Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559713
MD5:	f8c0ebdfd99eee53899e32d8e4aed988
SHA1:	545673e664526108dcac27a24c8fc13a67dc3843
SHA256:	0a1bc24039aaa659832a7678aae827f1dcb79808697147b7b243904f5dc0c6fe
Tags:	exeuser-Bitsight
Infos:

Detection

Credential Flusher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Credential Flusher

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

file.exe (PID: 6628 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F8C0EBDFD99EEE53899E32D8E4AED988)

taskkill.exe (PID: 2436 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2184 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6992 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6460 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3476 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3220 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7036 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2864 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7008 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2228 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b5bf9b5-84ac-4044-9d68-cc7a2e284fb2} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 16333270f10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7684 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4088 -parentBuildID 20230927232528 -prefsHandle 4080 -prefMapHandle 4076 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf227e4f-5dc3-43be-85a4-53f86739f9d1} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 163459df510 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8184 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4992 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4684 -prefMapHandle 4880 -prefsLen 33076 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a32dfac-dcd2-4e81-916d-59d797ae6bfc} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 163451c5f10 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: file.exe PID: 6628	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security

Code function: 0_2_0029EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0029EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0029ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0029ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0029EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0028AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0028AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002B9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_002B9576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.2161870215.00000000002E2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_0d827098-8
Source: file.exe, 00000000.00000000.2161870215.00000000002E2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ea7c14b3-f
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_956101aa-5
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8fccd31d-1

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_0000022EA6492377 NtQuerySystemInformation,		17_2_0000022EA6492377
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_0000022EA64B33B2 NtQuerySystemInformation,		17_2_0000022EA64B33B2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0028D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0028D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00281201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00281201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0028E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0028E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022BF40	0_2_0022BF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00228060	0_2_00228060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00292046	0_2_00292046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00288298	0_2_00288298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0025E4FF	0_2_0025E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0025676B	0_2_0025676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002B4873	0_2_002B4873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024CAA0	0_2_0024CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022CAF0	0_2_0022CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023CC39	0_2_0023CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00256DD9	0_2_00256DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023B119	0_2_0023B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002291C0	0_2_002291C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00241394	0_2_00241394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024781B	0_2_0024781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00227920	0_2_00227920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023997D	0_2_0023997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00247A4A	0_2_00247A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00247CA7	0_2_00247CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00273CD2	0_2_00273CD2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002ABE44	0_2_002ABE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00259EEE	0_2_00259EEE
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_0000022EA6492377	17_2_0000022EA6492377
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_0000022EA64B33B2	17_2_0000022EA64B33B2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_0000022EA64B3ADC	17_2_0000022EA64B3ADC
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_0000022EA64B33F2	17_2_0000022EA64B33F2

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00229CB3 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0023F9F2 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00240A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.troj.evad.winEXE@34/34@67/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002937B5 GetLastError,FormatMessageW,

0_2_002937B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002810BF AdjustTokenPrivileges,CloseHandle,		0_2_002810BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002816C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_002816C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002951CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_002951CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0028D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0028D4DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0029648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0029648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002242A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_002242A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6392:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:796:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 0000000E.00000003.2409064834.000001634ECEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2314084280.000001634F76A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000000E.00000003.2409064834.000001634ECEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 0000000E.00000003.2409064834.000001634ECEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 0000000E.00000003.2409064834.000001634ECEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 0000000E.00000003.2358541806.000001634F1C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: firefox.exe, 0000000E.00000003.2409064834.000001634ECEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 0000000E.00000003.2409064834.000001634ECEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 0000000E.00000003.2409064834.000001634ECEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 0000000E.00000003.2409064834.000001634ECEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 0000000E.00000003.2409064834.000001634ECEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);

Source: file.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2228 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b5bf9b5-84ac-4044-9d68-cc7a2e284fb2} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 16333270f10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4088 -parentBuildID 20230927232528 -prefsHandle 4080 -prefMapHandle 4076 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf227e4f-5dc3-43be-85a4-53f86739f9d1} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 163459df510 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4992 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4684 -prefMapHandle 4880 -prefsLen 33076 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a32dfac-dcd2-4e81-916d-59d797ae6bfc} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 163451c5f10 utility
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2228 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b5bf9b5-84ac-4044-9d68-cc7a2e284fb2} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 16333270f10 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4088 -parentBuildID 20230927232528 -prefsHandle 4080 -prefMapHandle 4076 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf227e4f-5dc3-43be-85a4-53f86739f9d1} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 163459df510 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4992 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4684 -prefMapHandle 4880 -prefsLen 33076 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a32dfac-dcd2-4e81-916d-59d797ae6bfc} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 163451c5f10 utility	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: webauthn.pdb source: firefox.exe, 0000000E.00000003.2274512610.000001634FBC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: wshbth.pdbGCTL source: firefox.exe, 0000000E.00000003.2322233093.000001634FBE2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdus.pdb source: firefox.exe, 0000000E.00000003.2321839146.0000016340E5B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320647393.0000016340E5A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wshbth.pdb source: firefox.exe, 0000000E.00000003.2322233093.000001634FBE2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 0000000E.00000003.2321424398.000001634FBD8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: webauthn.pdbGCTL source: firefox.exe, 0000000E.00000003.2274512610.000001634FBC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 0000000E.00000003.2321424398.000001634FBD8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdus.pdbGCTL source: firefox.exe, 0000000E.00000003.2321839146.0000016340E5B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320647393.0000016340E5A000.00000004.00000020.00020000.00000000.sdmp

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_002242DE

Source: gmpopenh264.dll.tmp.14.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00240A76 push ecx; ret

0_2_00240A89

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0023F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0023F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002B1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_002B1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95309

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 17_2_0000022EA6492377 rdtsc

17_2_0000022EA6492377

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.6 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0028DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0025C2A2 FindFirstFileExW,	0_2_0025C2A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002968EE FindFirstFileW,FindClose,	0_2_002968EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0029698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0029698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0028D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0028D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00299642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00299642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0029979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0029979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00299B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00299B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00295C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00295C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_002242DE

Source: firefox.exe, 00000010.00000002.3423479433.00000198B037A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp-
Source: firefox.exe, 00000011.00000002.3422966204.0000022EA5B0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPq6
Source: firefox.exe, 00000011.00000002.3428292945.0000022EA6372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllhm4
Source: firefox.exe, 00000012.00000002.3424632122.00000177CA780000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.3423845478.00000177CA71A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000010.00000002.3428205282.00000198B0712000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 00000010.00000002.3429407591.00000198B08D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#
Source: firefox.exe, 00000010.00000002.3429407591.00000198B08D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3428292945.0000022EA6372000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000011.00000002.3428292945.0000022EA6360000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/t

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 17_2_0000022EA6492377 rdtsc

17_2_0000022EA6492377

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0029EAA2 BlockInput,

0_2_0029EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00252622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00252622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_002242DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00244CE8 mov eax, dword ptr fs:[00000030h]

0_2_00244CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00280B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00280B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00252622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00252622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0024083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0024083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002409D5 SetUnhandledExceptionFilter,	0_2_002409D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00240C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00240C21

Source: C:\Users\user\Desktop\file.exe

0_2_00281201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00262BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00262BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0028B226 SendInput,keybd_event,

0_2_0028B226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002A22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_002A22DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00280B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00281663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00281663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd
Source: firefox.exe, 0000000E.00000003.2282553851.000001634FC42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hSoftware\Policies\Microsoft\Windows\PersonalizationNoChangingStartMenuBackgroundPersonalColors_BackgroundWilStaging_02RtlDisownModuleHeapAllocationRtlQueryFeatureConfigurationRtlRegisterFeatureConfigurationChangeNotificationRtlSubscribeWnfStateChangeNotificationRtlDllShutdownInProgressntdll.dllNtQueryWnfStateDataLocal\SM0:%d:%d:%hs_p0Local\SessionImmersiveColorPreferenceBEGINTHMthmfile\Sessions\%d\Windows\ThemeSectionMessageWindowendthemewndThemeApiConnectionRequest\ThemeApiPortwinsta0SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\PersonalizeAppsUseLightThemeSystemUsesLightThemedefaultshell\themes\uxtheme\render.cppCompositedWindow::WindowdeletedrcacheMDIClientSoftware\Microsoft\Windows\DWMColorPrevalenceSoftware\Microsoft\Windows\CurrentVersion\ImmersiveShellTabletModeMENUAccentColorSoftware\Microsoft\Windows\CurrentVersion\Explorer\AccentDefaultStartColorControl Panel\DesktopAutoColorizationAccentColorMenuStartColorMenuAutoColorSoftware\Microsoft\Windows\CurrentVersion\Themes\History\ColorsSoftware\Microsoft\Windows\CurrentVersion\Themes\HistoryAccentPaletteTab$Shell_TrayWndLocal\SessionImmersiveColorMutex

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00240698 cpuid

0_2_00240698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00298195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00298195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0027D27A GetUserNameW,

0_2_0027D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0025B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_0025B952

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_002242DE

Stealing of Sensitive Information

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: file.exe PID: 6628, type: MEMORYSTR

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: file.exe PID: 6628, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002A1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_002A1204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002A1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_002A1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
star-mini.c10r.facebook.com	157.240.195.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.193	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
services.addons.mozilla.org	151.101.193.91	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.142	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
youtube-ui.l.google.com	172.217.19.174	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.65.140	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000012.00000002.3425410443.00000177CAAC4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://detectportal.firefox.com/	firefox.exe, 0000000E.00000003.2420920901.000001634F17F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://youtube.com/account?=https://ac1	firefox.exe, 00000012.00000002.3423422945.00000177CA6C0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://datastudio.google.com/embed/reporting/	firefox.exe, 0000000E.00000003.2384192036.000001634EBA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262835549.000001634465B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2261204841.00000163445A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2375354664.000001634EBA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262624431.0000016344650000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.mozilla.com0	gmpopenh264.dll.tmp.14.dr	false	high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 0000000E.00000003.2231825802.0000016347327000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2236596352.0000016347324000.00000004.00000800.00020000.00000000.sdmp	false	high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000010.00000002.3424133837.00000198B0472000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3425118502.0000022EA5E86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.3425410443.00000177CAA8F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 0000000E.00000003.2401669080.0000016344031000.00000004.00000800.00020000.00000000.sdmp	false	high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://www.leboncoin.fr/	firefox.exe, 0000000E.00000003.2431037015.000001634472C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://spocs.getpocket.com/spocs	firefox.exe, 0000000E.00000003.2420920901.000001634F17F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 0000000E.00000003.2361462820.0000016346979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359559933.000001634F13F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://screenshots.firefox.com	firefox.exe, 0000000E.00000003.2405666960.00000163416DA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://shavar.services.mozilla.com	firefox.exe, 0000000E.00000003.2394835868.0000016344E2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2427964650.0000016344E44000.00000004.00000800.00020000.00000000.sdmp	false	high
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000000E.00000003.2214509939.0000016343432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2214827178.0000016343453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2214273884.0000016343410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2214036093.0000016343200000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000000E.00000003.2430081166.000001634475F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2242651262.000001634475F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 0000000E.00000003.2398201083.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2409106830.000001634ECD6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000000E.00000003.2392806470.0000016347134000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000000E.00000003.2214509939.0000016343432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2336444172.00000163473B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2391156078.000001634C2D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2214827178.0000016343453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2214273884.0000016343410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2243204058.000001634472D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2214036093.0000016343200000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.msn.com	firefox.exe, 0000000E.00000003.2419407819.0000016345E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2366635966.0000016345E0A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000000E.00000003.2214509939.0000016343432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2214273884.0000016343410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2214036093.0000016343200000.00000004.00000800.00020000.00000000.sdmp	false	high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://youtube.com/	firefox.exe, 0000000E.00000003.2394480128.0000016345E16000.00000004.00000800.00020000.00000000.sdmp	false	high
https://content-signature-2.cdn.mozilla.net/	firefox.exe, 0000000E.00000003.2428843516.0000016344B4E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://json-schema.org/draft/2020-12/schema/=	firefox.exe, 0000000E.00000003.2401669080.0000016344031000.00000004.00000800.00020000.00000000.sdmp	false	high
https://youtube.com/account?=https://ac	firefox.exe, 00000011.00000002.3424450238.0000022EA5CF0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 0000000E.00000003.2409227988.000001634EC5C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://api.accounts.firefox.com/v1	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	prefs-1.js.14.dr	false	high
https://ok.ru/	firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.amazon.com/	firefox.exe, 0000000E.00000003.2358541806.000001634F1C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2338938458.0000016344ABB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359911174.00000163472CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2246620052.0000016344AAF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 0000000E.00000003.2392806470.0000016347136000.00000004.00000800.00020000.00000000.sdmp	false	high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	firefox.exe, 0000000E.00000003.2400247151.00000163447F7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/	firefox.exe, 0000000E.00000003.2388073668.0000016345EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3425118502.0000022EA5E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.3425410443.00000177CAA0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	firefox.exe, 0000000E.00000003.2263111698.0000016344687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262974202.0000016344675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262624431.0000016344650000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://MD8.mozilla.org/1/m	firefox.exe, 0000000E.00000003.2410426231.000001634B978000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.bbc.co.uk/	firefox.exe, 0000000E.00000003.2431037015.000001634472C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 0000000E.00000003.2409227988.000001634EC5C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000012.00000002.3425410443.00000177CAAC4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://127.0.0.1:	firefox.exe, 0000000E.00000003.2403098453.0000016343284000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2414713714.000001634B836000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220	firefox.exe, 0000000E.00000003.2262974202.0000016344675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262624431.0000016344650000.00000004.00000800.00020000.00000000.sdmp	false	high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000000E.00000003.2322499807.0000016344F26000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bugzilla.mo	firefox.exe, 0000000E.00000003.2399789677.0000016344C6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2374749812.000001634F159000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://youtube.com/account?=	recovery.jsonlz4.tmp.14.dr	false	high
https://shavar.services.mozilla.com/	firefox.exe, 0000000E.00000003.2394600759.0000016344EDA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://youtube.com/account?=https://accounts.googl	firefox.exe, 00000012.00000002.3423845478.00000177CA71A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 0000000E.00000003.2392806470.0000016347136000.00000004.00000800.00020000.00000000.sdmp	false	high
https://spocs.getpocket.com/	firefox.exe, 0000000E.00000003.2420920901.000001634F17F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2376051367.0000016345E16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2394480128.0000016345E16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3425118502.0000022EA5E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.3425410443.00000177CAA13000.00000004.00000800.00020000.00000000.sdmp	false	high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://www.iqiyi.com/	firefox.exe, 0000000E.00000003.2431037015.000001634472C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	false	high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://addons.mozilla.org/	firefox.exe, 0000000E.00000003.2375354664.000001634EB8C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
http://www.inbox.lv/rfc2368/?value=%su	firefox.exe, 0000000E.00000003.2397469728.00000163508C3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1170143	firefox.exe, 0000000E.00000003.2262974202.0000016344675000.00000004.00000800.00020000.00000000.sdmp	false	high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://monitor.firefox.com/about	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
http://mozilla.org/MPL/2.0/.	firefox.exe, 0000000E.00000003.2239108861.0000016347196000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2388883139.0000016345882000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2422856049.0000016345EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2220729394.00000163437A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2362254699.000001634693B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2402541567.0000016343865000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2396155989.0000016344F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2388653431.00000163458E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2239108861.00000163471B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2440795637.0000016346CA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2258699155.00000163453AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2219354724.0000016340CE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2363542760.00000163468DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2239108861.000001634718B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2236596352.0000016347317000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2239108861.0000016347134000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2329674699.00000163453CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2382810318.000001634521E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2242117831.00000163459B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2365549300.0000016345EA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2240970584.0000016347084000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.bellmedia.c	firefox.exe, 0000000E.00000003.2393856307.0000016346DC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2241480918.0000016346DC5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://login.microsoftonline.com	firefox.exe, 0000000E.00000003.2241480918.0000016346DD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2375934763.0000016346DD3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://coverage.mozilla.org	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
http://crl.thawte.com/ThawteTimestampingCA.crl0	gmpopenh264.dll.tmp.14.dr	false	high
https://www.zhihu.com/	firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	firefox.exe, 0000000E.00000003.2400247151.00000163447F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2239108861.00000163471AF000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	firefox.exe, 0000000E.00000003.2400247151.00000163447F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2239108861.00000163471AF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000000E.00000003.2236596352.0000016347324000.00000004.00000800.00020000.00000000.sdmp	false	high
https://blocked.cdn.mozilla.net/	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	firefox.exe, 0000000E.00000003.2392806470.000001634712B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 0000000E.00000003.2374749812.000001634F179000.00000004.00000800.00020000.00000000.sdmp	false	high
https://profiler.firefox.com	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 0000000E.00000003.2401125888.00000163440A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2431500816.0000016344095000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=793869	firefox.exe, 0000000E.00000003.2262974202.0000016344675000.00000004.00000800.00020000.00000000.sdmp	false	high
https://identity.mozilla.com/apps/relay	firefox.exe, 0000000E.00000003.2399623922.0000016344CB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2428411652.0000016344CBB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000000E.00000003.2364258940.000001634685F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2418026613.000001634685F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2421985713.0000016346861000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	firefox.exe, 0000000E.00000003.2263111698.0000016344687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262974202.0000016344675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262624431.0000016344650000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262774917.0000016344666000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000000E.00000003.2401125888.00000163440A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2431500816.0000016344095000.00000004.00000800.00020000.00000000.sdmp	false	high
https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/	firefox.exe, 0000000E.00000003.2409227988.000001634EC5C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000000E.00000003.2415206525.0000016347281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2242117831.00000163459B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high
https://www.amazon.co.uk/	firefox.exe, 0000000E.00000003.2431037015.000001634472C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/	firefox.exe, 0000000E.00000003.2394727732.0000016344E6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2358541806.000001634F195000.00000004.00000800.00020000.00000000.sdmp	false	high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000010.00000002.3427806457.00000198B0580000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3424131745.0000022EA5CA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.3424709174.00000177CA880000.00000002.10000000.00040000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.142	youtube.com	United States	15169	GOOGLEUS	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
151.101.193.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559713
Start date and time:	2024-11-20 21:04:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@34/34@67/12
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 95% Number of executed functions: 40 Number of non-executed functions: 315
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 35.80.238.59, 35.164.125.63, 52.12.64.98, 172.217.17.78, 2.20.255.154, 2.23.167.193, 88.221.134.155, 88.221.134.209, 172.217.17.74
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, shavar.prod.mozaws.net, ciscobinary.openh264.org, otelrules.azureedge.net, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, tse1.mm.bing.net, a17.rackcdn.com.mdc.edgesuite.net, g.bing.com, detectportal.prod.mozaws.net, aus5.mozilla.org, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ris.api.iris.microsoft.com, a19.dscg10.akamai.net, ocsp.digicert.com, redirector.gvt1.com, ocsp.edge.digicert.com, safebrowsing.googleapis.com, location.services.mozilla.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:05:13	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.117.188.166	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
151.101.193.91	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
34.149.100.209	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
star-mini.c10r.facebook.com	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	157.240.196.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.196.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.196.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.196.35
	http://interpro.wisc.edu/courses/maintaining-asphalt-pavements/?utm_source=Brochure&utm_medium=postal&utm_campaign=D487&utm_term=SHB&utm_content=Sep	Get hash	malicious	Unknown	Browse	157.240.196.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.196.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
twitter.com	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.193
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.193
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.193
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.193

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	34.117.77.79
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.121.53
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
FASTLYUS	https://pub-a652f10bc7cf485fb3baac4a6358c931.r2.dev/dreyflex.html	Get hash	malicious	Gabagool	Browse	151.101.66.137
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	185.199.110.133
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	151.101.194.49
	https://safelinks.mygo1.com/ls/click?upn=u001.1mDt7ytPYCJSVG-2BhF04Stdj4cHPTtKuY-2FmURzzu8QTldxw-2FzpyQYTJMxn3CPFnnsIuOY-2F5ruiOS6FLjm58JljkOmonXKnT8iwwYmA30I9bsERP5vx05gL85c3Lc-2F9WrpUfyNz12kcqjd3wt6WtaxLWxoHc5J3Zua9xQUurCc2AIjJtnP8Xu6Otzn8DBWsS0QPl2WC-2FCyrpDHulFvP0eEWn9IDo-2BqFc1GmD1SsVw5lRKY6yWeuyFQhUWIqZ4VCAeEroA6Ndqh9iaNvFz0XzERrEFYNTxkPirSQWkw6YqX5uo-3DaVWv_h5yw3DykLZfOpXzx776oAcLdVv6tuK-2FE7nfoR01CbnMOUH4fGhxn3KVtBew-2BRfJoKGgpvyhjBTXBTw1J6hN0wi-2FkZpowy1W9-2BTe-2Bf57Ts50FCXINRnefXkQ-2FFO3hKPeSa4hJKnd-2Bpj-2F7GS6r3Uq0ucRRb6izhExkinWfndIosIP-2Ff06hq3eO6ged-2F-2FYA1ldX-2BK4wuZipA-2BXRgTIkXvTbKj74iEMllOxCNkgoQZE3mKkIMM6o0L-2FNgq5TR8KcWZzS-2BEoZ1Oyop5AmC8zRE1SSKfnZ-2F0g1qg2dir-2F788Fq8CtpqmRpkFaF34nQcSYSfbixDSj0B5gj0fuY43UiPKR2D9s0w8lZaDR5dDYOswzPttauCIiIjiyfK20I-2BA4JjKFg	Get hash	malicious	Unknown	Browse	151.101.2.92
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	aJU0obOiEe	Get hash	malicious	Unknown	Browse	151.101.3.8
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
ATGS-MMD-ASUS	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	34.36.216.150
	https://safelinks.mygo1.com/ls/click?upn=u001.1mDt7ytPYCJSVG-2BhF04Stdj4cHPTtKuY-2FmURzzu8QTldxw-2FzpyQYTJMxn3CPFnnsIuOY-2F5ruiOS6FLjm58JljkOmonXKnT8iwwYmA30I9bsERP5vx05gL85c3Lc-2F9WrpUfyNz12kcqjd3wt6WtaxLWxoHc5J3Zua9xQUurCc2AIjJtnP8Xu6Otzn8DBWsS0QPl2WC-2FCyrpDHulFvP0eEWn9IDo-2BqFc1GmD1SsVw5lRKY6yWeuyFQhUWIqZ4VCAeEroA6Ndqh9iaNvFz0XzERrEFYNTxkPirSQWkw6YqX5uo-3DaVWv_h5yw3DykLZfOpXzx776oAcLdVv6tuK-2FE7nfoR01CbnMOUH4fGhxn3KVtBew-2BRfJoKGgpvyhjBTXBTw1J6hN0wi-2FkZpowy1W9-2BTe-2Bf57Ts50FCXINRnefXkQ-2FFO3hKPeSa4hJKnd-2Bpj-2F7GS6r3Uq0ucRRb6izhExkinWfndIosIP-2Ff06hq3eO6ged-2F-2FYA1ldX-2BK4wuZipA-2BXRgTIkXvTbKj74iEMllOxCNkgoQZE3mKkIMM6o0L-2FNgq5TR8KcWZzS-2BEoZ1Oyop5AmC8zRE1SSKfnZ-2F0g1qg2dir-2F788Fq8CtpqmRpkFaF34nQcSYSfbixDSj0B5gj0fuY43UiPKR2D9s0w8lZaDR5dDYOswzPttauCIiIjiyfK20I-2BA4JjKFg	Get hash	malicious	Unknown	Browse	34.128.128.0
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	m68k.elf	Get hash	malicious	Mirai	Browse	34.184.2.12
	arm4.elf	Get hash	malicious	Mirai	Browse	34.163.247.200
	x86_64.elf	Get hash	malicious	Mirai	Browse	48.21.95.72
	i486.elf	Get hash	malicious	Mirai	Browse	32.232.216.202
ATGS-MMD-ASUS	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	34.36.216.150
	https://safelinks.mygo1.com/ls/click?upn=u001.1mDt7ytPYCJSVG-2BhF04Stdj4cHPTtKuY-2FmURzzu8QTldxw-2FzpyQYTJMxn3CPFnnsIuOY-2F5ruiOS6FLjm58JljkOmonXKnT8iwwYmA30I9bsERP5vx05gL85c3Lc-2F9WrpUfyNz12kcqjd3wt6WtaxLWxoHc5J3Zua9xQUurCc2AIjJtnP8Xu6Otzn8DBWsS0QPl2WC-2FCyrpDHulFvP0eEWn9IDo-2BqFc1GmD1SsVw5lRKY6yWeuyFQhUWIqZ4VCAeEroA6Ndqh9iaNvFz0XzERrEFYNTxkPirSQWkw6YqX5uo-3DaVWv_h5yw3DykLZfOpXzx776oAcLdVv6tuK-2FE7nfoR01CbnMOUH4fGhxn3KVtBew-2BRfJoKGgpvyhjBTXBTw1J6hN0wi-2FkZpowy1W9-2BTe-2Bf57Ts50FCXINRnefXkQ-2FFO3hKPeSa4hJKnd-2Bpj-2F7GS6r3Uq0ucRRb6izhExkinWfndIosIP-2Ff06hq3eO6ged-2F-2FYA1ldX-2BK4wuZipA-2BXRgTIkXvTbKj74iEMllOxCNkgoQZE3mKkIMM6o0L-2FNgq5TR8KcWZzS-2BEoZ1Oyop5AmC8zRE1SSKfnZ-2F0g1qg2dir-2F788Fq8CtpqmRpkFaF34nQcSYSfbixDSj0B5gj0fuY43UiPKR2D9s0w8lZaDR5dDYOswzPttauCIiIjiyfK20I-2BA4JjKFg	Get hash	malicious	Unknown	Browse	34.128.128.0
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	m68k.elf	Get hash	malicious	Mirai	Browse	34.184.2.12
	arm4.elf	Get hash	malicious	Mirai	Browse	34.163.247.200
	x86_64.elf	Get hash	malicious	Mirai	Browse	48.21.95.72
	i486.elf	Get hash	malicious	Mirai	Browse	32.232.216.202

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_e4f85075-9617-4c0b-a77b-ff6ecf9aeea1.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7946
Entropy (8bit):	5.176109105231634
Encrypted:	false
SSDEEP:	192:HBMX9JKcbhbVbTbfbRbObtbyEl7nArsJA6unSrDtTkdxSof6:HiWcNhnzFSJgr/1nSrDhkdx+
MD5:	7BF0C5720398F248CB43E251D0C25F8E
SHA1:	1492C58FFBF0A133761F1E4F82DD684203502BB5
SHA-256:	2A25CC62CF47D1D7D6C90251CCF86611D4603B78D49B47C254DF48B165D8C99C
SHA-512:	CF3C329E8C0160AA3ACA199F6B3C489400E71425A0058150E565B61107E11E7C27765E0FC7CA1E008A6AACE6C4053A33C3120E4D505A8B985EE0D1CD5A39DF73
Malicious:	false
Preview:	{"type":"uninstall","id":"e4f85075-9617-4c0b-a77b-ff6ecf9aeea1","creationDate":"2024-11-20T21:57:09.229Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_e4f85075-9617-4c0b-a77b-ff6ecf9aeea1.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7946
Entropy (8bit):	5.176109105231634
Encrypted:	false
SSDEEP:	192:HBMX9JKcbhbVbTbfbRbObtbyEl7nArsJA6unSrDtTkdxSof6:HiWcNhnzFSJgr/1nSrDhkdx+
MD5:	7BF0C5720398F248CB43E251D0C25F8E
SHA1:	1492C58FFBF0A133761F1E4F82DD684203502BB5
SHA-256:	2A25CC62CF47D1D7D6C90251CCF86611D4603B78D49B47C254DF48B165D8C99C
SHA-512:	CF3C329E8C0160AA3ACA199F6B3C489400E71425A0058150E565B61107E11E7C27765E0FC7CA1E008A6AACE6C4053A33C3120E4D505A8B985EE0D1CD5A39DF73
Malicious:	false
Preview:	{"type":"uninstall","id":"e4f85075-9617-4c0b-a77b-ff6ecf9aeea1","creationDate":"2024-11-20T21:57:09.229Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.931897477554205
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLP0+p8P:gXiNFS+OcUGOdwiOdwBjkYL8c8P
MD5:	8B3560CFC14650CF72FF01B987CC2BB9
SHA1:	320620D9BE60C4D44FBBB172E6A916003660ED84
SHA-256:	4B2D54679FD728BD7358DB1A162BA09B0A4643B1B6E4E5C25D7467C66BF9086F
SHA-512:	5104081B9CB619E97AD45302E739A4626B94F2F13B449EE7B206FB3424DA0F0FC124EA661615439CE5AC2087959F96A88C48A31E0117D91C66E11B8B4189259C
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.931897477554205
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLP0+p8P:gXiNFS+OcUGOdwiOdwBjkYL8c8P
MD5:	8B3560CFC14650CF72FF01B987CC2BB9
SHA1:	320620D9BE60C4D44FBBB172E6A916003660ED84
SHA-256:	4B2D54679FD728BD7358DB1A162BA09B0A4643B1B6E4E5C25D7467C66BF9086F
SHA-512:	5104081B9CB619E97AD45302E739A4626B94F2F13B449EE7B206FB3424DA0F0FC124EA661615439CE5AC2087959F96A88C48A31E0117D91C66E11B8B4189259C
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.07333858257979299
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zkiFEm3:DLhesh7Owd4+jiFn
MD5:	36A14B75ED8E9AB7B0C6A88A2942338A
SHA1:	8980F71BFBDF24C2945494537817CB03C51176D5
SHA-256:	75A280B841D23DD50E0813A12AE7F77E9ABDD68B39D5EDCB83DE1C10B19C907D
SHA-512:	99ED78B395E08BEF687024BC6BFF230CC83420E45B671B1919B7B705AD82C146A9710EF5E0C5BCE6F84063AE43C17B3464ADD69CE4317DA1D7012B084F770268
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035615874395153645
Encrypted:	false
SSDEEP:	3:GtlstFvigDZh5B94lstFvigDZh5BlXlT89//alEl:GtWtBWWtBf89XuM
MD5:	51749170DB07995FEA092452F89564FD
SHA1:	B447A021507FCF1D054E833510DF99A699C90A86
SHA-256:	EB5D55AED88F3721CC1A39C68B1582157A7145802CECB434C28F014416DC015F
SHA-512:	0DAD3704E4A1CC913DA0396B932897C0120CC7420099CC921A7124C4C1B349518F47A9C062A1BF2D83487D083FBFEF7777974F87D2B580FD0BE299D262274107
Malicious:	false
Preview:	..-.....................8.A.......\|k"rNl.:..6.B..-.....................8.A.......\|k"rNl.:..6.B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.035023022135915946
Encrypted:	false
SSDEEP:	3:Ol1cTNAo3odKoN1gaKSrV//mwl8XW3R2:K2stN1gypuw93w
MD5:	B0A683384DFEC7A2E809E74F79F782B1
SHA1:	487EE4B7B0EC7BDD807D30D946E950F6FEEF7B0D
SHA-256:	DD51AC3402BB35C74D3D7DAA73BCDA4DA64E2C00E281CC70F553BBEEE002094A
SHA-512:	3D13CE652B4C86F7AC84E556943DA80E38EAA00DBBFBB2578635D5489ACDBB71E21EFE0E315C10999ECF32A7197CBD44B3B596A658587A4294799B9D923D9BBB
Malicious:	false
Preview:	7....-.............\|k"rNR^. Y(.0...........\|k"rN.A.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.467067750120203
Encrypted:	false
SSDEEP:	192:mnTFTRRUYbBp6zLZNMGaXfW6qU4gmzy+/3/7sn5RYiNBw8d7Sl:MKeiFNMJj2yC2dwA0
MD5:	D9A9440E9E2A77BDFDE15532E26704BD
SHA1:	71F801D18F4FA4FD60A1D9271030AD90DB951D5D
SHA-256:	0E2F4C828FFFD2E15D228EA43BCE4259E0610604F6BAB1794F03B4D253FAC165
SHA-512:	571F97520626694A621830D3B166AD4526F8F7BB15F2685516725B4C51BA9950BACEC4FB71BEF45C41BF2CA54DEDEEBDEE9A6D29CFDA3FF913CD92F46D1954C2
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732139799);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732139799);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732139799);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173213

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.467067750120203
Encrypted:	false
SSDEEP:	192:mnTFTRRUYbBp6zLZNMGaXfW6qU4gmzy+/3/7sn5RYiNBw8d7Sl:MKeiFNMJj2yC2dwA0
MD5:	D9A9440E9E2A77BDFDE15532E26704BD
SHA1:	71F801D18F4FA4FD60A1D9271030AD90DB951D5D
SHA-256:	0E2F4C828FFFD2E15D228EA43BCE4259E0610604F6BAB1794F03B4D253FAC165
SHA-512:	571F97520626694A621830D3B166AD4526F8F7BB15F2685516725B4C51BA9950BACEC4FB71BEF45C41BF2CA54DEDEEBDEE9A6D29CFDA3FF913CD92F46D1954C2
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732139799);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732139799);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732139799);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173213

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	6.33691080670962
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSNPLXnIgNR/pnxQwRlszT5sKL0G3eHVvwKXTLamhujJmyOOxmOmaot:GUpOx4VrnR6z3eNwCTL4JNKRhl
MD5:	B808F7C65D454D39E4FFA80B4EA3B7E6
SHA1:	477A42D6B7414D10EBDD12204746A31AC97984F6
SHA-256:	7910D967E1519E28707DFA5FD5EF843BA343DB09A138F870EE18E5345830E6B4
SHA-512:	BEFB4D7FD28525665506E19B6096E52045F51B913FBDB255D3D4B5264B04611F79CC768FB07AACFF61600A694E788B834DD24812C590709DF9404E04A95EF1DF
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{7bfa0137-c4a0-440b-bd0d-2f1472dcb50d}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1732139803421,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...46f3a197-db49-410a-81b3-94975c835573","zD..1...Wm..l........j..:....1":{..jUpdate...2,"startTim..`769048...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c3270bb6f2f7664428a48797f00afbef6fc","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....773380,"originA

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	6.33691080670962
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSNPLXnIgNR/pnxQwRlszT5sKL0G3eHVvwKXTLamhujJmyOOxmOmaot:GUpOx4VrnR6z3eNwCTL4JNKRhl
MD5:	B808F7C65D454D39E4FFA80B4EA3B7E6
SHA1:	477A42D6B7414D10EBDD12204746A31AC97984F6
SHA-256:	7910D967E1519E28707DFA5FD5EF843BA343DB09A138F870EE18E5345830E6B4
SHA-512:	BEFB4D7FD28525665506E19B6096E52045F51B913FBDB255D3D4B5264B04611F79CC768FB07AACFF61600A694E788B834DD24812C590709DF9404E04A95EF1DF
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{7bfa0137-c4a0-440b-bd0d-2f1472dcb50d}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1732139803421,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...46f3a197-db49-410a-81b3-94975c835573","zD..1...Wm..l........j..:....1":{..jUpdate...2,"startTim..`769048...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c3270bb6f2f7664428a48797f00afbef6fc","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....773380,"originA

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	6.33691080670962
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSNPLXnIgNR/pnxQwRlszT5sKL0G3eHVvwKXTLamhujJmyOOxmOmaot:GUpOx4VrnR6z3eNwCTL4JNKRhl
MD5:	B808F7C65D454D39E4FFA80B4EA3B7E6
SHA1:	477A42D6B7414D10EBDD12204746A31AC97984F6
SHA-256:	7910D967E1519E28707DFA5FD5EF843BA343DB09A138F870EE18E5345830E6B4
SHA-512:	BEFB4D7FD28525665506E19B6096E52045F51B913FBDB255D3D4B5264B04611F79CC768FB07AACFF61600A694E788B834DD24812C590709DF9404E04A95EF1DF
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{7bfa0137-c4a0-440b-bd0d-2f1472dcb50d}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1732139803421,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...46f3a197-db49-410a-81b3-94975c835573","zD..1...Wm..l........j..:....1":{..jUpdate...2,"startTim..`769048...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c3270bb6f2f7664428a48797f00afbef6fc","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....773380,"originA

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 4, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.042811512334329
Encrypted:	false
SSDEEP:	24:JBkSldh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jkSWEUo9LXtR+JdkOnohYsl
MD5:	21235938025E2102017AC8C9748948A4
SHA1:	A1EED1C4588724A8396C95FC9923C0A33B360FF8
SHA-256:	E34B06B180E3F73DC8E441650BB7FE694A9D58E927412D6ED40B0852B784824E
SHA-512:	D334B419A2A75179C17D7F53BF65FCC132ADE03B21059F0007ACDBB08284A281D8CE1C1CC598E6A070024D0DAE158E2E9618E121342BE068E87A051FE33D6061
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.008815371813602
Encrypted:	false
SSDEEP:	48:YrSAYcHqUQZpExB1+anOdW6VhOGVpWJzzcsYMsku7f86SLAVL775FtsfAcbyJFde:yccCTEr5NfJzzcBvbw6Kkvrc2Rn27
MD5:	D5CB86CFCF9BAAA43BFA083B8E585C1F
SHA1:	B71960AA68C91F97A03637E5A7ACAB70E01A31DB
SHA-256:	5E73A527F7CB6E02DFE6CCBDDDFD4BBFDE2A9999673A3754AFF4D67424A789C2
SHA-512:	B50EEAC5DAF632F82F40F4DC5202CB892E3D87044FFECA5BEB03C1396C595913A5A070C28E57F442C4CCDB635273561F748C3EE596B083C325C0ABBDF0E4B66F
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-20T21:56:19.258Z","profileAgeCreated":1696486829272,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.008815371813602
Encrypted:	false
SSDEEP:	48:YrSAYcHqUQZpExB1+anOdW6VhOGVpWJzzcsYMsku7f86SLAVL775FtsfAcbyJFde:yccCTEr5NfJzzcBvbw6Kkvrc2Rn27
MD5:	D5CB86CFCF9BAAA43BFA083B8E585C1F
SHA1:	B71960AA68C91F97A03637E5A7ACAB70E01A31DB
SHA-256:	5E73A527F7CB6E02DFE6CCBDDDFD4BBFDE2A9999673A3754AFF4D67424A789C2
SHA-512:	B50EEAC5DAF632F82F40F4DC5202CB892E3D87044FFECA5BEB03C1396C595913A5A070C28E57F442C4CCDB635273561F748C3EE596B083C325C0ABBDF0E4B66F
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-20T21:56:19.258Z","profileAgeCreated":1696486829272,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.592513082526213
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	922'624 bytes
MD5:	f8c0ebdfd99eee53899e32d8e4aed988
SHA1:	545673e664526108dcac27a24c8fc13a67dc3843
SHA256:	0a1bc24039aaa659832a7678aae827f1dcb79808697147b7b243904f5dc0c6fe
SHA512:	5def865c81e128351fbdbdeba233a5ec8b48d3f68709d6d3a00fc844768bb62632a882ed9e0a0d8dc1e459ae88deaa442aec94f53e6e489697c595c7d119c894
SSDEEP:	12288:1qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgayTW1:1qDEvCTbMWu7rQYlBQcBiT6rprG8aSK
TLSH:	14159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673E3B2B [Wed Nov 20 19:40:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F50A11144B3h
jmp 00007F50A1113DBFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F50A1113F9Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F50A1113F6Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F50A1116B5Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F50A1116BA8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F50A1116B91h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0xa860	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xdf000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0xa860	0xaa00	8ff34b3fe380b1a9114cc6f28b84a9aa	False	0.3690487132352941	data	5.652864034764808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xdf000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x1b26	data			1.0015827338129497
RT_GROUP_ICON	0xde2e0	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xde358	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xde36c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xde380	0x14	data	English	Great Britain	1.25
RT_VERSION	0xde394	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xde470	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 21:05:10.668642044 CET	49722	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:10.668754101 CET	443	49722	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:10.669595957 CET	49722	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:10.677395105 CET	49722	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:10.677449942 CET	443	49722	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:11.465096951 CET	49723	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:11.465147972 CET	443	49723	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:11.465581894 CET	49723	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:11.467119932 CET	49723	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:11.467135906 CET	443	49723	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:11.525741100 CET	49724	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:11.525783062 CET	443	49724	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:11.532254934 CET	49724	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:11.534941912 CET	49724	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:11.534961939 CET	443	49724	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:11.854161024 CET	49726	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:11.908430099 CET	443	49722	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:11.909142971 CET	49722	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:11.974725962 CET	80	49726	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:11.988380909 CET	49722	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:11.988418102 CET	443	49722	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:11.988513947 CET	49722	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:11.989104033 CET	443	49722	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:11.989800930 CET	49722	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:11.989800930 CET	49726	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:11.992381096 CET	49726	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:12.111854076 CET	80	49726	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:12.723834991 CET	49727	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:12.723861933 CET	443	49727	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:12.725308895 CET	49727	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:12.727046967 CET	49727	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:12.727060080 CET	443	49727	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:12.899986982 CET	49733	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:12.900002956 CET	443	49733	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:12.900070906 CET	49733	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:12.906974077 CET	49733	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:12.906985998 CET	443	49733	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:12.907217979 CET	49734	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:12.907233000 CET	443	49734	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:12.907341003 CET	49734	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:12.907478094 CET	49734	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:12.907489061 CET	443	49734	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:13.161665916 CET	80	49726	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:13.182399035 CET	49735	443	192.168.2.6	34.160.144.191
Nov 20, 2024 21:05:13.182444096 CET	443	49735	34.160.144.191	192.168.2.6
Nov 20, 2024 21:05:13.182833910 CET	49735	443	192.168.2.6	34.160.144.191
Nov 20, 2024 21:05:13.182986975 CET	49735	443	192.168.2.6	34.160.144.191
Nov 20, 2024 21:05:13.183007956 CET	443	49735	34.160.144.191	192.168.2.6
Nov 20, 2024 21:05:13.206490993 CET	49726	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:13.254545927 CET	443	49723	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.255250931 CET	443	49723	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.259330034 CET	443	49723	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.259952068 CET	49723	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.263581038 CET	49723	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.263585091 CET	443	49723	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.263683081 CET	49723	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.263755083 CET	443	49723	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.264461994 CET	49723	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.271331072 CET	443	49724	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.271403074 CET	49724	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.272114992 CET	443	49724	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.272248030 CET	49724	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.275063038 CET	49724	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.275077105 CET	443	49724	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.275187969 CET	49724	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.275240898 CET	443	49724	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.275546074 CET	49724	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.275635004 CET	49736	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.275676012 CET	443	49736	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.276511908 CET	49736	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.277889967 CET	49736	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:13.277909994 CET	443	49736	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:13.376885891 CET	49737	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:13.496750116 CET	80	49737	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:13.498151064 CET	49737	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:13.498385906 CET	49737	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:13.620963097 CET	80	49737	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:14.254399061 CET	443	49727	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.255559921 CET	49727	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.259604931 CET	49727	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.259619951 CET	443	49727	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.259721041 CET	49727	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.259862900 CET	443	49727	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.260112047 CET	49740	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.260163069 CET	443	49740	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.260206938 CET	49727	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.260622025 CET	49740	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.262032032 CET	49740	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.262058973 CET	443	49740	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.309727907 CET	443	49734	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:14.309851885 CET	49734	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:14.313045979 CET	49734	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:14.313055038 CET	443	49734	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:14.313301086 CET	443	49734	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:14.314905882 CET	49734	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:14.314992905 CET	49734	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:14.315043926 CET	443	49734	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:14.315164089 CET	49734	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:14.315181017 CET	49734	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:14.319626093 CET	443	49733	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.325438976 CET	49733	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.328757048 CET	49733	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.328768015 CET	443	49733	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.328851938 CET	49733	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.329410076 CET	443	49733	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.329464912 CET	49733	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.474517107 CET	443	49735	34.160.144.191	192.168.2.6
Nov 20, 2024 21:05:14.475220919 CET	49735	443	192.168.2.6	34.160.144.191
Nov 20, 2024 21:05:14.478095055 CET	49735	443	192.168.2.6	34.160.144.191
Nov 20, 2024 21:05:14.478104115 CET	443	49735	34.160.144.191	192.168.2.6
Nov 20, 2024 21:05:14.478408098 CET	443	49735	34.160.144.191	192.168.2.6
Nov 20, 2024 21:05:14.480566025 CET	49735	443	192.168.2.6	34.160.144.191
Nov 20, 2024 21:05:14.480648041 CET	49735	443	192.168.2.6	34.160.144.191
Nov 20, 2024 21:05:14.480715990 CET	443	49735	34.160.144.191	192.168.2.6
Nov 20, 2024 21:05:14.480803967 CET	49735	443	192.168.2.6	34.160.144.191
Nov 20, 2024 21:05:14.644820929 CET	80	49737	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:14.658468962 CET	49726	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:14.658521891 CET	49737	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:14.686965942 CET	49741	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.687036037 CET	443	49741	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.695410967 CET	49741	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.697259903 CET	49741	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:14.697299957 CET	443	49741	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:14.718475103 CET	49742	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:14.718525887 CET	443	49742	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:14.720067978 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:14.720885038 CET	49742	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:14.722249985 CET	49742	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:14.722275972 CET	443	49742	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:14.778603077 CET	80	49726	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:14.778672934 CET	49726	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:14.779112101 CET	80	49737	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:14.779180050 CET	49737	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:14.797019005 CET	49744	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:14.797049999 CET	443	49744	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:14.797277927 CET	49744	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:14.797410011 CET	49744	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:14.797419071 CET	443	49744	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:14.825989962 CET	49745	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:14.826019049 CET	443	49745	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:14.826098919 CET	49745	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:14.827904940 CET	49745	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:14.827917099 CET	443	49745	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:14.840507984 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:14.842658997 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:14.843087912 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:14.863615990 CET	49746	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:14.863632917 CET	443	49746	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:14.863852978 CET	49746	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:14.865679026 CET	49746	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:14.865691900 CET	443	49746	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:14.962769985 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:15.025557995 CET	443	49736	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:15.025950909 CET	49736	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:15.026335001 CET	443	49736	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:15.027141094 CET	49736	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:15.031750917 CET	49736	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:15.031774044 CET	443	49736	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:15.031848907 CET	49736	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:15.031935930 CET	443	49736	142.250.181.142	192.168.2.6
Nov 20, 2024 21:05:15.035589933 CET	49736	443	192.168.2.6	142.250.181.142
Nov 20, 2024 21:05:15.610310078 CET	443	49740	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:15.611253023 CET	49740	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:15.615478992 CET	49740	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:15.615516901 CET	443	49740	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:15.615566969 CET	49740	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:15.615957975 CET	443	49740	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:15.616892099 CET	49740	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:15.977215052 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:15.984817028 CET	443	49741	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:15.984832048 CET	443	49741	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:15.984899044 CET	49741	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:15.989283085 CET	49741	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:15.989335060 CET	443	49741	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:15.989388943 CET	49741	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:15.989588976 CET	443	49741	34.117.188.166	192.168.2.6
Nov 20, 2024 21:05:15.989856005 CET	49741	443	192.168.2.6	34.117.188.166
Nov 20, 2024 21:05:16.014878035 CET	49752	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.019918919 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.073432922 CET	443	49744	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:16.075989962 CET	49744	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:16.078536987 CET	49744	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:16.078548908 CET	443	49744	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:16.078883886 CET	443	49744	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:16.080604076 CET	49744	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:16.080693007 CET	49744	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:16.080763102 CET	443	49744	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:16.080845118 CET	49744	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:16.083039045 CET	443	49742	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:16.083116055 CET	49742	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:16.126211882 CET	443	49745	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:16.126283884 CET	49745	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:16.134821892 CET	80	49752	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:16.140372992 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:16.140376091 CET	49752	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.186722040 CET	443	49746	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:16.186918974 CET	49746	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:16.381309986 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:16.426279068 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.601535082 CET	49752	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.603924036 CET	49742	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:16.603948116 CET	443	49742	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:16.603960037 CET	49742	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:16.604559898 CET	443	49742	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:16.605345964 CET	49742	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:16.606316090 CET	49745	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:16.606316090 CET	49745	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:16.606336117 CET	443	49745	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:16.606570959 CET	443	49745	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:16.606638908 CET	49745	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:16.606894970 CET	49746	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:16.606909990 CET	443	49746	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:16.606959105 CET	49746	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:16.607881069 CET	443	49746	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:16.607945919 CET	49746	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:16.721295118 CET	80	49752	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:16.762959003 CET	49752	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.827836037 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.829909086 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.929724932 CET	80	49752	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:16.947560072 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:16.949606895 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:16.949700117 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.949875116 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:16.969059944 CET	49755	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:16.969150066 CET	443	49755	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:16.969253063 CET	49755	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:16.970572948 CET	49755	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:16.970609903 CET	443	49755	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:17.070525885 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:17.171169043 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:17.182562113 CET	80	49752	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:17.182647943 CET	49752	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:17.214828014 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:18.103053093 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:18.148691893 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:18.345158100 CET	443	49755	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:18.345240116 CET	49755	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:18.349395037 CET	49755	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:18.349412918 CET	443	49755	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:18.349505901 CET	49755	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:18.349643946 CET	443	49755	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:18.350398064 CET	49755	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:19.939318895 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:19.940242052 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:20.059307098 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:20.060246944 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:20.255414009 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:20.263608932 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:20.301721096 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:20.323884010 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:24.070827007 CET	49771	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:24.070946932 CET	443	49771	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:24.072755098 CET	49771	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:24.074517965 CET	49771	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:24.074548960 CET	443	49771	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:25.336498976 CET	443	49771	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:25.336627960 CET	49771	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.363698006 CET	49771	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.363718033 CET	443	49771	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:25.363804102 CET	49771	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.363980055 CET	443	49771	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:25.372579098 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:25.376549006 CET	49771	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.484118938 CET	49777	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.484225988 CET	443	49777	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:25.484277010 CET	49778	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.484338999 CET	443	49778	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:25.487833023 CET	49779	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:25.487863064 CET	443	49779	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:25.489602089 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:25.491622925 CET	49777	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.491625071 CET	49779	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:25.491626024 CET	49778	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.491774082 CET	49777	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.491794109 CET	443	49777	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:25.491893053 CET	49778	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:25.491923094 CET	443	49778	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:25.492636919 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:25.493417978 CET	49779	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:25.493434906 CET	443	49779	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:25.517575979 CET	49780	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:25.517599106 CET	443	49780	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:25.518049002 CET	49780	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:25.609360933 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:25.698132038 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:25.762151957 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:25.804784060 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:25.862374067 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:25.992253065 CET	49780	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:25.992286921 CET	443	49780	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:26.233845949 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:26.354407072 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:26.567281008 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:26.611350060 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:26.877434969 CET	443	49779	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:26.880255938 CET	49779	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:26.973778009 CET	443	49778	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:26.973793030 CET	443	49778	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:26.973855972 CET	49778	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:26.975208998 CET	443	49777	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:26.975222111 CET	443	49777	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:26.975261927 CET	49777	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.271199942 CET	443	49780	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:27.271285057 CET	49780	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:27.343624115 CET	49777	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.343662977 CET	443	49777	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:27.343996048 CET	443	49777	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:27.347275019 CET	49778	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.347306013 CET	443	49778	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:27.348357916 CET	443	49778	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:27.354711056 CET	49779	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:27.354749918 CET	443	49779	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:27.354794979 CET	49779	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:27.355014086 CET	443	49779	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:27.355544090 CET	49777	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.355562925 CET	49778	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.355652094 CET	49778	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.355701923 CET	49777	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.355772018 CET	443	49777	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:27.355782986 CET	443	49778	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:27.357841015 CET	49780	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:27.357933044 CET	443	49780	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:27.357969046 CET	49780	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:27.358207941 CET	443	49780	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:27.359508038 CET	49778	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.359518051 CET	49779	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:27.359524965 CET	49777	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.359539986 CET	49778	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.360073090 CET	49780	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:27.966284037 CET	49786	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.966324091 CET	443	49786	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:27.966801882 CET	49786	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.966917038 CET	49786	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:27.966931105 CET	443	49786	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:27.997368097 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:28.000857115 CET	49787	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:28.000896931 CET	443	49787	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:28.001630068 CET	49787	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:28.003128052 CET	49787	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:28.003143072 CET	443	49787	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:28.021881104 CET	49788	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:28.021908045 CET	443	49788	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:28.023942947 CET	49788	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:28.024080992 CET	49788	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:28.024095058 CET	443	49788	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:28.117044926 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:28.312578917 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:28.369894981 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:28.714482069 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:28.834352970 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:29.040213108 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:29.087574959 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:29.238467932 CET	443	49788	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:29.238538980 CET	49788	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:29.249224901 CET	443	49786	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:29.249315023 CET	49786	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:29.262352943 CET	443	49787	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:29.262465000 CET	49787	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.433744907 CET	49786	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.433779001 CET	443	49786	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:30.434797049 CET	443	49786	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:30.437084913 CET	49788	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.437151909 CET	443	49788	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:30.437571049 CET	443	49788	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:30.441298008 CET	49786	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.441298008 CET	49786	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.441519976 CET	49788	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.441589117 CET	49788	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.441771030 CET	443	49786	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:30.441792011 CET	443	49788	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:30.441963911 CET	49787	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.441981077 CET	443	49787	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:30.442121983 CET	49787	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.442224979 CET	443	49787	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:30.444082022 CET	49788	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.444089890 CET	49786	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:30.444118977 CET	49787	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:31.553468943 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:31.558342934 CET	49798	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:31.558398962 CET	443	49798	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:31.558772087 CET	49798	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:31.560661077 CET	49798	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:31.560679913 CET	443	49798	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:31.672992945 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:31.868215084 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:31.871823072 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:31.913712978 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:31.991272926 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:32.195650101 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:32.245835066 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:32.820796013 CET	443	49798	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:32.820871115 CET	49798	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:32.825611115 CET	49798	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:32.825620890 CET	443	49798	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:32.825714111 CET	49798	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:32.825819016 CET	443	49798	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:32.825871944 CET	49798	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:32.855246067 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:32.858930111 CET	49804	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:32.858980894 CET	443	49804	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:32.859214067 CET	49804	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:32.860615015 CET	49804	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:32.860635042 CET	443	49804	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:32.976401091 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:33.169948101 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:33.173937082 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:33.217466116 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:33.293797970 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:33.497692108 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:33.549612999 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:34.075901985 CET	443	49804	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:34.076023102 CET	49804	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:34.081125975 CET	49804	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:34.081135988 CET	443	49804	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:34.081264973 CET	49804	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:34.081406116 CET	443	49804	34.120.208.123	192.168.2.6
Nov 20, 2024 21:05:34.084723949 CET	49804	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:05:34.086606979 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:34.206217051 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:34.401897907 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:34.405798912 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:34.444736958 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:34.527139902 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:34.729885101 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:34.791452885 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:37.992279053 CET	49824	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:37.992366076 CET	443	49824	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:37.993577003 CET	49824	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:37.995162010 CET	49824	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:37.995188951 CET	443	49824	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:39.213368893 CET	443	49824	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:39.213449955 CET	49824	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:39.222429037 CET	49824	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:39.222441912 CET	443	49824	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:39.222546101 CET	49824	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:39.222723961 CET	443	49824	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:39.224368095 CET	49824	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:39.226524115 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:39.346553087 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:39.542205095 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:39.558235884 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:39.577203989 CET	49833	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:39.577267885 CET	443	49833	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:39.578349113 CET	49833	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:39.578593016 CET	49833	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:39.578610897 CET	443	49833	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:39.584851027 CET	49834	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:39.584898949 CET	443	49834	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:39.585094929 CET	49834	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:39.585298061 CET	49834	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:39.585314035 CET	443	49834	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:39.596801043 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:39.607047081 CET	49835	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:39.607081890 CET	443	49835	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:39.612523079 CET	49835	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:39.614171982 CET	49835	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:39.614191055 CET	443	49835	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:39.681726933 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:39.732435942 CET	49836	443	192.168.2.6	151.101.193.91
Nov 20, 2024 21:05:39.732506990 CET	443	49836	151.101.193.91	192.168.2.6
Nov 20, 2024 21:05:39.732614994 CET	49836	443	192.168.2.6	151.101.193.91
Nov 20, 2024 21:05:39.732770920 CET	49836	443	192.168.2.6	151.101.193.91
Nov 20, 2024 21:05:39.732806921 CET	443	49836	151.101.193.91	192.168.2.6
Nov 20, 2024 21:05:39.873111010 CET	49837	443	192.168.2.6	35.201.103.21
Nov 20, 2024 21:05:39.873186111 CET	443	49837	35.201.103.21	192.168.2.6
Nov 20, 2024 21:05:39.873322010 CET	49837	443	192.168.2.6	35.201.103.21
Nov 20, 2024 21:05:39.874797106 CET	49837	443	192.168.2.6	35.201.103.21
Nov 20, 2024 21:05:39.874818087 CET	443	49837	35.201.103.21	192.168.2.6
Nov 20, 2024 21:05:40.091269016 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:40.145175934 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:40.851018906 CET	443	49833	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:40.851270914 CET	49833	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:40.852530956 CET	443	49834	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:40.854667902 CET	49833	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:40.854684114 CET	443	49833	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:40.854893923 CET	49834	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:40.854996920 CET	443	49833	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:40.857811928 CET	49834	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:40.857835054 CET	443	49834	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:40.858124971 CET	443	49834	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:40.861017942 CET	49833	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:40.861124992 CET	49833	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:40.861176014 CET	443	49833	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:40.861361027 CET	49834	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:40.861407042 CET	49834	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:40.861551046 CET	49833	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:40.861557007 CET	443	49834	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:40.861613035 CET	49834	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:40.865793943 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:40.985318899 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:41.032278061 CET	443	49835	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:41.032390118 CET	49835	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:41.036645889 CET	49835	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:41.036675930 CET	443	49835	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:41.036760092 CET	49835	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:41.036986113 CET	443	49835	35.190.72.216	192.168.2.6
Nov 20, 2024 21:05:41.037225962 CET	49835	443	192.168.2.6	35.190.72.216
Nov 20, 2024 21:05:41.180278063 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:41.183949947 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:41.185353994 CET	443	49836	151.101.193.91	192.168.2.6
Nov 20, 2024 21:05:41.185971022 CET	49836	443	192.168.2.6	151.101.193.91
Nov 20, 2024 21:05:41.189528942 CET	49836	443	192.168.2.6	151.101.193.91
Nov 20, 2024 21:05:41.189551115 CET	443	49836	151.101.193.91	192.168.2.6
Nov 20, 2024 21:05:41.189829111 CET	443	49836	151.101.193.91	192.168.2.6
Nov 20, 2024 21:05:41.192347050 CET	49836	443	192.168.2.6	151.101.193.91
Nov 20, 2024 21:05:41.192430973 CET	49836	443	192.168.2.6	151.101.193.91
Nov 20, 2024 21:05:41.192504883 CET	443	49836	151.101.193.91	192.168.2.6
Nov 20, 2024 21:05:41.199148893 CET	49836	443	192.168.2.6	151.101.193.91
Nov 20, 2024 21:05:41.201152086 CET	49841	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:41.201220036 CET	443	49841	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:41.201423883 CET	49841	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:41.201580048 CET	49841	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:41.201600075 CET	443	49841	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:41.204011917 CET	49842	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:41.204068899 CET	443	49842	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:41.204236984 CET	49842	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:41.204369068 CET	49842	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:41.204385996 CET	443	49842	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:41.207007885 CET	49843	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:41.207036972 CET	443	49843	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:41.207568884 CET	49843	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:41.207683086 CET	49843	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:41.207689047 CET	443	49843	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:41.209177017 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:41.280922890 CET	443	49837	35.201.103.21	192.168.2.6
Nov 20, 2024 21:05:41.281090975 CET	49837	443	192.168.2.6	35.201.103.21
Nov 20, 2024 21:05:41.285315990 CET	49837	443	192.168.2.6	35.201.103.21
Nov 20, 2024 21:05:41.285331964 CET	443	49837	35.201.103.21	192.168.2.6
Nov 20, 2024 21:05:41.285419941 CET	49837	443	192.168.2.6	35.201.103.21
Nov 20, 2024 21:05:41.285490990 CET	443	49837	35.201.103.21	192.168.2.6
Nov 20, 2024 21:05:41.286140919 CET	49837	443	192.168.2.6	35.201.103.21
Nov 20, 2024 21:05:41.301631927 CET	49845	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:41.301671028 CET	443	49845	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:41.301856041 CET	49845	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:41.302423954 CET	49845	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:41.302434921 CET	443	49845	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:41.304609060 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:41.330955029 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:41.508994102 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:41.527535915 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:41.530318022 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:41.571414948 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:41.652414083 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:41.856627941 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:41.903568983 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:42.417074919 CET	443	49842	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.417171001 CET	49842	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.419699907 CET	443	49843	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.419842958 CET	49843	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.420068979 CET	49842	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.420099974 CET	443	49842	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.420413017 CET	443	49842	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.422676086 CET	49843	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.422703028 CET	443	49843	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.422943115 CET	443	49843	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.426153898 CET	49842	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.426263094 CET	49842	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.426331997 CET	49843	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.426351070 CET	443	49842	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.426402092 CET	49843	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.426464081 CET	443	49843	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.426547050 CET	49842	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.426657915 CET	49843	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.430619955 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:42.465536118 CET	443	49841	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.465620041 CET	49841	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.468303919 CET	49841	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.468311071 CET	443	49841	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.468599081 CET	443	49841	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.470285892 CET	49841	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.470383883 CET	49841	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.470439911 CET	443	49841	35.244.181.201	192.168.2.6
Nov 20, 2024 21:05:42.470515013 CET	49841	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.470535994 CET	49841	443	192.168.2.6	35.244.181.201
Nov 20, 2024 21:05:42.554467916 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:42.606756926 CET	443	49845	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:42.606837034 CET	49845	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:42.610465050 CET	49845	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:42.610485077 CET	443	49845	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:42.610943079 CET	443	49845	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:42.613854885 CET	49845	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:42.613907099 CET	49845	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:42.614195108 CET	443	49845	34.149.100.209	192.168.2.6
Nov 20, 2024 21:05:42.615338087 CET	49845	443	192.168.2.6	34.149.100.209
Nov 20, 2024 21:05:42.749871016 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:42.753381014 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:42.790591955 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:42.872838020 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:43.078625917 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:43.122675896 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:52.757285118 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:52.876760006 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:53.089374065 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:53.208973885 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:54.266622066 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:54.386257887 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:54.585333109 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:54.591850996 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:54.640664101 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:54.711452961 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:54.916223049 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:05:54.979737997 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:05:59.438802958 CET	49887	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:59.438927889 CET	443	49887	34.107.243.93	192.168.2.6
Nov 20, 2024 21:05:59.439399004 CET	49887	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:59.440840006 CET	49887	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:05:59.440877914 CET	443	49887	34.107.243.93	192.168.2.6
Nov 20, 2024 21:06:00.701196909 CET	443	49887	34.107.243.93	192.168.2.6
Nov 20, 2024 21:06:00.701318979 CET	49887	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:00.707432032 CET	49887	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:00.707467079 CET	443	49887	34.107.243.93	192.168.2.6
Nov 20, 2024 21:06:00.707618952 CET	49887	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:00.707701921 CET	443	49887	34.107.243.93	192.168.2.6
Nov 20, 2024 21:06:00.707786083 CET	49887	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:00.712083101 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:00.831933975 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:01.027924061 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:01.031363010 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:01.071167946 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:01.151648998 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:01.356080055 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:01.409892082 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:09.924123049 CET	49912	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.924174070 CET	443	49912	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.924302101 CET	49913	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.924341917 CET	443	49913	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.924432993 CET	49914	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.924452066 CET	443	49914	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.924572945 CET	49915	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.924582005 CET	443	49915	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.924689054 CET	49916	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.924725056 CET	443	49916	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.924918890 CET	49917	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.924962997 CET	443	49917	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.925497055 CET	49913	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.925496101 CET	49912	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.925664902 CET	49915	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.925667048 CET	49914	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.925667048 CET	49912	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.925698042 CET	443	49912	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.925796032 CET	49915	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.925807953 CET	443	49915	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.925863981 CET	49914	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.925882101 CET	443	49914	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.925930977 CET	49913	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.925939083 CET	443	49913	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.926019907 CET	49916	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.926143885 CET	49917	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.926172972 CET	49916	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.926182032 CET	443	49916	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:09.926265001 CET	49917	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:09.926281929 CET	443	49917	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.030571938 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:11.150573969 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:11.173374891 CET	443	49913	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.173481941 CET	49913	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.177130938 CET	49913	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.177154064 CET	443	49913	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.178191900 CET	443	49913	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.180190086 CET	49913	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.180308104 CET	49913	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.180407047 CET	443	49913	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.180835009 CET	49922	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.180881977 CET	443	49922	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.180919886 CET	49913	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.180984020 CET	49922	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.181122065 CET	49922	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.181139946 CET	443	49922	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.184788942 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:11.208383083 CET	443	49914	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.208496094 CET	49914	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.209757090 CET	443	49912	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.211627007 CET	49914	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.211641073 CET	443	49914	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.211813927 CET	49912	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.211910963 CET	443	49914	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.214241028 CET	49912	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.214255095 CET	443	49912	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.214582920 CET	443	49912	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.217576981 CET	49914	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.217679977 CET	49914	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.217761993 CET	443	49914	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.218111038 CET	49923	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.218166113 CET	443	49923	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.218290091 CET	49912	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.218360901 CET	49912	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.218483925 CET	443	49912	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.218606949 CET	49914	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.218635082 CET	49912	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.218652010 CET	49923	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.218826056 CET	49923	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.218844891 CET	443	49923	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.221863031 CET	443	49915	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.223396063 CET	443	49917	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.224886894 CET	49915	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.224925995 CET	49917	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.227689981 CET	49915	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.227705002 CET	443	49915	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.228575945 CET	443	49915	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.230195045 CET	49917	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.230221987 CET	443	49917	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.230571032 CET	443	49917	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.234340906 CET	49915	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.234440088 CET	49915	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.234560013 CET	49917	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.234724998 CET	443	49917	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.234765053 CET	49917	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.234791040 CET	443	49917	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.234992981 CET	49917	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.235002995 CET	443	49915	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.235094070 CET	49915	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.272156000 CET	443	49916	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.272232056 CET	49916	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.275723934 CET	49916	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.275729895 CET	443	49916	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.276083946 CET	443	49916	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.278909922 CET	49916	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.279001951 CET	49916	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.279098034 CET	443	49916	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:11.281171083 CET	49916	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:11.304337025 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:11.362728119 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:11.482376099 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:11.500462055 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:11.504544973 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:11.547673941 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:11.625731945 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:11.828557014 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:11.879836082 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:12.450551033 CET	443	49922	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:12.450803041 CET	49922	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.453608990 CET	49922	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.453617096 CET	443	49922	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:12.454019070 CET	443	49922	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:12.455990076 CET	49922	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.456098080 CET	49922	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.456208944 CET	443	49922	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:12.457060099 CET	49922	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.458921909 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:12.484496117 CET	443	49923	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:12.484586000 CET	49923	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.487592936 CET	49923	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.487600088 CET	443	49923	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:12.488523006 CET	443	49923	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:12.490298986 CET	49923	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.490415096 CET	49923	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.490483999 CET	443	49923	34.120.208.123	192.168.2.6
Nov 20, 2024 21:06:12.490564108 CET	49923	443	192.168.2.6	34.120.208.123
Nov 20, 2024 21:06:12.581235886 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:12.777214050 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:12.780183077 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:12.820240021 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:12.899658918 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:13.104496002 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:13.152348042 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:22.784323931 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:22.904011965 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:23.116425991 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:23.236521959 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:32.904375076 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:33.024662018 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:33.243030071 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:33.362951994 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:41.497113943 CET	49989	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:41.497168064 CET	443	49989	34.107.243.93	192.168.2.6
Nov 20, 2024 21:06:41.497549057 CET	49989	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:41.499213934 CET	49989	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:41.499243975 CET	443	49989	34.107.243.93	192.168.2.6
Nov 20, 2024 21:06:42.846815109 CET	443	49989	34.107.243.93	192.168.2.6
Nov 20, 2024 21:06:42.846920013 CET	49989	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:42.852827072 CET	49989	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:42.852858067 CET	443	49989	34.107.243.93	192.168.2.6
Nov 20, 2024 21:06:42.852948904 CET	49989	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:42.853050947 CET	443	49989	34.107.243.93	192.168.2.6
Nov 20, 2024 21:06:42.854284048 CET	49989	443	192.168.2.6	34.107.243.93
Nov 20, 2024 21:06:42.856348038 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:42.975970984 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:43.171022892 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:43.175271034 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:43.218525887 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:43.299894094 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:43.505592108 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:43.557199955 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:53.185051918 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:53.304847002 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:06:53.517174959 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:06:53.636981964 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:07:03.314865112 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:07:03.434448957 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:07:03.647095919 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:07:03.767187119 CET	80	49754	34.107.221.82	192.168.2.6
Nov 20, 2024 21:07:13.434986115 CET	49743	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:07:13.556107998 CET	80	49743	34.107.221.82	192.168.2.6
Nov 20, 2024 21:07:13.767127037 CET	49754	80	192.168.2.6	34.107.221.82
Nov 20, 2024 21:07:13.887504101 CET	80	49754	34.107.221.82	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 21:05:10.669516087 CET	63264	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:10.964669943 CET	53	63264	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:10.966533899 CET	54394	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:11.215198040 CET	53	54394	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:11.326585054 CET	56512	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:11.326883078 CET	54972	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:11.464075089 CET	53	54972	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:11.465329885 CET	64276	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:11.466450930 CET	55833	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:11.604654074 CET	53	64276	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:11.605967999 CET	53	55833	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:11.651671886 CET	51149	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:11.651998997 CET	55927	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:11.789019108 CET	53	51149	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:11.790291071 CET	53	55927	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:12.191767931 CET	57685	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:12.331146955 CET	53	57685	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:12.724467993 CET	62124	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:12.731162071 CET	54395	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:12.899020910 CET	53	54395	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:12.900145054 CET	61837	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:12.900218010 CET	53	62124	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:12.900779009 CET	64213	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:12.903832912 CET	54634	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:12.986995935 CET	53980	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:13.180903912 CET	53	64213	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.181397915 CET	53	53980	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.181969881 CET	53	54634	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.182625055 CET	55918	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:13.183356047 CET	53039	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:13.183532953 CET	53	61837	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.184125900 CET	63568	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:13.215336084 CET	65207	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:13.236561060 CET	59017	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:13.237992048 CET	60590	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:13.319772005 CET	53	55918	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.320566893 CET	59582	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:13.321629047 CET	53	53039	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.321882010 CET	53	63568	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.353180885 CET	53	65207	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.374146938 CET	53	59017	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.460541964 CET	53	59582	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:13.735481977 CET	62741	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:14.109915018 CET	60567	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:14.250078917 CET	53	60567	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:14.257586002 CET	59664	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:14.259892941 CET	53	65387	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:14.394865036 CET	53	59664	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:14.400847912 CET	64167	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:14.542388916 CET	53	64167	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:14.724158049 CET	54938	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:14.826421022 CET	61987	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:14.862669945 CET	53	54938	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:14.863789082 CET	49694	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:14.964585066 CET	53	61987	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:14.993422985 CET	59646	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:15.001396894 CET	53	49694	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:15.025660992 CET	63318	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:15.131164074 CET	53	59646	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:15.163096905 CET	53	63318	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:19.642724037 CET	63279	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:19.657088995 CET	56017	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:19.657362938 CET	50795	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:19.780172110 CET	53	63279	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:19.794526100 CET	53	50795	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:19.794593096 CET	53	56017	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:19.894526005 CET	49163	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:19.894759893 CET	60385	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:19.894994020 CET	51803	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.039870024 CET	53	49163	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.040385008 CET	53	60385	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.041189909 CET	53	51803	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.041477919 CET	58609	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.041959047 CET	63284	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.042237997 CET	64604	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.179012060 CET	53	58609	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.179894924 CET	53	64604	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.182506084 CET	53	63284	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.183628082 CET	52587	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.189572096 CET	63969	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.189572096 CET	64326	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.320832014 CET	53	52587	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.329235077 CET	53	63969	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.330574036 CET	53837	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.331089973 CET	53	64326	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.331757069 CET	49505	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.343836069 CET	65142	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.467684984 CET	53	53837	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.468444109 CET	53002	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.470838070 CET	53	49505	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.471484900 CET	58408	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.480757952 CET	53	65142	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.487181902 CET	63874	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:20.608114004 CET	53	53002	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.610033989 CET	53	58408	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:20.624408960 CET	53	63874	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:24.086297035 CET	58859	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:24.223881960 CET	53	58859	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:25.374135017 CET	49201	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:25.515821934 CET	53	49201	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:25.516927004 CET	49870	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:25.661513090 CET	53	49870	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:31.558701038 CET	51222	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:31.698281050 CET	53	51222	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:37.991952896 CET	63244	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:38.131705999 CET	53	63244	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:39.577564001 CET	49274	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:39.581536055 CET	61912	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:39.620126963 CET	61448	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:39.720385075 CET	53	49274	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:39.731061935 CET	53	61912	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:39.732537031 CET	57287	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:39.871824026 CET	53	61448	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:39.873287916 CET	65276	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:40.091232061 CET	53	57287	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:40.091491938 CET	53	65276	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:40.092485905 CET	65499	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:40.093389988 CET	62416	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:40.230684042 CET	53	62416	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:40.232619047 CET	53	65499	1.1.1.1	192.168.2.6
Nov 20, 2024 21:05:54.267013073 CET	49296	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:59.439250946 CET	55627	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:05:59.581501961 CET	53	55627	1.1.1.1	192.168.2.6
Nov 20, 2024 21:06:09.917701006 CET	59637	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:06:10.060853004 CET	53	59637	1.1.1.1	192.168.2.6
Nov 20, 2024 21:06:41.354024887 CET	63085	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:06:41.495877981 CET	53	63085	1.1.1.1	192.168.2.6
Nov 20, 2024 21:06:41.497543097 CET	56288	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:06:41.714970112 CET	56288	53	192.168.2.6	1.1.1.1
Nov 20, 2024 21:06:41.766123056 CET	53	56288	1.1.1.1	192.168.2.6
Nov 20, 2024 21:06:41.884135962 CET	53	56288	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 21:05:10.669516087 CET	192.168.2.6	1.1.1.1	0x21b5	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:10.966533899 CET	192.168.2.6	1.1.1.1	0x8d76	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 21:05:11.326585054 CET	192.168.2.6	1.1.1.1	0xd4f4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:11.326883078 CET	192.168.2.6	1.1.1.1	0xd39f	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:11.465329885 CET	192.168.2.6	1.1.1.1	0x83c1	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:11.466450930 CET	192.168.2.6	1.1.1.1	0x1915	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:11.651671886 CET	192.168.2.6	1.1.1.1	0x8842	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:11.651998997 CET	192.168.2.6	1.1.1.1	0xf828	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 21:05:12.191767931 CET	192.168.2.6	1.1.1.1	0xfa38	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:12.724467993 CET	192.168.2.6	1.1.1.1	0x7c73	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:12.731162071 CET	192.168.2.6	1.1.1.1	0xc828	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:12.900145054 CET	192.168.2.6	1.1.1.1	0xe05c	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:12.900779009 CET	192.168.2.6	1.1.1.1	0x6b0e	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:12.903832912 CET	192.168.2.6	1.1.1.1	0x5a54	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:12.986995935 CET	192.168.2.6	1.1.1.1	0x94f8	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.182625055 CET	192.168.2.6	1.1.1.1	0x9d92	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.183356047 CET	192.168.2.6	1.1.1.1	0xb7d1	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 21:05:13.184125900 CET	192.168.2.6	1.1.1.1	0xa7b2	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 21:05:13.215336084 CET	192.168.2.6	1.1.1.1	0xb644	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.236561060 CET	192.168.2.6	1.1.1.1	0x75bb	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.237992048 CET	192.168.2.6	1.1.1.1	0xf631	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.320566893 CET	192.168.2.6	1.1.1.1	0xfd86	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 21:05:13.735481977 CET	192.168.2.6	1.1.1.1	0x87f0	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.109915018 CET	192.168.2.6	1.1.1.1	0xdd69	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.257586002 CET	192.168.2.6	1.1.1.1	0xe554	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.400847912 CET	192.168.2.6	1.1.1.1	0xd612	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:14.724158049 CET	192.168.2.6	1.1.1.1	0x170	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.826421022 CET	192.168.2.6	1.1.1.1	0x9cf4	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.863789082 CET	192.168.2.6	1.1.1.1	0x8e00	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.993422985 CET	192.168.2.6	1.1.1.1	0x9b7b	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:15.025660992 CET	192.168.2.6	1.1.1.1	0x584	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 21:05:19.642724037 CET	192.168.2.6	1.1.1.1	0x9f70	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.657088995 CET	192.168.2.6	1.1.1.1	0x8387	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.657362938 CET	192.168.2.6	1.1.1.1	0xcd64	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.894526005 CET	192.168.2.6	1.1.1.1	0x5a8a	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.894759893 CET	192.168.2.6	1.1.1.1	0x646f	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.894994020 CET	192.168.2.6	1.1.1.1	0x902f	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.041477919 CET	192.168.2.6	1.1.1.1	0x532a	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:20.041959047 CET	192.168.2.6	1.1.1.1	0x1c98	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:20.042237997 CET	192.168.2.6	1.1.1.1	0x6ddf	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 21:05:20.183628082 CET	192.168.2.6	1.1.1.1	0x851e	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.189572096 CET	192.168.2.6	1.1.1.1	0x33f2	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.189572096 CET	192.168.2.6	1.1.1.1	0x58bd	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.330574036 CET	192.168.2.6	1.1.1.1	0x8cf5	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.331757069 CET	192.168.2.6	1.1.1.1	0xed50	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.343836069 CET	192.168.2.6	1.1.1.1	0x7078	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.468444109 CET	192.168.2.6	1.1.1.1	0x4f9e	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:20.471484900 CET	192.168.2.6	1.1.1.1	0x5964	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 20, 2024 21:05:20.487181902 CET	192.168.2.6	1.1.1.1	0x8aa5	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 20, 2024 21:05:24.086297035 CET	192.168.2.6	1.1.1.1	0x5530	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:25.374135017 CET	192.168.2.6	1.1.1.1	0xe3ea	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:25.516927004 CET	192.168.2.6	1.1.1.1	0xd84a	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:31.558701038 CET	192.168.2.6	1.1.1.1	0x1bb0	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:37.991952896 CET	192.168.2.6	1.1.1.1	0x65a5	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:39.577564001 CET	192.168.2.6	1.1.1.1	0xd584	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 20, 2024 21:05:39.581536055 CET	192.168.2.6	1.1.1.1	0x6703	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.620126963 CET	192.168.2.6	1.1.1.1	0xbe78	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.732537031 CET	192.168.2.6	1.1.1.1	0x37d3	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.873287916 CET	192.168.2.6	1.1.1.1	0x8d9a	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.092485905 CET	192.168.2.6	1.1.1.1	0x1514	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 20, 2024 21:05:40.093389988 CET	192.168.2.6	1.1.1.1	0x20f2	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:05:54.267013073 CET	192.168.2.6	1.1.1.1	0xcb36	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:59.439250946 CET	192.168.2.6	1.1.1.1	0xb457	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:06:09.917701006 CET	192.168.2.6	1.1.1.1	0xa225	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:06:41.354024887 CET	192.168.2.6	1.1.1.1	0xa39	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:06:41.497543097 CET	192.168.2.6	1.1.1.1	0xee25	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 20, 2024 21:06:41.714970112 CET	192.168.2.6	1.1.1.1	0xee25	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 21:05:01.022069931 CET	1.1.1.1	192.168.2.6	0xb49c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:01.022069931 CET	1.1.1.1	192.168.2.6	0xb49c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:10.663438082 CET	1.1.1.1	192.168.2.6	0xfc12	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:10.964669943 CET	1.1.1.1	192.168.2.6	0x21b5	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:11.464075089 CET	1.1.1.1	192.168.2.6	0xd39f	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:11.465116024 CET	1.1.1.1	192.168.2.6	0xd4f4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:11.465116024 CET	1.1.1.1	192.168.2.6	0xd4f4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:11.604654074 CET	1.1.1.1	192.168.2.6	0x83c1	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:11.605967999 CET	1.1.1.1	192.168.2.6	0x1915	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:11.789019108 CET	1.1.1.1	192.168.2.6	0x8842	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 20, 2024 21:05:11.790291071 CET	1.1.1.1	192.168.2.6	0xf828	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 20, 2024 21:05:12.331146955 CET	1.1.1.1	192.168.2.6	0xfa38	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:12.899020910 CET	1.1.1.1	192.168.2.6	0xc828	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:12.899020910 CET	1.1.1.1	192.168.2.6	0xc828	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:12.900218010 CET	1.1.1.1	192.168.2.6	0x7c73	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:12.902908087 CET	1.1.1.1	192.168.2.6	0xd08f	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:12.902908087 CET	1.1.1.1	192.168.2.6	0xd08f	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.181397915 CET	1.1.1.1	192.168.2.6	0x94f8	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:13.181397915 CET	1.1.1.1	192.168.2.6	0x94f8	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:13.181397915 CET	1.1.1.1	192.168.2.6	0x94f8	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.181969881 CET	1.1.1.1	192.168.2.6	0x5a54	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.183532953 CET	1.1.1.1	192.168.2.6	0xe05c	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.319772005 CET	1.1.1.1	192.168.2.6	0x9d92	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.353180885 CET	1.1.1.1	192.168.2.6	0xb644	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.374146938 CET	1.1.1.1	192.168.2.6	0x75bb	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.374146938 CET	1.1.1.1	192.168.2.6	0x75bb	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.375852108 CET	1.1.1.1	192.168.2.6	0xf631	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:13.375852108 CET	1.1.1.1	192.168.2.6	0xf631	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:13.460541964 CET	1.1.1.1	192.168.2.6	0xfd86	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 20, 2024 21:05:13.877732038 CET	1.1.1.1	192.168.2.6	0x87f0	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:14.250078917 CET	1.1.1.1	192.168.2.6	0xdd69	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.394865036 CET	1.1.1.1	192.168.2.6	0xe554	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.796169043 CET	1.1.1.1	192.168.2.6	0xf005	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:14.796169043 CET	1.1.1.1	192.168.2.6	0xf005	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.824903965 CET	1.1.1.1	192.168.2.6	0xd9c8	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.862669945 CET	1.1.1.1	192.168.2.6	0x170	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:14.862669945 CET	1.1.1.1	192.168.2.6	0x170	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:14.964585066 CET	1.1.1.1	192.168.2.6	0x9cf4	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:15.001396894 CET	1.1.1.1	192.168.2.6	0x8e00	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:16.968122959 CET	1.1.1.1	192.168.2.6	0xc8c0	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.780172110 CET	1.1.1.1	192.168.2.6	0x9f70	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:19.780172110 CET	1.1.1.1	192.168.2.6	0x9f70	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:19.780172110 CET	1.1.1.1	192.168.2.6	0x9f70	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794526100 CET	1.1.1.1	192.168.2.6	0xcd64	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794526100 CET	1.1.1.1	192.168.2.6	0xcd64	No error (0)	star-mini.c10r.facebook.com		157.240.195.35	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:19.794593096 CET	1.1.1.1	192.168.2.6	0x8387	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.039870024 CET	1.1.1.1	192.168.2.6	0x5a8a	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.040385008 CET	1.1.1.1	192.168.2.6	0x646f	No error (0)	star-mini.c10r.facebook.com		157.240.195.35	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.041189909 CET	1.1.1.1	192.168.2.6	0x902f	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.179012060 CET	1.1.1.1	192.168.2.6	0x532a	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 20, 2024 21:05:20.179012060 CET	1.1.1.1	192.168.2.6	0x532a	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 20, 2024 21:05:20.179012060 CET	1.1.1.1	192.168.2.6	0x532a	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 20, 2024 21:05:20.179012060 CET	1.1.1.1	192.168.2.6	0x532a	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 20, 2024 21:05:20.182506084 CET	1.1.1.1	192.168.2.6	0x1c98	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 20, 2024 21:05:20.320832014 CET	1.1.1.1	192.168.2.6	0x851e	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:20.320832014 CET	1.1.1.1	192.168.2.6	0x851e	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.329235077 CET	1.1.1.1	192.168.2.6	0x33f2	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.331089973 CET	1.1.1.1	192.168.2.6	0x58bd	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:20.331089973 CET	1.1.1.1	192.168.2.6	0x58bd	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.331089973 CET	1.1.1.1	192.168.2.6	0x58bd	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.331089973 CET	1.1.1.1	192.168.2.6	0x58bd	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.331089973 CET	1.1.1.1	192.168.2.6	0x58bd	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.467684984 CET	1.1.1.1	192.168.2.6	0x8cf5	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.470838070 CET	1.1.1.1	192.168.2.6	0xed50	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.470838070 CET	1.1.1.1	192.168.2.6	0xed50	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.470838070 CET	1.1.1.1	192.168.2.6	0xed50	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.470838070 CET	1.1.1.1	192.168.2.6	0xed50	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.480757952 CET	1.1.1.1	192.168.2.6	0x7078	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:20.624408960 CET	1.1.1.1	192.168.2.6	0x8aa5	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 20, 2024 21:05:25.515821934 CET	1.1.1.1	192.168.2.6	0xe3ea	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.731061935 CET	1.1.1.1	192.168.2.6	0x6703	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.731061935 CET	1.1.1.1	192.168.2.6	0x6703	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.731061935 CET	1.1.1.1	192.168.2.6	0x6703	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.731061935 CET	1.1.1.1	192.168.2.6	0x6703	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:39.871824026 CET	1.1.1.1	192.168.2.6	0xbe78	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:39.871824026 CET	1.1.1.1	192.168.2.6	0xbe78	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.091232061 CET	1.1.1.1	192.168.2.6	0x37d3	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.091232061 CET	1.1.1.1	192.168.2.6	0x37d3	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.091232061 CET	1.1.1.1	192.168.2.6	0x37d3	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.091232061 CET	1.1.1.1	192.168.2.6	0x37d3	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.091491938 CET	1.1.1.1	192.168.2.6	0x8d9a	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:05:40.232619047 CET	1.1.1.1	192.168.2.6	0x1514	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 20, 2024 21:05:40.232619047 CET	1.1.1.1	192.168.2.6	0x1514	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 20, 2024 21:05:40.232619047 CET	1.1.1.1	192.168.2.6	0x1514	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 20, 2024 21:05:40.232619047 CET	1.1.1.1	192.168.2.6	0x1514	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 20, 2024 21:05:43.269790888 CET	1.1.1.1	192.168.2.6	0x3ca8	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:43.269790888 CET	1.1.1.1	192.168.2.6	0x3ca8	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:54.665606976 CET	1.1.1.1	192.168.2.6	0xcb36	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 21:05:54.665606976 CET	1.1.1.1	192.168.2.6	0xcb36	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:06:09.899557114 CET	1.1.1.1	192.168.2.6	0x614	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 20, 2024 21:06:41.495877981 CET	1.1.1.1	192.168.2.6	0xa39	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49726	34.107.221.82	80	2864	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:05:11.992381096 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:13.161665916 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 08:56:12 GMT Age: 40140 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49737	34.107.221.82	80	2864	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:05:13.498385906 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:14.644820929 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42129 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49743	34.107.221.82	80	2864	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:05:14.843087912 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:15.977215052 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9078 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:16.019918919 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:16.381309986 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9079 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:16.827836037 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:17.171169043 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9080 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:19.940242052 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:20.255414009 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9083 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:25.489602089 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:25.804784060 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9088 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:27.997368097 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:28.312578917 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9091 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:31.553468943 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:31.868215084 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9094 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:32.855246067 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:33.169948101 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9096 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:34.086606979 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:34.401897907 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9097 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:39.226524115 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:39.542205095 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9102 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:40.865793943 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:41.180278063 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9104 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:41.209177017 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:41.527535915 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9104 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:42.430619955 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:42.749871016 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9105 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:05:52.757285118 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:05:54.266622066 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:05:54.585333109 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9117 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:06:00.712083101 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:06:01.027924061 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9123 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:06:11.030571938 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:06:11.184788942 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:06:11.500462055 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9134 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:06:12.458921909 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:06:12.777214050 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9135 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:06:22.784323931 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:06:32.904375076 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:06:42.856348038 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 20, 2024 21:06:43.171022892 CET	297	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 9166 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 20, 2024 21:06:53.185051918 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:07:03.314865112 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:07:13.434986115 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49752	34.107.221.82	80	2864	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:05:16.601535082 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49754	34.107.221.82	80	2864	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 21:05:16.949875116 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:18.103053093 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42132 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:19.939318895 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:20.263608932 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42135 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:25.372579098 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:25.698132038 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42140 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:26.233845949 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:26.567281008 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42141 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:28.714482069 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:29.040213108 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42143 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:31.871823072 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:32.195650101 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42147 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:33.173937082 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:33.497692108 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42148 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:34.405798912 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:34.729885101 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42149 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:39.558235884 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:40.091269016 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42154 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:41.183949947 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:41.508994102 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42156 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:41.530318022 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:41.856627941 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42156 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:42.753381014 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:43.078625917 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42157 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:05:53.089374065 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:05:54.591850996 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:05:54.916223049 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42169 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:06:01.031363010 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:06:01.356080055 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42176 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:06:11.362728119 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:06:11.504544973 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:06:11.828557014 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42186 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:06:12.780183077 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:06:13.104496002 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42187 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:06:23.116425991 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:06:33.243030071 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:06:43.175271034 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 20, 2024 21:06:43.505592108 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 42218 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 20, 2024 21:06:53.517174959 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:07:03.647095919 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 20, 2024 21:07:13.767127037 CET	6	OUT	Data Raw: 00 Data Ascii:

Target ID:	0
Start time:	15:05:03
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x220000
File size:	922'624 bytes
MD5 hash:	F8C0EBDFD99EEE53899E32D8E4AED988
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:05:03
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:05:03
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:05:06
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:05:06
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:05:06
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:05:06
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:05:06
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:05:06
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:05:07
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x190000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:05:07
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:05:07
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:05:07
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:05:07
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:05:08
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20230927232528 -prefsHandle 2232 -prefMapHandle 2228 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b5bf9b5-84ac-4044-9d68-cc7a2e284fb2} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 16333270f10 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	15:05:09
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4088 -parentBuildID 20230927232528 -prefsHandle 4080 -prefMapHandle 4076 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf227e4f-5dc3-43be-85a4-53f86739f9d1} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 163459df510 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	15:05:13
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4992 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4684 -prefMapHandle 4880 -prefsLen 33076 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a32dfac-dcd2-4e81-916d-59d797ae6bfc} 2864 "\\.\pipe\gecko-crash-server-pipe.2864" 163451c5f10 utility
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.7%
Total number of Nodes:	1557
Total number of Limit Nodes:	53

Executed Functions

Function 002242DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0022430D

Part of subcall function 00226B57: _wcslen.LIBCMT ref: 00226B6A

GetCurrentProcess.KERNEL32(?,002BCB64,00000000,?,?), ref: 00224422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00224429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00224454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00224466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00224474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0022447B
GetSystemInfo.KERNEL32(?,?,?), ref: 002244A0

Strings

kernel32.dll, xrefs: 0022444F
GetNativeSystemInfo, xrefs: 00224460
|O, xrefs: 002636F8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 2a913c0c099e4fb848a67cf5e4bc2e484dd7a7a5f5ec5be4cdf0d9b3b67ea97a
Instruction ID: d31c41d54649be9761dff21128745527ad8bb3b634b7235c8a7193c20ec58308
Opcode Fuzzy Hash: 2a913c0c099e4fb848a67cf5e4bc2e484dd7a7a5f5ec5be4cdf0d9b3b67ea97a
Instruction Fuzzy Hash: 46A1E67693A2D4DFC712EBADBC4C1B57FE47B263E0B9844F8E045A3A61D26045B4CB21

Function 002242A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,002250AA,?,?,00000000,00000000), ref: 002242B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,002250AA,?,?,00000000,00000000), ref: 002242C9
LoadResource.KERNEL32(?,00000000,?,?,002250AA,?,?,00000000,00000000,?,?,?,?,?,?,00224F20), ref: 002635BE
SizeofResource.KERNEL32(?,00000000,?,?,002250AA,?,?,00000000,00000000,?,?,?,?,?,?,00224F20), ref: 002635D3
LockResource.KERNEL32(002250AA,?,?,002250AA,?,?,00000000,00000000,?,?,?,?,?,?,00224F20,?), ref: 002635E6

Strings

SCRIPT, xrefs: 002242BF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: f81ae06ba68473fd1af9f1965ff5fa995c88b616019befbe912e0eab827b523e
Instruction ID: b00ddb5f976116a2bd0466e0b0c3d1d157ab814709bdd11914814b7ef4dcb345
Opcode Fuzzy Hash: f81ae06ba68473fd1af9f1965ff5fa995c88b616019befbe912e0eab827b523e
Instruction Fuzzy Hash: 4F117C70210701FFEB219FA6EC48F677BB9EBC9B51F20826AB80296250DB71DC108630

Function 00262BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00222B6B

Part of subcall function 00223A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,002F1418,?,00222E7F,?,?,?,00000000), ref: 00223A78

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,002E2224), ref: 00262C10
ShellExecuteW.SHELL32(00000000,?,?,002E2224), ref: 00262C17

Strings

runas, xrefs: 00262C0B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 01449d5264d9fd874c8fc3943a3bd06482591bbc92089a1c0b5f0003f4eac9c0
Instruction ID: 8d3b97e163521f5371cce5870d13a3bf8ee370e3f3e792dc21d97ccbcfe9d8d5
Opcode Fuzzy Hash: 01449d5264d9fd874c8fc3943a3bd06482591bbc92089a1c0b5f0003f4eac9c0
Instruction Fuzzy Hash: 9511E731124355FAC704FFE0F855ABDB7A49B95744F84042DF142160A2CF25867DCB52

Function 0028D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0028D501
Process32FirstW.KERNEL32(00000000,?), ref: 0028D50F
Process32NextW.KERNEL32(00000000,?), ref: 0028D52F
CloseHandle.KERNELBASE(00000000), ref: 0028D5DC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9840f73989146e40c917ba0b46db7e7495c4cc6285c39c6a5ab86a66cdc857c3
Instruction ID: 58ea85dc175a14a612a57e178d4add6c193503fe266a3030e12647a941ca4d32
Opcode Fuzzy Hash: 9840f73989146e40c917ba0b46db7e7495c4cc6285c39c6a5ab86a66cdc857c3
Instruction Fuzzy Hash: C531C271018301AFD300EF94D885AAFBBF8EF99344F54092DF585921E1EB719998CB93

Function 0028DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00265222), ref: 0028DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0028DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0028DBEE
FindClose.KERNEL32(00000000), ref: 0028DBFA

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 6d21f0fcac3538eab3661117a2e7d6a52d998eaa47ba6d8a7f965873257e2d70
Instruction ID: 2033990b5e89b388029917101ac545d052ff6b1529f5a5a942825f2a29a77dc3
Opcode Fuzzy Hash: 6d21f0fcac3538eab3661117a2e7d6a52d998eaa47ba6d8a7f965873257e2d70
Instruction Fuzzy Hash: 2FF0E530821910578220BF7CBC0D8AA376C9E01334BA04703F836C20F0EBB05D68C7D5

Function 00244CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(002528E9,?,00244CBE,002528E9,002E88B8,0000000C,00244E15,002528E9,00000002,00000000,?,002528E9), ref: 00244D09
TerminateProcess.KERNEL32(00000000,?,00244CBE,002528E9,002E88B8,0000000C,00244E15,002528E9,00000002,00000000,?,002528E9), ref: 00244D10
ExitProcess.KERNEL32 ref: 00244D22

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 34639f4e585d4b01057dd44a5eca1d5f949e37cd6a926ec248caff9f82423dfe
Instruction ID: a2ee9eef6b68766e714f65d916c0779a11d1b07f59cd850a13646eff0452b8ca
Opcode Fuzzy Hash: 34639f4e585d4b01057dd44a5eca1d5f949e37cd6a926ec248caff9f82423dfe
Instruction Fuzzy Hash: 22E0B631420149EBCF16BF54ED0DA583BA9EB45781B604158FD099A122CB75DD62CA84

Function 0022BF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#/, xrefs: 002707CE

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#/
API String ID: 3964851224-3200842618
Opcode ID: 0cd60f346d7d171d3b6d206e2d1206b6084f3a2f1a1ef2bec7f764f33ed22567
Instruction ID: 3010e0b5c077f28401cdc32ab43e1390e30d71fec85871a01105131e25786b2c
Opcode Fuzzy Hash: 0cd60f346d7d171d3b6d206e2d1206b6084f3a2f1a1ef2bec7f764f33ed22567
Instruction Fuzzy Hash: DCA25870A28311DFD714CF54D480B2AB7E1BF89304F24896DE99A8B352D771E865CF92

Function 002AAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 002AB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 002AB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 002AB1D4
_wcslen.LIBCMT ref: 002AB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 002AB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 002AB236
_wcslen.LIBCMT ref: 002AB332

Part of subcall function 002905A7: GetStdHandle.KERNEL32(000000F6), ref: 002905C6

_wcslen.LIBCMT ref: 002AB34B
_wcslen.LIBCMT ref: 002AB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 002AB3B6
GetLastError.KERNEL32(00000000), ref: 002AB407
CloseHandle.KERNEL32(?), ref: 002AB439
CloseHandle.KERNEL32(00000000), ref: 002AB44A
CloseHandle.KERNEL32(00000000), ref: 002AB45C
CloseHandle.KERNEL32(00000000), ref: 002AB46E
CloseHandle.KERNEL32(?), ref: 002AB4E3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 735992a162624ef6c61fe362acef33008480fbd8d034fe1bb296aa65e79ab103
Instruction ID: 1a4192f89bb09523afe422756aa6b0c8ec77f68d63bb2d3d298c04044d68996a
Opcode Fuzzy Hash: 735992a162624ef6c61fe362acef33008480fbd8d034fe1bb296aa65e79ab103
Instruction Fuzzy Hash: 2AF1BD315283419FCB15EF24D891B6EBBE5AF86310F14855DF8899B2A2CB31EC64CF52

Function 0022D730 Relevance: 21.6, APIs: 14, Instructions: 625windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0022D807
timeGetTime.WINMM ref: 0022DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0022DB28
TranslateMessage.USER32(?), ref: 0022DB7B
DispatchMessageW.USER32(?), ref: 0022DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0022DB9F
Sleep.KERNELBASE(0000000A), ref: 0022DBB1

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 36a941968a8734845917c85ca08f7a11014a351479e78cea219bb8dd60424e33
Instruction ID: d222c13f7e26a88a50dfb3ebf8ac3e2f7eeb36dd85d2db36e2f336747886a29a
Opcode Fuzzy Hash: 36a941968a8734845917c85ca08f7a11014a351479e78cea219bb8dd60424e33
Instruction Fuzzy Hash: 30420570628352EFD725CF64E848B6AB7E0BF45304F54855DF49987291D770E8A8CF82

Function 00222CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00222D07
RegisterClassExW.USER32(00000030), ref: 00222D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00222D42
InitCommonControlsEx.COMCTL32(?), ref: 00222D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00222D6F
LoadIconW.USER32(000000A9), ref: 00222D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00222D94

Strings

TaskbarCreated, xrefs: 00222D37
AutoIt v3 GUI, xrefs: 00222D23
0, xrefs: 00222CE9
+, xrefs: 00222CF0

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: cf705876273aa877474fec37e668045209fcc582ca40957c2d0fd713841bee5f
Instruction ID: 14bcb86d9a6e687984fdf85d716acc6b54c6ff05ea63ee266873b94c3e5b4d3d
Opcode Fuzzy Hash: cf705876273aa877474fec37e668045209fcc582ca40957c2d0fd713841bee5f
Instruction Fuzzy Hash: B421E3B1951208EFDB00DFA4E88DBEDBBB8FB08750F20822AF551A62A0D7B10550CF90

Function 0026065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0026039A: CreateFileW.KERNELBASE(00000000,00000000,?,00260704,?,?,00000000,?,00260704,00000000,0000000C), ref: 002603B7

GetLastError.KERNEL32 ref: 0026076F
__dosmaperr.LIBCMT ref: 00260776
GetFileType.KERNELBASE(00000000), ref: 00260782
GetLastError.KERNEL32 ref: 0026078C
__dosmaperr.LIBCMT ref: 00260795
CloseHandle.KERNEL32(00000000), ref: 002607B5
CloseHandle.KERNEL32(?), ref: 002608FF
GetLastError.KERNEL32 ref: 00260931
__dosmaperr.LIBCMT ref: 00260938

Strings

H, xrefs: 002608BD

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 259bf4dd47578cffec3e679edfe9f40640a8c0cd58cda15db61b6fbc0c200a33
Instruction ID: 919f1f3c730d821ea5d3eea75a63f6156ce14bc1437bc4c7f6b84862867bcc2d
Opcode Fuzzy Hash: 259bf4dd47578cffec3e679edfe9f40640a8c0cd58cda15db61b6fbc0c200a33
Instruction Fuzzy Hash: 81A14832A201058FDF19EF68D895BAE7BA0AB46320F140159F8159B3D2DB319D62DB91

Function 0022344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00223A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,002F1418,?,00222E7F,?,?,?,00000000), ref: 00223A78

Part of subcall function 00223357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00223379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0022356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0026318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 002631CE
RegCloseKey.ADVAPI32(?), ref: 00263210
_wcslen.LIBCMT ref: 00263277
_wcslen.LIBCMT ref: 00263286

Strings

Include, xrefs: 00263184, 002631C5
\Include\, xrefs: 00223527
Software\AutoIt v3\AutoIt, xrefs: 00223560
\, xrefs: 0026328C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: d929231cedfcef0a67535db63a6d1b5409632395d833b0940b46c020224e67bf
Instruction ID: 5b6376ec6b33325e1e441f8f0e7954fb8584e348144877a0eba5a26d8546d731
Opcode Fuzzy Hash: d929231cedfcef0a67535db63a6d1b5409632395d833b0940b46c020224e67bf
Instruction Fuzzy Hash: 57718CB1424311AEC314EF65EC959ABBBE8FF86790F40087EF44593160DB349A98CF62

Function 00222B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00222B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00222B9D
LoadIconW.USER32(00000063), ref: 00222BB3
LoadIconW.USER32(000000A4), ref: 00222BC5
LoadIconW.USER32(000000A2), ref: 00222BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00222BEF
RegisterClassExW.USER32(?), ref: 00222C40

Part of subcall function 00222CD4: GetSysColorBrush.USER32(0000000F), ref: 00222D07
Part of subcall function 00222CD4: RegisterClassExW.USER32(00000030), ref: 00222D31
Part of subcall function 00222CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00222D42
Part of subcall function 00222CD4: InitCommonControlsEx.COMCTL32(?), ref: 00222D5F
Part of subcall function 00222CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00222D6F
Part of subcall function 00222CD4: LoadIconW.USER32(000000A9), ref: 00222D85
Part of subcall function 00222CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00222D94

Strings

AutoIt v3, xrefs: 00222C2F
#, xrefs: 00222C16
0, xrefs: 00222C0F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: acf9cf8813bba2a8aa8182566276b6228037c8e3ebaed03ab675e85635689365
Instruction ID: c427e6e664b99ca23d18ee2930222a2aa495a02892dbc40310ac94037f6534a6
Opcode Fuzzy Hash: acf9cf8813bba2a8aa8182566276b6228037c8e3ebaed03ab675e85635689365
Instruction Fuzzy Hash: C1214C70E10314EBDB109FA6FC4DAA9BFB4FB48BA0F5040AAF500A67A0D7B10564DF90

Function 00223170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0022316A,?,?), ref: 002231D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0022316A,?,?), ref: 00223204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00223227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0022316A,?,?), ref: 00223232
CreatePopupMenu.USER32 ref: 00223246
PostQuitMessage.USER32(00000000), ref: 00223267

Strings

TaskbarCreated, xrefs: 0022322D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 1dcb38a03785f5441532cd599eb5e19a28c9d79a7cc08190c7dc3f0ede58ec89
Instruction ID: 830b9874143317364690f72ac7559681278a6fb4cde3a1e729dcac941a0496b3
Opcode Fuzzy Hash: 1dcb38a03785f5441532cd599eb5e19a28c9d79a7cc08190c7dc3f0ede58ec89
Instruction Fuzzy Hash: 32413731230225F7DB149FF8BC1DB793628E705390F540235FA45952A2CBA9DE70DBA1

Function 00221410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00221459
CoUninitialize.COMBASE ref: 002214F8
UnregisterHotKey.USER32(?), ref: 002216DD
DestroyWindow.USER32(?), ref: 002624B9
FreeLibrary.KERNEL32(?), ref: 0026251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0026254B

Strings

close all, xrefs: 00221454

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: f6a9f53c85cf40c4d66422fe25fa043e2023171ed8150b0c3d986a8d0ae4dd43
Instruction ID: 8295bbfc45ff7f831a6624b612b7f6c253c88afdb7ccd030faa8c868b58384a8
Opcode Fuzzy Hash: f6a9f53c85cf40c4d66422fe25fa043e2023171ed8150b0c3d986a8d0ae4dd43
Instruction Fuzzy Hash: 82D19D31721622DFDB29EF54E499E29F7A4BF15300F6442ADE44A6B261CB30AC76CF50

Function 00222C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00222C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00222CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00221CAD,?), ref: 00222CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00221CAD,?), ref: 00222CCF

Strings

AutoIt v3, xrefs: 00222C89, 00222C8E, 00222C8F
edit, xrefs: 00222CAC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: d6644f4071c1ff4de14d08746008a5bf5c663a22542d0e47c8a91613332fb584
Instruction ID: 5e19e54229c764f9605ab9fc7241bce9028660ed69fcb1e275c267481c2b88fe
Opcode Fuzzy Hash: d6644f4071c1ff4de14d08746008a5bf5c663a22542d0e47c8a91613332fb584
Instruction Fuzzy Hash: A9F0DA76540290BAEB311717BC0CEB76EBDD7C7FB0B5000AAF900A66A0C6611860DBB0

Function 00223B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00223B0F,SwapMouseButtons,00000004,?), ref: 00223B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00223B0F,SwapMouseButtons,00000004,?), ref: 00223B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00223B0F,SwapMouseButtons,00000004,?), ref: 00223B83

Strings

Control Panel\Mouse, xrefs: 00223B3E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: e033763920f5e3bb3a59d36709ab1dcb359821af0646088feebd1ffc564e105c
Instruction ID: 8c917348d92984091bdd48d9b5d61df283112bd2b8e2fb1e0b470eec0756312e
Opcode Fuzzy Hash: e033763920f5e3bb3a59d36709ab1dcb359821af0646088feebd1ffc564e105c
Instruction Fuzzy Hash: 2D112AB5521219FFDB20CFA5EC48AAEB7B8EF04748B104959B805D7210D2759E509B60

Function 00223923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 002633A2

Part of subcall function 00226B57: _wcslen.LIBCMT ref: 00226B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00223A04

Strings

Line: , xrefs: 002633EB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 768cbb937607ee52c66593b048f2b4452fd7f4dd0359f781307d9c8ca569f4d4
Instruction ID: d029741351caf9716763e9acc21c3e4c63a0311050e0098e51cda3879bf239f8
Opcode Fuzzy Hash: 768cbb937607ee52c66593b048f2b4452fd7f4dd0359f781307d9c8ca569f4d4
Instruction Fuzzy Hash: 1D31E571528324BAC325EF50FC49FEBB7D8AB41750F40096AF59982191DB7496B8CBC2

Function 00222DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00262C8C

Part of subcall function 00223AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00223A97,?,?,00222E7F,?,?,?,00000000), ref: 00223AC2

Part of subcall function 00222DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00222DC4

Strings

`e., xrefs: 00262C85
X, xrefs: 00262C5A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`e.
API String ID: 779396738-1838813811
Opcode ID: 279aae76b4264f16fd6acedb93ab2c345fb2c9fdfee4977a952a7c78c03e19e2
Instruction ID: c1c9be6b63a2936af2bbb2c0a93604faaad791d7a47af3bbcad29fdc94e93494
Opcode Fuzzy Hash: 279aae76b4264f16fd6acedb93ab2c345fb2c9fdfee4977a952a7c78c03e19e2
Instruction Fuzzy Hash: 6D21C671A20298EBCB11EFD4D849BEE7BF89F58314F40405AE405B7241DBB856AD8FA1

Function 0023FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00240668

Part of subcall function 002432A4: RaiseException.KERNEL32(?,?,?,0024068A,?,002F1444,?,?,?,?,?,?,0024068A,00221129,002E8738,00221129), ref: 00243304

__CxxThrowException@8.LIBVCRUNTIME ref: 00240685

Strings

Unknown exception, xrefs: 00240692

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 2e47601218e0f723d10c83f40b312c9d1734ad6f04f3306ac72e86ed6e8b7039
Instruction ID: a0e7b85ba4775875d5d3110e3251473ae91b058ebe82ac665f6a1bd30bfb6470
Opcode Fuzzy Hash: 2e47601218e0f723d10c83f40b312c9d1734ad6f04f3306ac72e86ed6e8b7039
Instruction Fuzzy Hash: E4F0C234D2030E77CB08FAA4E88AC9E776CAE40750BA04571BA1896591EFB1DAB5CD80

Function 002210F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00221BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00221BF4
Part of subcall function 00221BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00221BFC
Part of subcall function 00221BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00221C07
Part of subcall function 00221BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00221C12
Part of subcall function 00221BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00221C1A
Part of subcall function 00221BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00221C22

Part of subcall function 00221B4A: RegisterWindowMessageW.USER32(00000004,?,002212C4), ref: 00221BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0022136A
OleInitialize.OLE32 ref: 00221388
CloseHandle.KERNEL32(00000000,00000000), ref: 002624AB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: ed687de574c688134db1522e58babb93e8b376d4540cc5c5a54264454df37524
Instruction ID: c185ad021dfdb8dbe97f2fd3425b9c97d0ff3e02303785a0678f29b6d4c61e58
Opcode Fuzzy Hash: ed687de574c688134db1522e58babb93e8b376d4540cc5c5a54264454df37524
Instruction Fuzzy Hash: 5171ABB4921244DFE384EF7AB94DAB57AