB09D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 23e7053e1e46f4d4e50a84a8e396239e8bb2c5580d76e77a97c0ffd76756d91b
Instruction ID: c46af39ab244295275605b471e7f30e1ca7bf56b95ad074b04a5c69623e05494
Opcode Fuzzy Hash: 23e7053e1e46f4d4e50a84a8e396239e8bb2c5580d76e77a97c0ffd76756d91b
Instruction Fuzzy Hash: 67A1AF71A04301AFE722DF28C886F2AB7E5AF44714F15885DF999DF292DB71EC408B81

Function 003CC429 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003CD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003CC10E,?,?), ref: 003CD415
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD451
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD4C8
Part of subcall function 003CD3F8: _wcslen.LIBCMT ref: 003CD4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003CC505
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003CC560
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 003CC5C3
RegCloseKey.ADVAPI32(?,?), ref: 003CC606
RegCloseKey.ADVAPI32(00000000), ref: 003CC613

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: e69c15908c6049a8143b20a1644544bdf25118a71ee67448553655f91ab4eef0
Instruction ID: 0b4bbc3cee9e931d4afe42c9c740834a74d807aaca78705499ec67b14b787ec5
Opcode Fuzzy Hash: e69c15908c6049a8143b20a1644544bdf25118a71ee67448553655f91ab4eef0
Instruction Fuzzy Hash: BC617E31218241AFD716DF14C890F6ABBE9FF85308F5495ACF4998B292CB31ED46CB91

Function 003AED12 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003AE6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003AD7CD,?), ref: 003AE714

Part of subcall function 003AE6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003AD7CD,?), ref: 003AE72D

Part of subcall function 003AEAB0: GetFileAttributesW.KERNEL32(?,003AD840), ref: 003AEAB1

lstrcmpiW.KERNEL32(?,?), ref: 003AED8A
MoveFileW.KERNEL32(?,?), ref: 003AEDC3
_wcslen.LIBCMT ref: 003AEF02
_wcslen.LIBCMT ref: 003AEF1A
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 003AEF67

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 1d275cafb8db0ad04b1b77aa10d70f603aa271642c931b642b83ebf53415021f
Instruction ID: 830baa73a8d435e51bb320aa6bc8786759c99f056e0734d91d7562b4a65237e9
Opcode Fuzzy Hash: 1d275cafb8db0ad04b1b77aa10d70f603aa271642c931b642b83ebf53415021f
Instruction Fuzzy Hash: FD5150B25083859FC726EB94D8919DBB3ECEF96300F00492EF285D7151EF71A6888B56

Function 003A9517 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003A9534
VariantClear.OLEAUT32 ref: 003A95A5
VariantClear.OLEAUT32 ref: 003A9604
VariantClear.OLEAUT32(?), ref: 003A9677
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 003A96A2

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 3e06f591b38ea2518434573e7e78ec67c99ec07597c985b532d363a8700097d3
Instruction ID: 82ca59c27167c0226fae33aba9fcd8aa0661aed97b35970b92e3f53361159a4a
Opcode Fuzzy Hash: 3e06f591b38ea2518434573e7e78ec67c99ec07597c985b532d363a8700097d3
Instruction Fuzzy Hash: 9A514AB5A00219EFCB15CF58D884AAAB7F8FF89310B15855AE905EB310E730E911CB90

Function 003B9540 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 003B95F3
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 003B961F
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 003B9677
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 003B969C
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 003B96A4

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 1d8f43fdf18b955e8cfaf40cd424e724542e1f287464069cde0680550506e09c
Instruction ID: 18ec495b2f6ad512effb86c724018f82586b123e0179c812e3f41351b2113f4c
Opcode Fuzzy Hash: 1d8f43fdf18b955e8cfaf40cd424e724542e1f287464069cde0680550506e09c
Instruction Fuzzy Hash: 68511875A00219AFCB06DF64C881AAABBF5FF49314F058059E949AF362CB35ED41CB90

Function 003C9941 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 003C999D
GetProcAddress.KERNEL32(00000000,?), ref: 003C9A2D
GetProcAddress.KERNEL32(00000000,00000000), ref: 003C9A49
GetProcAddress.KERNEL32(00000000,?), ref: 003C9A8F
FreeLibrary.KERNEL32(00000000), ref: 003C9AAF

Part of subcall function 0035F9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,003B1A02,?,753CE610), ref: 0035F9F1
Part of subcall function 0035F9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,003A0354,00000000,00000000,?,?,003B1A02,?,753CE610,?,003A0354), ref: 0035FA18

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 5ac3e950d53a96c7a5e926ff1035e474d5d061194c2719fdfd0633373ab31112
Instruction ID: 3593d681f9c49d71597abb46ae1eecbffebddf07d7373cc4f8ec6e9825610ee6
Opcode Fuzzy Hash: 5ac3e950d53a96c7a5e926ff1035e474d5d061194c2719fdfd0633373ab31112
Instruction Fuzzy Hash: 64511839A05245DFCB02DF68C485E99BBF4FF09314B1680A9E8069F762D731ED86CB91

Function 003D75AE Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 003D766B
SetWindowLongW.USER32(?,000000EC,?), ref: 003D7682
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 003D76AB
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,003BB5BE,00000000,00000000), ref: 003D76D0
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 003D76FF

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: b624a4a31c7ad190f2ed838049df1a50ecc3003ce2de2c5b328d50166ec471ae
Instruction ID: 0aff03784ff8aae60c443205d54c38bfb88dadaa66162451a0bbc8ba555b667f
Opcode Fuzzy Hash: b624a4a31c7ad190f2ed838049df1a50ecc3003ce2de2c5b328d50166ec471ae
Instruction Fuzzy Hash: 5941D336A08504AFD7268F2CEC48FA97BA9EB05350F160266F855A73E0F770ED11D650

Function 003723C1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00372433
_free.LIBCMT ref: 00372453

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: cc663fd5784f7c6099f66dbd2a2141c889eec9fd748d2317391f672bc2709875
Instruction ID: 26f4425a9e0cb567def6382065f45acf602d3066e573836d6987714ad8f5aeef
Opcode Fuzzy Hash: cc663fd5784f7c6099f66dbd2a2141c889eec9fd748d2317391f672bc2709875
Instruction Fuzzy Hash: FB41CF36A002009FDB25DF79C881A5AB3E5EF89314F1685A8E519EB395D635AD01CB80

Function 003A224E Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003A2262
PostMessageW.USER32(00000001,00000201,00000001), ref: 003A230E
Sleep.KERNEL32(00000000,?,?,?), ref: 003A2316
PostMessageW.USER32(00000001,00000202,00000000), ref: 003A2327
Sleep.KERNEL32(00000000,?,?,?,?), ref: 003A232F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: d79b1a7c07aece87b1c3e3bf18466898d84bb88e2067e74e1dd0ca2b5deabe85
Instruction ID: e2e0cba840b57e094ead185b8f26c438d5be164f78c5515bcaf528113235eba6
Opcode Fuzzy Hash: d79b1a7c07aece87b1c3e3bf18466898d84bb88e2067e74e1dd0ca2b5deabe85
Instruction Fuzzy Hash: 5F31DF71900219EFDB05CFACDD88BDE7BB9EB06315F004629F922AB2D0C370A940CB90

Function 003BD95F Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,003BCC63,00000000), ref: 003BD97D
InternetReadFile.WININET(?,00000000,?,?), ref: 003BD9B4
GetLastError.KERNEL32(?,00000000,?,?,?,003BCC63,00000000), ref: 003BD9F9
SetEvent.KERNEL32(?,?,00000000,?,?,?,003BCC63,00000000), ref: 003BDA0D
SetEvent.KERNEL32(?,?,00000000,?,?,?,003BCC63,00000000), ref: 003BDA37

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: f8f96498b2ca5cddbe6000e6990e854e57878c9694a09484bbff1d68f16a738e
Instruction ID: 53432f92a5579cd2afeb511f192cd1928fa036b83925d079984de2248e09e342
Opcode Fuzzy Hash: f8f96498b2ca5cddbe6000e6990e854e57878c9694a09484bbff1d68f16a738e
Instruction Fuzzy Hash: 0E314C71604205EFDB26DFA5D885AABBBFCEB04358F10842EE646D6950E730AE40DB60

Function 003D61A5 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 003D61E4
SendMessageW.USER32(?,00001074,?,00000001), ref: 003D623C
_wcslen.LIBCMT ref: 003D624E
_wcslen.LIBCMT ref: 003D6259
SendMessageW.USER32(?,00001002,00000000,?), ref: 003D62B5

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 8bbeef10a047bbc58bb7e7b5d7c6729646ee15c81d6f01179013002c7e49a0a8
Instruction ID: 67398981b92de4487c7e347d8d581b1cefbf1f5fbc5b430b60b6fcf6f92361f4
Opcode Fuzzy Hash: 8bbeef10a047bbc58bb7e7b5d7c6729646ee15c81d6f01179013002c7e49a0a8
Instruction Fuzzy Hash: 13219136D00218AADB129FA4EC85AEE77BCFB15324F108217F925EA284D7709985CF50

Function 003C138D Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 003C13AE
GetForegroundWindow.USER32 ref: 003C13C5
GetDC.USER32(00000000), ref: 003C1401
GetPixel.GDI32(00000000,?,00000003), ref: 003C140D
ReleaseDC.USER32(00000000,00000003), ref: 003C1445

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 044532203dae881c6b7346cf0c4c291995adfafc3b14bb32132b6e561e1e9946
Instruction ID: efc0a2f074f5e5e7da380c83eeb33e2e0576008f88c2b355b1ea4712f58f55f6
Opcode Fuzzy Hash: 044532203dae881c6b7346cf0c4c291995adfafc3b14bb32132b6e561e1e9946
Instruction Fuzzy Hash: 2D216D36601214AFD705EF65D894A9EBBE9EF49304F048469E85ADB661CA30AD00DBA0

Function 0037D13D Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0037D146
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0037D169

Part of subcall function 00373B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00366A79,?,0000015D,?,?,?,?,003685B0,000000FF,00000000,?,?), ref: 00373BC5

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0037D18F
_free.LIBCMT ref: 0037D1A2
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0037D1B1

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: fe4d93299a8c4c29de1cf590f4322ff014ac5e2383972896ca04cea4264cc045
Instruction ID: f102a12c30061e3b136a95147869577fe1ea67ac2c21bc30cc1a685798dab083
Opcode Fuzzy Hash: fe4d93299a8c4c29de1cf590f4322ff014ac5e2383972896ca04cea4264cc045
Instruction Fuzzy Hash: 4201F7766026157F3373267A6C8CC7B7B7DEEC2B61355812AFC0DC7240DA688C0181B0

Function 0037316B Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0000000A,?,?,0036F64E,0036545F,0000000A,?,00000000,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 00373170
_free.LIBCMT ref: 003731A5
_free.LIBCMT ref: 003731CC
SetLastError.KERNEL32(00000000,?,00000000,?,?,?,0000000A,00000000), ref: 003731D9
SetLastError.KERNEL32(00000000,?,00000000,?,?,?,0000000A,00000000), ref: 003731E2

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2af9c9a06d480133b0225fc4ff6d31f2fe41a893d58f8df3fb296abb2c32c27d
Instruction ID: 86aeb0edc20e2c4e054b6af94963e2009817189f20fbebc5e6e4e42b1815548f
Opcode Fuzzy Hash: 2af9c9a06d480133b0225fc4ff6d31f2fe41a893d58f8df3fb296abb2c32c27d
Instruction Fuzzy Hash: 18012D766816007BD7333734AC85E6B275D9FC53717628429F82DE6192EF3DCA016111

Function 003A08FE Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,003A0831,80070057,?,?,?,003A0C4E), ref: 003A091B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003A0831,80070057,?,?), ref: 003A0936
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003A0831,80070057,?,?), ref: 003A0944
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003A0831,80070057,?), ref: 003A0954
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,003A0831,80070057,?,?), ref: 003A0960

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 6f1c82334ac04fe599a8c5bf1104a96d5e88a0ac1478f2840baee2d61b1f85cf
Instruction ID: 9334b72c855c800129508fb3e3eb650ef38954cc7c917232b5601bb4b7aa6248
Opcode Fuzzy Hash: 6f1c82334ac04fe599a8c5bf1104a96d5e88a0ac1478f2840baee2d61b1f85cf
Instruction Fuzzy Hash: 6D018F76601204AFEB174F65EC44B9F7BADEB44751F140129F905E2221D771DD409BA0

Function 003AF292 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 003AF2AE
QueryPerformanceFrequency.KERNEL32(?), ref: 003AF2BC
Sleep.KERNEL32(00000000), ref: 003AF2C4
QueryPerformanceCounter.KERNEL32(?), ref: 003AF2CE
Sleep.KERNEL32 ref: 003AF30A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: cb30bb8f164167a12fdd63037d6f4b12f63a2bcd91835f66388d5a9705c72b2e
Instruction ID: 22e74bac908c7cc777d846f86b364cbb68971b0007867a8560b61aea5cbdf883
Opcode Fuzzy Hash: cb30bb8f164167a12fdd63037d6f4b12f63a2bcd91835f66388d5a9705c72b2e
Instruction Fuzzy Hash: 8D012979D02619EFCF02AFE4EC49AEEBB7CFB0A701F010466E542B2290DB309554C7A5

Function 003A1A45 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 003A1A60
GetLastError.KERNEL32(?,00000000,00000000,?,?,003A14E7,?,?,?), ref: 003A1A6C
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,003A14E7,?,?,?), ref: 003A1A7B
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,003A14E7,?,?,?), ref: 003A1A82
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 003A1A99

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 85dc6c66b82aba56a0ccddb2b5ef4c7d95a37422722a4a5ba92e2ef60489596b
Instruction ID: b421ca59624c658d2dc99da3b4e258a6c9370bc246f87ef4c8b9486018c294b3
Opcode Fuzzy Hash: 85dc6c66b82aba56a0ccddb2b5ef4c7d95a37422722a4a5ba92e2ef60489596b
Instruction Fuzzy Hash: F6018CB9642206BFDB124FA4EC48E6A3B6EEF893A4F210415F845C7260DA31DC408A60

Function 003A1900 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003A1916
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003A1922
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003A1931
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003A1938
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003A194E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 5028e7fb0db170569a9b576f7cf248eba351e11c9e16f440ad092c850d5f43ff
Instruction ID: a866842d7a6b0d785d3b5da1d7619360d9495ba5e82be732a8cd73f1214747dd
Opcode Fuzzy Hash: 5028e7fb0db170569a9b576f7cf248eba351e11c9e16f440ad092c850d5f43ff
Instruction Fuzzy Hash: 6EF04975241312BBDB220FA5AC49F573BADEF8A7A0F110416FA45D72A0CA70DC00CAA0

Function 003A1960 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 003A1976
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 003A1982
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003A1991
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 003A1998
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003A19AE

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: eb0dceb208138aff2212f26ff40d7b66c205d3b3b6d406e5a2a9643cbb18ca4d
Instruction ID: d7a376c18499e5b111ea0bf9e3fa60c81295cf1a9b5c21d2c1043cf45b1825cf
Opcode Fuzzy Hash: eb0dceb208138aff2212f26ff40d7b66c205d3b3b6d406e5a2a9643cbb18ca4d
Instruction Fuzzy Hash: 6CF06D75241311BBDB235FA4EC59F573BADEF8A7A0F110416FA45C72A0CB70E800CAA0

Function 003B0CB6 Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,003B0B24,?,003B3D41,?,00000001,00383AF4,?), ref: 003B0CCB
CloseHandle.KERNEL32(?,?,?,?,003B0B24,?,003B3D41,?,00000001,00383AF4,?), ref: 003B0CD8
CloseHandle.KERNEL32(?,?,?,?,003B0B24,?,003B3D41,?,00000001,00383AF4,?), ref: 003B0CE5
CloseHandle.KERNEL32(?,?,?,?,003B0B24,?,003B3D41,?,00000001,00383AF4,?), ref: 003B0CF2
CloseHandle.KERNEL32(?,?,?,?,003B0B24,?,003B3D41,?,00000001,00383AF4,?), ref: 003B0CFF
CloseHandle.KERNEL32(?,?,?,?,003B0B24,?,003B3D41,?,00000001,00383AF4,?), ref: 003B0D0C

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6e4e6f6623dbdd4cbd4b3d2ad492acf2aa07ce7cbf57bd95970ae38238e5c5cb
Instruction ID: 536c75922e20f604d6ba59c9f094df6023d9f71375d4e7d86bd96555921e32e2
Opcode Fuzzy Hash: 6e4e6f6623dbdd4cbd4b3d2ad492acf2aa07ce7cbf57bd95970ae38238e5c5cb
Instruction Fuzzy Hash: 75019071801B15DFCB35AF66D980857FBF9BE503193168A3ED29652931C7B0A948DE80

Function 003A65AB Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 003A65BF
GetWindowTextW.USER32(00000000,?,00000100), ref: 003A65D6
MessageBeep.USER32(00000000), ref: 003A65EE
KillTimer.USER32(?,0000040A), ref: 003A660A
EndDialog.USER32(?,00000001), ref: 003A6624

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: c00ebe8123adc31b5639b94af4b7ea7243f2bbd25dcff03bf62504bfe36d20d5
Instruction ID: 3f8a759cd31b3ca0a444f81c3f6f94e3fc155b5f1628e70209ffe3746673fcdf
Opcode Fuzzy Hash: c00ebe8123adc31b5639b94af4b7ea7243f2bbd25dcff03bf62504bfe36d20d5
Instruction Fuzzy Hash: BB018130941304ABEB265F20ED4FB967BBCFF01705F44065AA187A14E1DBF4AA488B90

Function 0037DABA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0037DAD2

Part of subcall function 00372D38: RtlFreeHeap.NTDLL(00000000,00000000,?,0037DB51,00411DC4,00000000,00411DC4,00000000,?,0037DB78,00411DC4,00000007,00411DC4,?,0037DF75,00411DC4), ref: 00372D4E
Part of subcall function 00372D38: GetLastError.KERNEL32(00411DC4,?,0037DB51,00411DC4,00000000,00411DC4,00000000,?,0037DB78,00411DC4,00000007,00411DC4,?,0037DF75,00411DC4,00411DC4), ref: 00372D60

_free.LIBCMT ref: 0037DAE4
_free.LIBCMT ref: 0037DAF6
_free.LIBCMT ref: 0037DB08
_free.LIBCMT ref: 0037DB1A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4c1359e7fa27ee8ea024409742adb3d8b20b67ed762e91d5978fe53baa4b35fd
Instruction ID: 6e901962ee044454e3948dc5df78b239fdcf7df1027109c832b66a8a43575dc7
Opcode Fuzzy Hash: 4c1359e7fa27ee8ea024409742adb3d8b20b67ed762e91d5978fe53baa4b35fd
Instruction Fuzzy Hash: 8EF0FF73944204ABC676EB98EA82C1B77EDBE087107968C15F01DEB502CA38FC808654

Function 00372610 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0037262E

Part of subcall function 00372D38: RtlFreeHeap.NTDLL(00000000,00000000,?,0037DB51,00411DC4,00000000,00411DC4,00000000,?,0037DB78,00411DC4,00000007,00411DC4,?,0037DF75,00411DC4), ref: 00372D4E
Part of subcall function 00372D38: GetLastError.KERNEL32(00411DC4,?,0037DB51,00411DC4,00000000,00411DC4,00000000,?,0037DB78,00411DC4,00000007,00411DC4,?,0037DF75,00411DC4,00411DC4), ref: 00372D60

_free.LIBCMT ref: 00372640
_free.LIBCMT ref: 00372653
_free.LIBCMT ref: 00372664
_free.LIBCMT ref: 00372675

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6649a5f528f6def7aa6973d0976864e54b091a42017e4a8d016bf5ab54e0c2a6
Instruction ID: f4f3a0da46294f03905825852f5020a4281c5dbdd372f7ee5502a5477026ddcf
Opcode Fuzzy Hash: 6649a5f528f6def7aa6973d0976864e54b091a42017e4a8d016bf5ab54e0c2a6
Instruction Fuzzy Hash: 79F0D071902110DBC723BF94ED41C8A3764BB28751706C967F428D6276C7794912AF8C

Function 003712B7 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00371469
__freea.LIBCMT ref: 00371487

Part of subcall function 003718A7: _free.LIBCMT ref: 003718BF

Strings

am/pm, xrefs: 003714EA
a/p, xrefs: 0037154E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 487e0a0f6022bd5b4917738dc0470816a597d55e339d225fa8bce5ed31d7135b
Instruction ID: 1462985bfcadd60e80c28856647642bb804f0dec43437cd21aea4255587d57fc
Opcode Fuzzy Hash: 487e0a0f6022bd5b4917738dc0470816a597d55e339d225fa8bce5ed31d7135b
Instruction Fuzzy Hash: 26D11377910206DADB3A9F6CC8457BAB7B5FF05710F2AC11AE80AAB650D33C9D40CB91

Function 003C5231 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 315COMMON

Download Yara Rule

APIs

Part of subcall function 003B41FA: GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,003C52EE,?,?,00000035,?), ref: 003B4229
Part of subcall function 003B41FA: FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,003C52EE,?,?,00000035,?), ref: 003B4239

GetLastError.KERNEL32(?,00000000,?,?,00000035,?), ref: 003C5419
VariantInit.OLEAUT32(?), ref: 003C550E
VariantClear.OLEAUT32(?), ref: 003C55CD

Strings

bn:, xrefs: 003C54ED, 003C55E4

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorLastVariant$ClearFormatInitMessage
String ID: bn:
API String ID: 2854431205-2304793031
Opcode ID: d4d5708d2210d3f10aa1b475c3fc878a54726aedecda0d1dcc7bd6336030236d
Instruction ID: 8e65b182eea75fedccc40ae47ffb2be76dd8aaec764d8fe1ecada493750e9d11
Opcode Fuzzy Hash: d4d5708d2210d3f10aa1b475c3fc878a54726aedecda0d1dcc7bd6336030236d
Instruction Fuzzy Hash: FCD13975A002499FCB0ADF94C891EEDBBB4FF09304F54415DE416AF292DB31A986CF50

Function 0034CF80 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0034D253

Strings

t5A, xrefs: 0034CFC8
t5A, xrefs: 0034CFCF
t5A, xrefs: 0034D23A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Init_thread_footer
String ID: t5A$t5A$t5A
API String ID: 1385522511-3912432259
Opcode ID: 2017b3b955387d72db9c84518391d4fcf1451e8d53ba1f809b1d57f65b951107
Instruction ID: d0b5309901cf3f0aa273191407003521173784999e90cc12b504ca4338bc4703
Opcode Fuzzy Hash: 2017b3b955387d72db9c84518391d4fcf1451e8d53ba1f809b1d57f65b951107
Instruction Fuzzy Hash: A4914975A00206DFCB59CF59C4906AABBF2FF59310F25856AD945AB340E731EE82CF90

Function 003C61A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?), ref: 003C623D
_wcslen.LIBCMT ref: 003C6249

Strings

bn:, xrefs: 003C61B1, 003C62E1
CALLARGARRAY, xrefs: 003C6243, 003C6248

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY$bn:
API String ID: 157775604-3788682057
Opcode ID: 7b43e1ad9d2971a12538d796c3aa46b265e2faf4a2aec0f4337c1d0ab7ed9d38
Instruction ID: 49193fb9787fc9c868329dcc7768ed1757debda24905ce99665b272ffc5072e3
Opcode Fuzzy Hash: 7b43e1ad9d2971a12538d796c3aa46b265e2faf4a2aec0f4337c1d0ab7ed9d38
Instruction Fuzzy Hash: 4C41B171E002159FCB06DFA4C882EAEBBB5FF59360F15446DE406EB252D7719D81CB90

Function 003A3063 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003ABDCA: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003A2B1D,?,?,00000034,00000800,?,00000034), ref: 003ABDF4

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 003A30AD

Part of subcall function 003ABD95: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003A2B4C,?,?,00000800,?,00001073,00000000,?,?), ref: 003ABDBF

Part of subcall function 003ABCF1: GetWindowThreadProcessId.USER32(?,?), ref: 003ABD1C
Part of subcall function 003ABCF1: OpenProcess.KERNEL32(00000438,00000000,?,?,?,003A2AE1,00000034,?,?,00001004,00000000,00000000), ref: 003ABD2C
Part of subcall function 003ABCF1: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,003A2AE1,00000034,?,?,00001004,00000000,00000000), ref: 003ABD42

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003A311A
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003A3167

Strings

@, xrefs: 003A317F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: e1d5bfcb5794e268bd1a796be08becb580b293d535127eb6a019d38ea2361153
Instruction ID: a1c4185a06e1aff244bc4c167d1eabdd044efa75937a4a578ca0f6996f41854e
Opcode Fuzzy Hash: e1d5bfcb5794e268bd1a796be08becb580b293d535127eb6a019d38ea2361153
Instruction Fuzzy Hash: 0C412C72900218BFDB12DFA4CD85ADEBBB8EF46700F004495FA45BB181DA706F85CB61

Function 00371A9E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\296336\Essex.com,00000104), ref: 00371AD9
_free.LIBCMT ref: 00371BA4
_free.LIBCMT ref: 00371BAE

Strings

C:\Users\user\AppData\Local\Temp\296336\Essex.com, xrefs: 00371AD0, 00371AD7, 00371B06, 00371B3E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\296336\Essex.com
API String ID: 2506810119-571044921
Opcode ID: d8f24dcec9072840b68484524c93691fa22bff3794fe032b8912a2121cd8f3c0
Instruction ID: 0f141b702f8809fb01c509f5eb7902f7bd55e5fe5803e7ecf659be6a04032374
Opcode Fuzzy Hash: d8f24dcec9072840b68484524c93691fa22bff3794fe032b8912a2121cd8f3c0
Instruction Fuzzy Hash: A7314572A00218AFCB32DF9DDD85D9EBBFCEB85710B1181A6E40897211E7B48E40DB94

Function 003ACB28 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 003ACBB1
DeleteMenu.USER32(?,00000007,00000000), ref: 003ACBF7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,004129C0,01197048), ref: 003ACC40

Strings

0, xrefs: 003ACB8A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: cf854e32b75ca38699511c58d2c1021505a593a07dd364b6c4357ea3b1cfaafe
Instruction ID: 1ec655133ce9e716c6a6f541569aaf0ed5f99849d9196dc398c75a00268ddb50
Opcode Fuzzy Hash: cf854e32b75ca38699511c58d2c1021505a593a07dd364b6c4357ea3b1cfaafe
Instruction Fuzzy Hash: B241D2712143029FD726DF28D884B1ABBE8EF86724F04561DF4A59B291D734E905CB62

Function 003D4EB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,003DDCD0,00000000,?,?,?,?), ref: 003D4F48
GetWindowLongW.USER32 ref: 003D4F65
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003D4F75

Strings

SysTreeView32, xrefs: 003D4F1A

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: f398c8cbe0935a0b4defcb94f292b0f1ead89881065317f21ded6613f59639de
Instruction ID: 8993fe819e60665b3063ad4a00b3fc027b978bd18b146ba1aa38e2b9d2b6bd32
Opcode Fuzzy Hash: f398c8cbe0935a0b4defcb94f292b0f1ead89881065317f21ded6613f59639de
Instruction Fuzzy Hash: 2031A232214605AFDB228F78EC45BDA77A9EF08334F254726F975A62E0D770EC509750

Function 003C3AAB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003C3DB8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,003C3AD4,?,?), ref: 003C3DD5

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 003C3AD7
_wcslen.LIBCMT ref: 003C3AF8
htons.WSOCK32(00000000,?,?,00000000), ref: 003C3B63

Strings

255.255.255.255, xrefs: 003C3AF2, 003C3AF7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 043f8bda2ba666a911eb3bff15f3b0427d2366664be4822754bbb6e7f2c82317
Instruction ID: f661db9c31be3677100994cc65d460f05a464951b692d749f5432b7af441bba7
Opcode Fuzzy Hash: 043f8bda2ba666a911eb3bff15f3b0427d2366664be4822754bbb6e7f2c82317
Instruction Fuzzy Hash: 9C31AD396042019FCB12CF28C485FAAB7A4EF15328F25C15DE816CB7A2D731EE45CB61

Function 003D4954 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 003D49DC
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 003D49F0
SendMessageW.USER32(?,00001002,00000000,?), ref: 003D4A14

Strings

SysMonthCal32, xrefs: 003D49A7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 424ee8d4be698c00f79fc63ed7471982e4997af282f94bcb03d92d8dae736aea
Instruction ID: 612b058e79abf726d1e9b4e7cab12c17c1ac117fe2ce65fa3ccdf80ef209b7ad
Opcode Fuzzy Hash: 424ee8d4be698c00f79fc63ed7471982e4997af282f94bcb03d92d8dae736aea
Instruction Fuzzy Hash: D421BF33610219ABDF128F90DC82FEB3B69EF48714F120215FA15AB1D0D6B1A851DB90

Function 003D50F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 003D51A3
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 003D51B1
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 003D51B8

Strings

msctls_updown32, xrefs: 003D5122

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: ceceae104684d6e611f85e5aa63d7a44c9e125bba38612b452e1654b8bc2ddc7
Instruction ID: 849f29cfe735546a30101b21098bd7402cbbe1e561205caba0629db130475456
Opcode Fuzzy Hash: ceceae104684d6e611f85e5aa63d7a44c9e125bba38612b452e1654b8bc2ddc7
Instruction Fuzzy Hash: A42171B6601609AFDB12DF28DC81EB737ADEF5A364B05015AF9009B361CB70EC11CBA0

Function 003D4253 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 003D42DC
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 003D42EC
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 003D4312

Strings

Listbox, xrefs: 003D42AB

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: d031a904d14bb4d9d930831e45f3846b1a37c313abb24b0137009b5f9eb021b5
Instruction ID: bbef325c951f0429c2f30a7e1ef219d734b96f2488a2f578620f25ddcd0b52ed
Opcode Fuzzy Hash: d031a904d14bb4d9d930831e45f3846b1a37c313abb24b0137009b5f9eb021b5
Instruction Fuzzy Hash: B2219232614218BBEF128F94EC85FFB376EEF89754F118526F9409B290C671DC5187A0

Function 003B5439 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003B544D
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 003B54A1
SetErrorMode.KERNEL32(00000000,?,?,003DDCD0), ref: 003B5515

Strings

%lu, xrefs: 003B54B4

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: f862c5270fdd0027c60085185a2c69d9faf63d79c4ad9eb0b2a2bbdc8d989171
Instruction ID: e8ef04203758725bb83837812139c34cc88d41f5307f299952c71e3a78f7a8ab
Opcode Fuzzy Hash: f862c5270fdd0027c60085185a2c69d9faf63d79c4ad9eb0b2a2bbdc8d989171
Instruction Fuzzy Hash: 36315371A00209AFD712DF54C885EAA77F8EF05308F1540A5F509DF262D771EE45CB61

Function 003D8305 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 003D8339
EnumChildWindows.USER32(?,003D802F,00000000), ref: 003D83B0

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

Strings

(A, xrefs: 003D834A
(A, xrefs: 003D8317

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$ActiveChildEnumLongWindows
String ID: (A$(A
API String ID: 3814560230-870051280
Opcode ID: 4ea86aa69f3f1d2489a23fabe73624fb6ef6f89ead12855738eff191998e9493
Instruction ID: 42fd2fb19a88aa5483b7b5c80820c09463ecdc99be4c0abc14462041a155105c
Opcode Fuzzy Hash: 4ea86aa69f3f1d2489a23fabe73624fb6ef6f89ead12855738eff191998e9493
Instruction Fuzzy Hash: 6F214A79200605DFC726DF28E940A96B7E5FB49720F21461AE879D73A0DBB0B861CF64

Function 003D4C89 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 003D4CED
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 003D4D02
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 003D4D0F

Strings

msctls_trackbar32, xrefs: 003D4CC4

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 0d3ef0510a5b5b33afe526fe06c3da715c0b8499cd086e8420b5756d48e78dde
Instruction ID: 8b7b642823f473e605dd09a50c6248e1925985cf3c1595f5bf63da2247d04940
Opcode Fuzzy Hash: 0d3ef0510a5b5b33afe526fe06c3da715c0b8499cd086e8420b5756d48e78dde
Instruction Fuzzy Hash: 5E113672240208BFEF225F65DC06FEB37ADEF85B24F120526FA40E61A0C271DC108B20

Function 003A389E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00348577: _wcslen.LIBCMT ref: 0034858A

Part of subcall function 003A36F4: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 003A3712
Part of subcall function 003A36F4: GetWindowThreadProcessId.USER32(?,00000000), ref: 003A3723
Part of subcall function 003A36F4: GetCurrentThreadId.KERNEL32 ref: 003A372A
Part of subcall function 003A36F4: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 003A3731

GetFocus.USER32 ref: 003A38C4

Part of subcall function 003A373B: GetParent.USER32(00000000), ref: 003A3746

GetClassNameW.USER32(?,?,00000100), ref: 003A390F
EnumChildWindows.USER32(?,003A3987), ref: 003A3937

Strings

%s%d, xrefs: 003A394B

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: cd78d5dc6bbef895c30fea3dd6161691fd782590cb5201015efb68d9db1ea5ad
Instruction ID: 627f90a474e996f081048adb25c5b3f923bba667dda2c116498958cb131c4d73
Opcode Fuzzy Hash: cd78d5dc6bbef895c30fea3dd6161691fd782590cb5201015efb68d9db1ea5ad
Instruction Fuzzy Hash: 6B11A2716002056BCF13BF749C86AEE77AAEF95304F048069F9099F292DF7099058B60

Function 003459FF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00345A34
DestroyWindow.USER32(?,003437B8,?,?,?,?,?,00343709,?,?), ref: 00345A91

Strings

<)A, xrefs: 00384F34
<)A, xrefs: 00345A09

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: DeleteDestroyObjectWindow
String ID: <)A$<)A
API String ID: 2587070983-4028890927
Opcode ID: 8f65231910db980716255a7e4ac437d6063134723fff466b85c0fae1cb5bb2b2
Instruction ID: 7a0ab26febd16834710289875d44909cfab22dd9523c54733be3cdf9ea37c579
Opcode Fuzzy Hash: 8f65231910db980716255a7e4ac437d6063134723fff466b85c0fae1cb5bb2b2
Instruction Fuzzy Hash: 0D213EB4B26A41CFDB1BDB1DEA94BA533E4AB44311F058169F401DF672CBB4AD54CB08

Function 003D6321 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 003D6360
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 003D638D
DrawMenuBar.USER32(?), ref: 003D639C

Strings

0, xrefs: 003D632E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: db576df2c57a48d23988819a9905a586d05a1cc266dfdbc448d1693f2569ff69
Instruction ID: f4006c059d56436763eba2aab3af4fd61cc275c992bcfad2c43879f27db461ff
Opcode Fuzzy Hash: db576df2c57a48d23988819a9905a586d05a1cc266dfdbc448d1693f2569ff69
Instruction Fuzzy Hash: 49018436500214EFDB129F11EC85BAE7BB9FF46351F14809AE449DA260DB308985EF21

Function 003D823D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,004128E0,003DAD55,000000FC,?,00000000,00000000,?), ref: 003D823F
GetFocus.USER32 ref: 003D8247

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

Part of subcall function 00342234: GetWindowLongW.USER32(?,000000EB), ref: 00342242

SendMessageW.USER32(?,000000B0,000001BC,000001C0), ref: 003D82B4

Strings

(A, xrefs: 003D8254

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: (A
API String ID: 3601265619-3099020080
Opcode ID: 1fcf6149c74c57b9f75eedcde9b2e261e7ff6e4de7c081ce333062631edf3617
Instruction ID: 7ce98c9ed755fedfd9f5d9fd152aa7415802c1268656034693456cb5161049e9
Opcode Fuzzy Hash: 1fcf6149c74c57b9f75eedcde9b2e261e7ff6e4de7c081ce333062631edf3617
Instruction Fuzzy Hash: 82015232602900CFC3179F6CE854AA637E6EB89320F15466AE4168B3A4CB717C57CB50

Function 003D8526 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

DestroyAcceleratorTable.USER32(?), ref: 003D8576
CreateAcceleratorTableW.USER32(00000000,?,?,?,003BBE96,00000000,00000000,?,00000001,00000002), ref: 003D858C
GetForegroundWindow.USER32(?,003BBE96,00000000,00000000,?,00000001,00000002), ref: 003D8595

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

Strings

(A, xrefs: 003D8532

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AcceleratorTableWindow$CreateDestroyForegroundLong
String ID: (A
API String ID: 986409557-3099020080
Opcode ID: 5adfa60ca0dead7aadb86a0c97c6041a0bb8003004a5a419ba7e5a2ec69c2f3e
Instruction ID: 8a77362fbcec38e70195277f1b9055984107ad3b3f76ff4fa4c2bcbecb4ee18a
Opcode Fuzzy Hash: 5adfa60ca0dead7aadb86a0c97c6041a0bb8003004a5a419ba7e5a2ec69c2f3e
Instruction Fuzzy Hash: 26015B71611744CFCB269F69FD84AA537AAFB05321F10862AE511C63B0DB70B8A0CB44

Function 003D8BCD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00414038,0041407C), ref: 003D8C1A
CloseHandle.KERNEL32 ref: 003D8C2C

Strings

8@A, xrefs: 003D8BD6
|@A, xrefs: 003D8BE5

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: 8@A$|@A
API String ID: 3712363035-4013086848
Opcode ID: eb8e94a0a3acb6ff84e8df7312bc6f4bfa19ce2f03989fd86ae37892ad1c0b7c
Instruction ID: 27abd3b2776cc4497bc31aef6b7a0bd2a79b8d90bdae7033ceb615daa5fca79e
Opcode Fuzzy Hash: eb8e94a0a3acb6ff84e8df7312bc6f4bfa19ce2f03989fd86ae37892ad1c0b7c
Instruction Fuzzy Hash: D2F05EB2581304BEE3116B62AC45FB73E6CEB49351F018032BB08EA1A1D7754C1083BD

Function 003A096F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089bc53a20cd1c76187913f2eff70a3d8138677986dca4fcc1cf7cec2f807024
Instruction ID: a464e6ee18d29152940e56fb0ae0caccbcba9c0d360c01c6c0607a5c64b38949
Opcode Fuzzy Hash: 089bc53a20cd1c76187913f2eff70a3d8138677986dca4fcc1cf7cec2f807024
Instruction Fuzzy Hash: 3CC15975A0020AEFCB09CFA4C894AAEB7B9FF49714F118598E405EF251D731EE81CB90

Function 003741F3 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0037427E
__alldvrm.LIBCMT ref: 0037447F
__alldvrm.LIBCMT ref: 003744A1

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 65ac5c1fffd7beff7dffafb7e38bd52ffe3f80321006b0a9665303c455145bc9
Instruction ID: 4df2d25c7ae588b31117465324cef1def213bc0a8760e5d0d5de039f639cb6f6
Opcode Fuzzy Hash: 65ac5c1fffd7beff7dffafb7e38bd52ffe3f80321006b0a9665303c455145bc9
Instruction Fuzzy Hash: 18A14875A003869FEB33DE19C8917AEBBE5EF11310F2581ADE59D9B242C33CA941CB50

Function 003A0D26 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,003E0BD4,?), ref: 003A0EE0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,003E0BD4,?), ref: 003A0EF8
CLSIDFromProgID.OLE32(?,?,00000000,003DDCE0,000000FF,?,00000000,00000800,00000000,?,003E0BD4,?), ref: 003A0F1D
_memcmp.LIBVCRUNTIME ref: 003A0F3E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 7829f79db27f95f429b7899f92e6bd5571968df081cac23f449218feac4c51fc
Instruction ID: c2e8355448ee8601e6b234f1049a7c8b7c82e4bb89d50810f6d07cd3fb0998de
Opcode Fuzzy Hash: 7829f79db27f95f429b7899f92e6bd5571968df081cac23f449218feac4c51fc
Instruction Fuzzy Hash: 3B811871A00109EFCB05DF94C984EEEB7B9FF89315F204598F516AB250DB71AE06CB60

Function 003CB0DC Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 003CB10C
Process32FirstW.KERNEL32(00000000,?), ref: 003CB11A

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Process32NextW.KERNEL32(00000000,?), ref: 003CB1FC
CloseHandle.KERNEL32(00000000), ref: 003CB20B

Part of subcall function 0035E36B: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00384D73,?), ref: 0035E395

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: ce06b9061bfb180cb99f68cc2c25c49f95c5263b1274327005a733ed43c3372c
Instruction ID: 00d86414d86371d2c7c305a13f49fd68816754a10a6e386bb481731cde471684
Opcode Fuzzy Hash: ce06b9061bfb180cb99f68cc2c25c49f95c5263b1274327005a733ed43c3372c
Instruction Fuzzy Hash: F35129B5908300AFD311EF24D886E5BBBE8FF89754F40492DF9859B251EB70E904CB92

Function 00381711 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00381840

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ef6bfa225b771461a83f0d5b030aa1662c8a7fef1f37e7d4fcf704e9c1419507
Instruction ID: 53c6de25af2177856456242f9c8707bb91aeed23f068db6af6a150e4b83ef3d8
Opcode Fuzzy Hash: ef6bfa225b771461a83f0d5b030aa1662c8a7fef1f37e7d4fcf704e9c1419507
Instruction Fuzzy Hash: 0D411831A00700AEDB377ABDDC83AAE3AACEF45730F1586A9F418DE191D63949425761

Function 003C2533 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 003C255A
WSAGetLastError.WSOCK32 ref: 003C2568
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 003C25E7
WSAGetLastError.WSOCK32 ref: 003C25F1

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 7365a3645d6e995f1f7ee94cebf32f402a2bc63a3a9c866e525d0d130df19c48
Instruction ID: bd9aed7756b6badfa52cdc2fd6dca402a727b32de077681e5543355952e96fc9
Opcode Fuzzy Hash: 7365a3645d6e995f1f7ee94cebf32f402a2bc63a3a9c866e525d0d130df19c48
Instruction Fuzzy Hash: BA41A474A00200AFE722AF24C886F2A77E5EB45754F54C45CF9569F2D2D7B2ED428B90

Function 003D6CB0 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003D6D1A
ScreenToClient.USER32(?,?), ref: 003D6D4D
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 003D6DBA

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 11ac0e326c58f2e1a0fa0ad604041a2084995f5b08f9e229740f2e120212270d
Instruction ID: 9706bb5f343ff0e45b9429e7273068852de8e859812305e5ea551d23e731b5c7
Opcode Fuzzy Hash: 11ac0e326c58f2e1a0fa0ad604041a2084995f5b08f9e229740f2e120212270d
Instruction Fuzzy Hash: 0F514D75A00209EFCF25DF68E9819AE7BB6FF54320F11815AF9259B390D730AE41CB50

Function 0037B79F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c17250129a74cda206b64073d47cacdfc3db217981af3755a90f16c55394807
Instruction ID: 3420b9f0c3fe468bce2bdf0975e3a2cee65d0e16639ccfc6fea3075ab6292c5d
Opcode Fuzzy Hash: 9c17250129a74cda206b64073d47cacdfc3db217981af3755a90f16c55394807
Instruction Fuzzy Hash: 5D41E171A00748BFD726AE78C841BAABBFCEB88710F10C62AF059DB291D37599018791

Function 003B611E Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 003B61C8
GetLastError.KERNEL32(?,00000000), ref: 003B61EE
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 003B6213
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 003B623F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 083f18e512c22fd18342fa7eb9fde7480619635589f3a593735cd6fdb7ea7323
Instruction ID: 2ef214e245432fc306bb1eade54be0f0740e98728c1d72b6ee499d3f5f57e5f3
Opcode Fuzzy Hash: 083f18e512c22fd18342fa7eb9fde7480619635589f3a593735cd6fdb7ea7323
Instruction Fuzzy Hash: 75413A39600610DFCB12EF14C585A5EBBE2FF89714B198488E94AAF762CB34FD41CB91

Function 003AB41E Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 003AB473
SetKeyboardState.USER32(00000080), ref: 003AB48F
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 003AB4FD
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 003AB54F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 96f5bca7620e93dc3715ae3e54bf6d484e0d1ce78f21d34748cd41eacbd44f10
Instruction ID: 2afd9ba747af0e4a3970931ae306884ab022a66a7ed15a2d65d8d8900957c2cd
Opcode Fuzzy Hash: 96f5bca7620e93dc3715ae3e54bf6d484e0d1ce78f21d34748cd41eacbd44f10
Instruction Fuzzy Hash: 46310770E406486EFF338B2698057FAFBB9EB5B310F04821AE496961D3C375898587A1

Function 003AB563 Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 003AB5B8
SetKeyboardState.USER32(00000080,?,00008000), ref: 003AB5D4
PostMessageW.USER32(00000000,00000101,00000000), ref: 003AB63B
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 003AB68D

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: fd66b0cc35e6785217d54fe26665c93996314878c9f140f6860627774757e342
Instruction ID: b32f46c0dfa5f8aceebc8d6b248069a5717146cc7d8e18b5fea5e937b09e91c2
Opcode Fuzzy Hash: fd66b0cc35e6785217d54fe26665c93996314878c9f140f6860627774757e342
Instruction Fuzzy Hash: 8931FD30D406485EFF368B6598057FAFBAAFF97310F04422AE485561F2C778C955CB91

Function 003D80AE Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 003D80D4
GetWindowRect.USER32(?,?), ref: 003D814A
PtInRect.USER32(?,?,?), ref: 003D815A
MessageBeep.USER32(00000000), ref: 003D81C6

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 6d704c816c96958906f33486cb4d878afcc6ffb295e3e65a96fa80e3ba711d50
Instruction ID: 7433158d3f09fd36bfbe5d0edabfb435903045f7993109acee2f33878fbfc0d4
Opcode Fuzzy Hash: 6d704c816c96958906f33486cb4d878afcc6ffb295e3e65a96fa80e3ba711d50
Instruction Fuzzy Hash: A541BE72B01215DFCB12CF58E881AA9B7F5FB49310F1580AAE9559B360CB70F94ACB80

Function 003D2176 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 003D2187

Part of subcall function 003A4393: GetWindowThreadProcessId.USER32(?,00000000), ref: 003A43AD
Part of subcall function 003A4393: GetCurrentThreadId.KERNEL32 ref: 003A43B4
Part of subcall function 003A4393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,003A2F00), ref: 003A43BB

GetCaretPos.USER32(?), ref: 003D219B
ClientToScreen.USER32(00000000,?), ref: 003D21E8
GetForegroundWindow.USER32 ref: 003D21EE

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: a3a700adaca67f709ee69ec340b36ede46b21c3590097df93668c3e67fd8789c
Instruction ID: c30204afa666dcc53752d622369f06014ed806ae1dd67688a8262ce72a203a3d
Opcode Fuzzy Hash: a3a700adaca67f709ee69ec340b36ede46b21c3590097df93668c3e67fd8789c
Instruction Fuzzy Hash: 73314371D01109AFC705EFA9C881CAEB7FCEF59304B5184AAE415EB311D775AE45CBA0

Function 003AE8AC Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 003441EA: _wcslen.LIBCMT ref: 003441EF

_wcslen.LIBCMT ref: 003AE8E2
_wcslen.LIBCMT ref: 003AE8F9
_wcslen.LIBCMT ref: 003AE924
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 003AE92F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 0a334cfaa081b5cf458d68d7fe8f49bc6ed092892b08d61c92b22260a82457ff
Instruction ID: 7258ad5bdc202f23723ef4c6916cdc27e004d1d79dd9208250229e4a9794d215
Opcode Fuzzy Hash: 0a334cfaa081b5cf458d68d7fe8f49bc6ed092892b08d61c92b22260a82457ff
Instruction Fuzzy Hash: F121E575D00314AFCB12AFA8D982BAEB7F8EF46310F158069E804BF245D7749E41C7A1

Function 003ADB6C Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,003DDC30), ref: 003ADBA6
GetLastError.KERNEL32 ref: 003ADBB5
CreateDirectoryW.KERNEL32(?,00000000), ref: 003ADBC4
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,003DDC30), ref: 003ADC21

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 2f8e5c57b629f81eadb3d6e630d0debefb6ebaeb35e1b64faffc7eb4de4c91cf
Instruction ID: 9789349fee90db8adeb0039ec1bba0394f17e31f7bff42f8430ca7c54ed066a9
Opcode Fuzzy Hash: 2f8e5c57b629f81eadb3d6e630d0debefb6ebaeb35e1b64faffc7eb4de4c91cf
Instruction Fuzzy Hash: B821D3715442058FC301DF24D8808ABBBE8EF5B364F500A1AF49ACB6A1D730D946CF52

Function 003D321E Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 003D32A6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003D32C0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003D32CE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 003D32DC

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 0b8492b8bc433874ed4c94120627105474cd556d23747e8b51d01dd6b831dcfa
Instruction ID: fedb6395c958f99375e59fa10205ccabc75dc3318fb8789806b4ad79fd2226b7
Opcode Fuzzy Hash: 0b8492b8bc433874ed4c94120627105474cd556d23747e8b51d01dd6b831dcfa
Instruction Fuzzy Hash: 93210032605111AFD7029B24E845F6ABBA9FF81324F24865AF8268B3D2C772ED41C7D1

Function 003A825C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003A96E4: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,003A8271,?,000000FF,?,003A90BB,00000000,?,0000001C,?,?), ref: 003A96F3
Part of subcall function 003A96E4: lstrcpyW.KERNEL32(00000000,?,?,003A8271,?,000000FF,?,003A90BB,00000000,?,0000001C,?,?,00000000), ref: 003A9719
Part of subcall function 003A96E4: lstrcmpiW.KERNEL32(00000000,?,003A8271,?,000000FF,?,003A90BB,00000000,?,0000001C,?,?), ref: 003A974A

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,003A90BB,00000000,?,0000001C,?,?,00000000), ref: 003A828A
lstrcpyW.KERNEL32(00000000,?,?,003A90BB,00000000,?,0000001C,?,?,00000000), ref: 003A82B0
lstrcmpiW.KERNEL32(00000002,cdecl,?,003A90BB,00000000,?,0000001C,?,?,00000000), ref: 003A82EB

Strings

cdecl, xrefs: 003A82E2

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 0a20818a2553d36de33e9f72c696ad6a77a62df3db05d259307ac53b8def1b5a
Instruction ID: 12dc4b0f5cbc81fbe5829cec99b4b2c562836ef0e2d486de045f5ad02735025e
Opcode Fuzzy Hash: 0a20818a2553d36de33e9f72c696ad6a77a62df3db05d259307ac53b8def1b5a
Instruction Fuzzy Hash: F911E67E200342AFCB169F38D845E7A77A9FF4A750B50402BF942CB2A4EF319811C791

Function 003D60FF Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 003D615A
_wcslen.LIBCMT ref: 003D616C
_wcslen.LIBCMT ref: 003D6177
SendMessageW.USER32(?,00001002,00000000,?), ref: 003D62B5

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 09cd101557777bb69e6284ade677c7595799862000058b7e04b66e649c898a42
Instruction ID: 3f1f5fda119ef69331d21693058933dedf79a3e0894a33bd829637ced5c4541c
Opcode Fuzzy Hash: 09cd101557777bb69e6284ade677c7595799862000058b7e04b66e649c898a42
Instruction Fuzzy Hash: 46119676900218A6DB12DF64AC85AEF777CEB11354F10412BF921D9281E774C944CB60

Function 00372079 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87688f9bfc513cb32c0166112ca4909f995c7e39b6d5f75eddec8646b97be6de
Instruction ID: f6a34ed49e09443078836d6839d0128290006a9f0dffd93c11cf3371d87415a6
Opcode Fuzzy Hash: 87688f9bfc513cb32c0166112ca4909f995c7e39b6d5f75eddec8646b97be6de
Instruction Fuzzy Hash: 6F018FB2605216BEE63326787CC1F67670DDF413B8B318325B529A51D1DA688C409170

Function 003A2374 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 003A2394
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003A23A6
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003A23BC
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003A23D7

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: adea1c0d7d28b2a651d88fe50710cfe735559e64cfb54b694844a4e0d994b10f
Instruction ID: fa0128a9607bcaf894b46e83d18f195ec7532ed6f89e7107ad577e270cea908c
Opcode Fuzzy Hash: adea1c0d7d28b2a651d88fe50710cfe735559e64cfb54b694844a4e0d994b10f
Instruction Fuzzy Hash: D811093A901218FFEF119BA9CD85F9EBBB8FB09750F210091EA01B7290D6716E10DB94

Function 003AEAED Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003AEB14
MessageBoxW.USER32(?,?,?,?), ref: 003AEB47
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 003AEB5D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 003AEB64

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 54f2873925192d3241773582048446c130582cade86401a71ea0ea23ff9852c2
Instruction ID: af5563d26d0daecf8fbdc1dd1f2f4adb887c9bebf6f6586acf4117b6b466329d
Opcode Fuzzy Hash: 54f2873925192d3241773582048446c130582cade86401a71ea0ea23ff9852c2
Instruction Fuzzy Hash: 8911DB76905229BFCB029BB89C09ADE7FADEB47310F158266F825D3690D6B4C90487B1

Function 0036D53C Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0036D369,00000000,00000004,00000000), ref: 0036D588
GetLastError.KERNEL32 ref: 0036D594
__dosmaperr.LIBCMT ref: 0036D59B
ResumeThread.KERNEL32(00000000), ref: 0036D5B9

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 635eadc00bd4176407f3eb438e75d873fd4d328cc895091022c04eb6fe71744a
Instruction ID: 67e69207e821f6fffa786973eb7380aad17463cb393ec6dcd6ade9438e7b16b2
Opcode Fuzzy Hash: 635eadc00bd4176407f3eb438e75d873fd4d328cc895091022c04eb6fe71744a
Instruction Fuzzy Hash: 0001F936E011147FCB136FA5EC05BAA7B6CEF82334F118215FA268A5E4CF708800C6A1

Function 00347873 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 003478B1
GetStockObject.GDI32(00000011), ref: 003478C5
SendMessageW.USER32(00000000,00000030,00000000), ref: 003478CF

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 7fe5438cea6088467d55ba2d382d7b373d599efa2528f4ccee88634da9deb43d
Instruction ID: fd701a3a1c57dcdb3f81810591e4d00b248c9c05cfa0b04073b2d8965125a8b8
Opcode Fuzzy Hash: 7fe5438cea6088467d55ba2d382d7b373d599efa2528f4ccee88634da9deb43d
Instruction Fuzzy Hash: 6411AD72506108BFDF135FA0DC59EEA7BADFF08364F050116FA0096120D731AC60EBA1

Function 003733E6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000364,00000000,00000000,?,0037338D,00000364,00000000,00000000,00000000,?,003735FE,00000006,FlsSetValue), ref: 00373418
GetLastError.KERNEL32(?,0037338D,00000364,00000000,00000000,00000000,?,003735FE,00000006,FlsSetValue,003E3260,FlsSetValue,00000000,00000364,?,003731B9), ref: 00373424
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0037338D,00000364,00000000,00000000,00000000,?,003735FE,00000006,FlsSetValue,003E3260,FlsSetValue,00000000), ref: 00373432

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6316cfc51feb1d45aa4948a3ef8c5875b66897c71bcff1e706315f9812deaeca
Instruction ID: 309d20d3f32d64e6e7bddf272b61b84e343a4b7283a305f030db069b1e8ee48d
Opcode Fuzzy Hash: 6316cfc51feb1d45aa4948a3ef8c5875b66897c71bcff1e706315f9812deaeca
Instruction Fuzzy Hash: 18012032652226ABC7374B7AEC449573B5CBF04B61B218620F90ED7180C734DD01D6E4

Function 003ABA6F Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,003AB69A,?,00008000), ref: 003ABA8B
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,003AB69A,?,00008000), ref: 003ABAB0
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,003AB69A,?,00008000), ref: 003ABABA
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,003AB69A,?,00008000), ref: 003ABAED

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: cad0bd9f33b397b92d3ee36668dcb67e59e507e5dd76571bb622ac9137d2fb39
Instruction ID: cdb73148c0d5b50cb7e167fcd37654cb82d7fabe7d5dc6afeb250269ee8dd7f3
Opcode Fuzzy Hash: cad0bd9f33b397b92d3ee36668dcb67e59e507e5dd76571bb622ac9137d2fb39
Instruction Fuzzy Hash: 6C118B30C01629EBCF02EFE4E948AEEFB78FF0A711F110096D941B2141CB308A50CBA5

Function 003D886F Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003D888E
ScreenToClient.USER32(?,?), ref: 003D88A6
ScreenToClient.USER32(?,?), ref: 003D88CA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 003D88E5

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 0ebd4c6c6cb632339ef797fc7927d03fc20603eef3541b6b4576680ca974ecc5
Instruction ID: 79c767ad0dddac24dd2adc51d9859eb1549bc5bd2d9d3d86ad46733a3a2f747c
Opcode Fuzzy Hash: 0ebd4c6c6cb632339ef797fc7927d03fc20603eef3541b6b4576680ca974ecc5
Instruction Fuzzy Hash: 041143B9D01209AFDB42CF98D8849EEBBB9FF08310F504156E915E3610D735AA54DF91

Function 003A36F4 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 003A3712
GetWindowThreadProcessId.USER32(?,00000000), ref: 003A3723
GetCurrentThreadId.KERNEL32 ref: 003A372A
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 003A3731

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 8c82b58fba9509e7c267c078a4bc803ed8a9764ab69d00865548e7ff25337659
Instruction ID: 7c4e4989501d90ee22cda646f11427ed7287a04120cd0613e1025e99e0fc1403
Opcode Fuzzy Hash: 8c82b58fba9509e7c267c078a4bc803ed8a9764ab69d00865548e7ff25337659
Instruction Fuzzy Hash: 64E092B11022247BDB221BA2AC4DEFB7F6CDF43BA1F400056F105D2080DAA5C940C2F1

Function 003D92BF Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00341F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00341F87
Part of subcall function 00341F2D: SelectObject.GDI32(?,00000000), ref: 00341F96
Part of subcall function 00341F2D: BeginPath.GDI32(?), ref: 00341FAD
Part of subcall function 00341F2D: SelectObject.GDI32(?,00000000), ref: 00341FD6

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 003D92E3
LineTo.GDI32(?,?,?), ref: 003D92F0
EndPath.GDI32(?), ref: 003D9300
StrokePath.GDI32(?), ref: 003D930E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 74e5dbff439f05a8c176f1f783bc24f1926b80633a0abbdcac0b4576a3beacf6
Instruction ID: 0458142875544b2f0c2c901d56077871301a1744eae37e859c201a915c0b3885
Opcode Fuzzy Hash: 74e5dbff439f05a8c176f1f783bc24f1926b80633a0abbdcac0b4576a3beacf6
Instruction Fuzzy Hash: 65F05E32106268BADB135F54BD0EFCE3F5DAF0A320F048102FA15651E1C7B555629BA9

Function 003421A0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 003421BC
SetTextColor.GDI32(?,?), ref: 003421C6
SetBkMode.GDI32(?,00000001), ref: 003421D9
GetStockObject.GDI32(00000005), ref: 003421E1

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: a250e12984d678f8f2140734bd580a577536774e2250c6b717c588bfe523ef69
Instruction ID: 8582bf8b0b788c9a2013d6192e93ad2b84258563c2e3904134f09adf952086dd
Opcode Fuzzy Hash: a250e12984d678f8f2140734bd580a577536774e2250c6b717c588bfe523ef69
Instruction Fuzzy Hash: 82E09231241340AEDB236F74BC09BE93F65EB12736F04825AF7FA581E0C77286449B10

Function 0039EC36 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0039EC36
GetDC.USER32(00000000), ref: 0039EC40
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0039EC60
ReleaseDC.USER32(?), ref: 0039EC81

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8067d32b105b8d7570be6bcc2d894cbf691547088612fd8579e590a02a473937
Instruction ID: 3ec031830c3c09abacec2733450eb6d633158ac5fae6da85343839aacfa8b610
Opcode Fuzzy Hash: 8067d32b105b8d7570be6bcc2d894cbf691547088612fd8579e590a02a473937
Instruction Fuzzy Hash: 9EE01AB0805204DFCF429FA0E908A5DBBBDFB48311F10844AE84AE7250CB3899019F40

Function 0039EC4A Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0039EC4A
GetDC.USER32(00000000), ref: 0039EC54
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0039EC60
ReleaseDC.USER32(?), ref: 0039EC81

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3be31b879f1713cf02c02d57eb3267d1d7c7a2c7d3ca87c32d75753777532d68
Instruction ID: d51ac4b85ce9435ea1aa93140a9280fc9c01ca923c889525d369f33e3ac58954
Opcode Fuzzy Hash: 3be31b879f1713cf02c02d57eb3267d1d7c7a2c7d3ca87c32d75753777532d68
Instruction Fuzzy Hash: 0AE012B0C01204EFCF429FA0E808A5DBBB9FB48311F10844AE80AE7260CB38AA019F40

Function 00393616 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 409COMMON

Download Yara Rule

Strings

bn:, xrefs: 00393631, 003938EA, 00393903, 00393B3F, 00393B58
@COM_EVENTOBJ, xrefs: 00393AD6

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LoadString
String ID: @COM_EVENTOBJ$bn:
API String ID: 2948472770-3914359590
Opcode ID: 46de31d7886f1053e76c2009cbecc9d0e684a67a7b122384d4411217786de460
Instruction ID: 8090ee1acced85a21c3dc873f0fb347a2969eadbfa9a5ae9e98c79af8e4f7b93
Opcode Fuzzy Hash: 46de31d7886f1053e76c2009cbecc9d0e684a67a7b122384d4411217786de460
Instruction Fuzzy Hash: EEF1BFB5A083009FDB26DF14C881B6AB7E0FF84704F14885DF59A9B261D775EE49CB82

Function 003C85DB Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 003605B2: EnterCriticalSection.KERNEL32(0041170C,?,00000000,?,0034D22A,00413570,00000001,00000000,?,?,003BF023,?,?,00000000,00000001,?), ref: 003605BD
Part of subcall function 003605B2: LeaveCriticalSection.KERNEL32(0041170C,?,0034D22A,00413570,00000001,00000000,?,?,003BF023,?,?,00000000,00000001,?,00000001,00412430), ref: 003605FA

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 00360413: __onexit.LIBCMT ref: 00360419

__Init_thread_footer.LIBCMT ref: 003C8658

Part of subcall function 00360568: EnterCriticalSection.KERNEL32(0041170C,00000000,?,0034D258,00413570,003827C9,00000001,00000000,?,?,003BF023,?,?,00000000,00000001,?), ref: 00360572
Part of subcall function 00360568: LeaveCriticalSection.KERNEL32(0041170C,?,0034D258,00413570,003827C9,00000001,00000000,?,?,003BF023,?,?,00000000,00000001,?,00000001), ref: 003605A5

Strings

Variable must be of type 'Object'., xrefs: 003C8697
bn:, xrefs: 003C85E5, 003C887F

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: Variable must be of type 'Object'.$bn:
API String ID: 535116098-3141235823
Opcode ID: 7558350f4051347b9e6834ce4df4f1543d72fd03e006aae73fd0de61d1852749
Instruction ID: 14e59f5533c48c71f5b101dcb19513f61364774e0e15a9452f6395f42539fe42
Opcode Fuzzy Hash: 7558350f4051347b9e6834ce4df4f1543d72fd03e006aae73fd0de61d1852749
Instruction Fuzzy Hash: EE918C74A00208EFCB06EF94D891EADBBB5FF49304F55805DF906AB692DB71AE41CB50

Function 003B57CC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 003441EA: _wcslen.LIBCMT ref: 003441EF

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 003B5919

Strings

LPT, xrefs: 003B5840
*, xrefs: 003B5855

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 611f0dadabda354c1860b047da8653a427f74151867359d467e8a2be04105d00
Instruction ID: 7da2876c00e7fbaf76d4bf0042d60e6d5ec2f703a105748b37df62819d0f3c28
Opcode Fuzzy Hash: 611f0dadabda354c1860b047da8653a427f74151867359d467e8a2be04105d00
Instruction Fuzzy Hash: 09917A75A00604DFCB16DF54C494FAABBF5AF44308F198099E94AAF762C731EE85CB90

Function 003A5703 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 223comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 003A58AF

Strings

0$A, xrefs: 003A5952
Container, xrefs: 003A581E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ContainedObject
String ID: 0$A$Container
API String ID: 3565006973-3775943865
Opcode ID: bb83e03b5c7e5fe7c7d1e7e49aebe31c89ebb034f64a3eb196d89b6b6a87474f
Instruction ID: 27399b7e39366d0282c393a6f0d74e2caf1e13e3e31a368a6a1fe0e40ba5f7e8
Opcode Fuzzy Hash: bb83e03b5c7e5fe7c7d1e7e49aebe31c89ebb034f64a3eb196d89b6b6a87474f
Instruction Fuzzy Hash: F3813970600601EFDB15DF64C884A6ABBF9FF49710F20856EF94A9F691DBB0E845CB50

Function 0036E5ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0036E67D

Strings

pow, xrefs: 0036E655, 0036E672

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: ea468760db86a95b9bb4ba4e46d680a91fa7d3af8e8e64b3a4b15e3eb3ca4b9d
Instruction ID: 8c4eee795f7cb0db8c31cf6008065cef931f4abbaf9dcfad580a5f623bf1c346
Opcode Fuzzy Hash: ea468760db86a95b9bb4ba4e46d680a91fa7d3af8e8e64b3a4b15e3eb3ca4b9d
Instruction Fuzzy Hash: 3651D065E49102D6CB337714CD4937A2BA8AB50700F71CE58F0998A2EDDF398C9E9A46

Function 0035A8EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0035A916

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: db8631b7825af1340fb342b1be7017e12fcc8dc313d4278c21914dbe06b392ca
Instruction ID: 5afe493b54c5653a9e3aa9f7c33ece391686e13fe3e8a31005d3a6edb2684ef8
Opcode Fuzzy Hash: db8631b7825af1340fb342b1be7017e12fcc8dc313d4278c21914dbe06b392ca
Instruction Fuzzy Hash: 3751503190424ACFCF27DF28C041ABA7BA4AF52310F264159FC919B2A0DB34AC86DB61

Function 0035F6CA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0035F6DB
GlobalMemoryStatusEx.KERNEL32(?), ref: 0035F6F4

Strings

@, xrefs: 0035F6E8

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: d37d1ef79c8ac913f6c6807a1632620a6f3bd2099c5686a0ada5f5c19c343c51
Instruction ID: 9d635212fe29869d349bb175a3e4a44a8da65e60c4a758faeff5e6e0d6a92146
Opcode Fuzzy Hash: d37d1ef79c8ac913f6c6807a1632620a6f3bd2099c5686a0ada5f5c19c343c51
Instruction Fuzzy Hash: 3E5147725087489BD321AF10DC86BAFBBECFB85300F81885DF1D9591A1DF709529CB66

Function 003BDB39 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 003BDB75
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 003BDB7F

Strings

|, xrefs: 003BDB50

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: d66ddaa8a83bbc5af8368d92245096069576200f9c8a3b01b19e594ec45c0435
Instruction ID: 1b0e70ead55cd6ebeb9dffd182414e70b7cc05a5c73e37b88d51c69a50b41f97
Opcode Fuzzy Hash: d66ddaa8a83bbc5af8368d92245096069576200f9c8a3b01b19e594ec45c0435
Instruction Fuzzy Hash: FB314D71C01119ABCF16DFA4CC85AEEBFB9FF14318F100029F915AA266EB719A16CF50

Function 003D4008 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 003D40BD
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 003D40F8

Strings

static, xrefs: 003D4058

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: b4f1c731a728d20f1dfc43d9748859e132312d5b431d540da489ac670119e902
Instruction ID: 6f99f473dd95051841aeac78ba95fa4c381e6229af69b03f851b607bf9c39c30
Opcode Fuzzy Hash: b4f1c731a728d20f1dfc43d9748859e132312d5b431d540da489ac670119e902
Instruction Fuzzy Hash: EA318F72510604ABDB229F68DC80AFB73ADFF48720F01861AF99587290DA71AC81CB60

Function 003D4FD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 003D50BD
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 003D50D2

Strings

', xrefs: 003D502C

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: fe9e73ba93ecce5dce52019595ec810db55c18ddb45b04ae1b5ac5ba79994a73
Instruction ID: b880b1e558ae6b1277b9ff0929388995fbe3bfac54784a095953a5ddb737d5d1
Opcode Fuzzy Hash: fe9e73ba93ecce5dce52019595ec810db55c18ddb45b04ae1b5ac5ba79994a73
Instruction Fuzzy Hash: 1B312875A0170A9FDB15CFA9D980BDEBBB9FF49300F10406AE904AB391D771A945CF90

Function 003420B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

Part of subcall function 00342234: GetWindowLongW.USER32(?,000000EB), ref: 00342242

GetParent.USER32(?), ref: 00383440
DefDlgProcW.USER32(?,00000133,?,?,?,?), ref: 003834CA

Strings

(A, xrefs: 003420B9

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LongWindow$ParentProc
String ID: (A
API String ID: 2181805148-3099020080
Opcode ID: 868f9c46c35bfaffc1010dc6cc54596af9c0f2e5ce9efd53fdba905e6a73612f
Instruction ID: 505a33755413e6fea695db46bd65089b7aefdf1a176679854d7bdca48d531acb
Opcode Fuzzy Hash: 868f9c46c35bfaffc1010dc6cc54596af9c0f2e5ce9efd53fdba905e6a73612f
Instruction Fuzzy Hash: 6621A230201244AFCB27AF69CC49DB63BA6EF06360F554294F6256F3E2C771AE51D710

Function 003D41AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00347873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 003478B1
Part of subcall function 00347873: GetStockObject.GDI32(00000011), ref: 003478C5
Part of subcall function 00347873: SendMessageW.USER32(00000000,00000030,00000000), ref: 003478CF

GetWindowRect.USER32(00000000,?), ref: 003D4216
GetSysColor.USER32(00000012), ref: 003D4230

Strings

static, xrefs: 003D41F3

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 5f96d16e7d5865f14258d788c4af16e99d383f6591707473815a04ec2207347a
Instruction ID: 5b8a8c0d1f1517cf047b6e7b897671e35adda7e1b9583ed70eae219ab4e9e134
Opcode Fuzzy Hash: 5f96d16e7d5865f14258d788c4af16e99d383f6591707473815a04ec2207347a
Instruction Fuzzy Hash: 6D11F672610209AFDB02DFB8EC45AEA7BF8EB08314F014926F955E7250D775E8619B60

Function 003BD763 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 003BD7C2
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 003BD7EB

Strings

<local>, xrefs: 003BD7AB

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: ca09e655d5b92caa468005c2356f153312063f77e75401f031af6e93dcbe1da9
Instruction ID: fd069c4156ad266cf3c1758549eee637cd98ffed9678485cfdd34b5e0a1d5cd8
Opcode Fuzzy Hash: ca09e655d5b92caa468005c2356f153312063f77e75401f031af6e93dcbe1da9
Instruction Fuzzy Hash: 1D1129712126327AD7354F628C46EF7BF5CEB127ACF104226F60993480EA749840C2F0

Function 003A75ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

CharUpperBuffW.USER32(?,?,?), ref: 003A761D
_wcslen.LIBCMT ref: 003A7629

Strings

STOP, xrefs: 003A7623, 003A7628

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 6166798803fde10c3f24ae5c0a77b2a553efa1f71d11765399e65a7b720e1258
Instruction ID: 48f2be5d1d1fd4c3fd34ec6dad6d74249ca3076d84b2cc30248bb762d7552568
Opcode Fuzzy Hash: 6166798803fde10c3f24ae5c0a77b2a553efa1f71d11765399e65a7b720e1258
Instruction Fuzzy Hash: 1401C432A149278BCB229EBDDC80ABF73B9EF62790B410524E4219A2A1EB31D900D650

Function 003A262B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003A45FD: GetClassNameW.USER32(?,?,000000FF), ref: 003A4620

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 003A2699

Strings

ListBox, xrefs: 003A2663
ComboBox, xrefs: 003A2638

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: b793480dba20dd999a684d6a9968e4324d09ec9eb8c2a95d9a07d78364ad3e81
Instruction ID: a2b06b8beecc486eda82c7422d32a325c4f2161823fb8a67bff0336f063431b8
Opcode Fuzzy Hash: b793480dba20dd999a684d6a9968e4324d09ec9eb8c2a95d9a07d78364ad3e81
Instruction Fuzzy Hash: DE01DD75A012146BCB06EB64CC51DFF77B8EF97350B50061AF4725B2D1DA71A408CB50

Function 003A2525 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003A45FD: GetClassNameW.USER32(?,?,000000FF), ref: 003A4620

SendMessageW.USER32(?,00000180,00000000,?), ref: 003A2593

Strings

ListBox, xrefs: 003A255D
ComboBox, xrefs: 003A2532

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: b3035229144d505b0399745f28a3f4d10508bf6ad41a3c5431c02535b7e4b43e
Instruction ID: c9b748d5c9a3bec71b46cd1b412e5965be7c00b408ebb01cef7d63599e7a981c
Opcode Fuzzy Hash: b3035229144d505b0399745f28a3f4d10508bf6ad41a3c5431c02535b7e4b43e
Instruction Fuzzy Hash: 1301AC75E411046BCB06EB54C956EFFB7E8DF57340F51002678426B2C1DA50EE08DAB1

Function 003A25A9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003A45FD: GetClassNameW.USER32(?,?,000000FF), ref: 003A4620

SendMessageW.USER32(?,00000182,?,00000000), ref: 003A2615

Strings

ListBox, xrefs: 003A25E1
ComboBox, xrefs: 003A25B6

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 5d75229482cb31c16dcee9822f8c6b285b24252acaccacf8b674265b5f8db76a
Instruction ID: a521d84b7fbf9a70baf8f5d8e0c87ed867e1004850e29c0251c9ce8422dea74d
Opcode Fuzzy Hash: 5d75229482cb31c16dcee9822f8c6b285b24252acaccacf8b674265b5f8db76a
Instruction Fuzzy Hash: C601A275E4110466CB0BEBA4D901EFFB7E8DB17340F500026B842BB291DBA5EE08DBB1

Function 003A26B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B329: _wcslen.LIBCMT ref: 0034B333

Part of subcall function 003A45FD: GetClassNameW.USER32(?,?,000000FF), ref: 003A4620

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 003A2720

Strings

ListBox, xrefs: 003A26ED
ComboBox, xrefs: 003A26C2

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 3a7409e644059e0846121d7c525c511743bdf64c3a9220da57e317318184406b
Instruction ID: 11ec96d3be77f3dc177d1d805666a5fdfd58856952903bc965937c951adb09b3
Opcode Fuzzy Hash: 3a7409e644059e0846121d7c525c511743bdf64c3a9220da57e317318184406b
Instruction Fuzzy Hash: 48F0F975E4021466C70BE7649C41FFF73BCEF03740F400926B462AB2C2DB61A908CA50

Function 003D9AFD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

DefDlgProcW.USER32(?,0000002B,?,?,?), ref: 003D9B6D

Part of subcall function 00342234: GetWindowLongW.USER32(?,000000EB), ref: 00342242

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 003D9B53

Strings

(A, xrefs: 003D9B06

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LongWindow$MessageProcSend
String ID: (A
API String ID: 982171247-3099020080
Opcode ID: 20162f81098c019123fa584d6381c6eecf8ed6fd12bed201b308d15807ea9aa0
Instruction ID: 71cc420d36efd5284265421fbf70872e12f44dc181e4e35cc8d71721d32b84b9
Opcode Fuzzy Hash: 20162f81098c019123fa584d6381c6eecf8ed6fd12bed201b308d15807ea9aa0
Instruction Fuzzy Hash: F901D432205214ABCB269F24FC44F963BAAFB85365F11056BF9021E3E0C7B26811DB54

Function 00373A62 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

Strings

j3>, xrefs: 00373A88
2<7, xrefs: 00373A64

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID:
String ID: 2<7$j3>
API String ID: 0-2637416001
Opcode ID: 1aa6c3311859d15ce312e48fb2b655b9ccedf37f0c068f8f00273bb5ff763e92
Instruction ID: c6c884943affc265d9de4de7152dd5c926433c8874b123c54a9d53d9c7bdbbd0
Opcode Fuzzy Hash: 1aa6c3311859d15ce312e48fb2b655b9ccedf37f0c068f8f00273bb5ff763e92
Instruction Fuzzy Hash: 4CF0B435514149AADB659F95C842AF973B8DF04700F10806ABCCECB690EB798F90E3A5

Function 003D8432 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0034249F: GetWindowLongW.USER32(00000000,000000EB), ref: 003424B0

GetWindowLongW.USER32(?,000000F0), ref: 003D8471
GetWindowLongW.USER32(?,000000EC), ref: 003D847F

Strings

(A, xrefs: 003D843E

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: LongWindow
String ID: (A
API String ID: 1378638983-3099020080
Opcode ID: 9221842ae29ebe1c3ae197d0ad33fd2ad8b4dc86fe0a8b3a7dab73a0c43d461d
Instruction ID: 0f9648b63a0afbf0d7f4a3fcb17fac5bcf98958540e9c904704ca369bd8fdd75
Opcode Fuzzy Hash: 9221842ae29ebe1c3ae197d0ad33fd2ad8b4dc86fe0a8b3a7dab73a0c43d461d
Instruction Fuzzy Hash: 26F04F712052459FC705DF6AED44DAA77B9EB86320B51862AF926CB3F0CB70A810DB50

Function 003A1461 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 003A146F

Strings

Error allocating memory., xrefs: 003A1468
AutoIt, xrefs: 003A1463

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 219b59435a7e3f11e67d7fa3078f8010266d6564f055c03f353e5f234651fdb1
Instruction ID: 6a1a2e3a4da716345b61f9839d01be9ce5ffb8becc1ec0eb18a02a61310c2454
Opcode Fuzzy Hash: 219b59435a7e3f11e67d7fa3078f8010266d6564f055c03f353e5f234651fdb1
Instruction Fuzzy Hash: 95E0483228471436D6163794BC03F8976C88F06B51F11882BF7886D5C28EF7655042D9

Function 0039E778 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(56004086,?), ref: 0039E797
FreeLibrary.KERNEL32 ref: 0039E7BD

Strings

X64, xrefs: 0039E680

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: X64
API String ID: 3013587201-893830106
Opcode ID: 78b40bdcaebfd4a12773347f5749bb9a9e16c97977caf4c52089aa170b64db31
Instruction ID: cf29ec68f5adda8d9891d3ba7b81341e67fab9ce9283384fb89a3f236ce7b3b8
Opcode Fuzzy Hash: 78b40bdcaebfd4a12773347f5749bb9a9e16c97977caf4c52089aa170b64db31
Instruction Fuzzy Hash: 24E022B1405A05CBEBB7EB604D88EA9372CBB20701F17059AE843E2021EF32C884CB44

Function 003610B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0035FAD4: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,003610E2,?,?,?,0034100A), ref: 0035FAD9

IsDebuggerPresent.KERNEL32(?,?,?,0034100A), ref: 003610E6
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0034100A), ref: 003610F5

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 003610F0

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: bd7daf7d65fdd7c16ef8a4534bff3956a660051b93a12129fe9aadb0d123e4bf
Instruction ID: 519287721c045c534dc369dcc20db250019b36d306d98df613bc86b3a5076633
Opcode Fuzzy Hash: bd7daf7d65fdd7c16ef8a4534bff3956a660051b93a12129fe9aadb0d123e4bf
Instruction Fuzzy Hash: 1BE092706007908FD3369F75E905742BBE4AF00305F04CD2DE885C6291DBF4E488CB91

Function 0035F114 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0035F151

Strings

`5A, xrefs: 0035F131
h5A, xrefs: 0035F146

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Init_thread_footer
String ID: `5A$h5A
API String ID: 1385522511-3984614717
Opcode ID: 02f1d24cbd458a744db78571a59c015f6713b0e341acb57e59caa75e4f76569c
Instruction ID: 830cc77fa2b91cf91765702af4800cad874048219f86737f39f52587cef3bf24
Opcode Fuzzy Hash: 02f1d24cbd458a744db78571a59c015f6713b0e341acb57e59caa75e4f76569c
Instruction Fuzzy Hash: ABE0D8B1404C14EFC506DB2CD841DD83376A705B23B108175E5024B2A1C7241B42CA18

Function 003B39D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 003B39F0
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 003B3A05

Strings

aut, xrefs: 003B39F9

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 10a6e174026c7513f455a8e6cad34fc045030d3f3c1944b4b4f22e4079fc4f25
Instruction ID: 72a2a0c8dbe2a6e6c3ed0c4898b4e87e0c67a80f779ad2546fd08c36023c8923
Opcode Fuzzy Hash: 10a6e174026c7513f455a8e6cad34fc045030d3f3c1944b4b4f22e4079fc4f25
Instruction Fuzzy Hash: A1D05B7150131477DA209764AC0DFCB7B6CDB44710F0005A2BA55910D1DBF4D545CB90

Function 003D2DBE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003D2DC8
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 003D2DDB

Part of subcall function 003AF292: Sleep.KERNEL32 ref: 003AF30A

Strings

Shell_TrayWnd, xrefs: 003D2DC1

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 723d83ca832ca4cd53403820576c7f2acf959eeb92ad3f23cc7fc84a5e6ca52d
Instruction ID: 016e93991c36861f3acf965410e0ea384b8bb966c35c66aade7280ae3717275e
Opcode Fuzzy Hash: 723d83ca832ca4cd53403820576c7f2acf959eeb92ad3f23cc7fc84a5e6ca52d
Instruction Fuzzy Hash: 61D0A939386300AAE224A370BC0BFD27B189B00B00F200832720AAA0C0C9A0A8008688

Function 003D2DF2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003D2E08
PostMessageW.USER32(00000000), ref: 003D2E0F

Part of subcall function 003AF292: Sleep.KERNEL32 ref: 003AF30A

Strings

Shell_TrayWnd, xrefs: 003D2E01

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 6d59317c424008bc32d09437502a40738cbf46dcf8f224499cd2dfe848c3d50c
Instruction ID: 0531ddaff6084418d8fb90e8d6e32b9301b1a24ff3bf0ba4a483249731a19fcc
Opcode Fuzzy Hash: 6d59317c424008bc32d09437502a40738cbf46dcf8f224499cd2dfe848c3d50c
Instruction Fuzzy Hash: 1CD0A9353823006AE225A370BC0BFC27B189B01B00F6008327206AA0C0C9A0B8008688

Function 0037C17D Relevance: 5.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0037C213
GetLastError.KERNEL32 ref: 0037C221
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0037C27C

Memory Dump Source

Source File: 0000000B.00000002.2328551216.0000000000341000.00000020.00000001.01000000.00000007.sdmp, Offset: 00340000, based on PE: true

Associated: 0000000B.00000002.2328524875.0000000000340000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.00000000003DD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328609513.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328661842.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2328682601.0000000000415000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_340000_Essex.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 370a03fb7f12bd56a99a04408a8c3faf1fdaeda6a6b37b6e1680487903b4069f
Instruction ID: 2d0d6ffbe636719b27906188f5349528775010bc68c2bfe221dcb10978c5e2e3
Opcode Fuzzy Hash: 370a03fb7f12bd56a99a04408a8c3faf1fdaeda6a6b37b6e1680487903b4069f
Instruction Fuzzy Hash: BA41F530610605AFDF338FE5D844AAA7BA9EF15310F26D56DF85DAB1A2DB348C00CB60

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AxoPac.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\296336\Essex.com

C:\Users\user\AppData\Local\Temp\296336\j

C:\Users\user\AppData\Local\Temp\Access

C:\Users\user\AppData\Local\Temp\Annually

C:\Users\user\AppData\Local\Temp\Anti

C:\Users\user\AppData\Local\Temp\Bulk

C:\Users\user\AppData\Local\Temp\Cornwall

C:\Users\user\AppData\Local\Temp\Eyed

C:\Users\user\AppData\Local\Temp\Floral

C:\Users\user\AppData\Local\Temp\Formed

C:\Users\user\AppData\Local\Temp\Formed.cmd (copy)

C:\Users\user\AppData\Local\Temp\Fotos

C:\Users\user\AppData\Local\Temp\Licensing

C:\Users\user\AppData\Local\Temp\Literary

Windows Analysis Report
AxoPac.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre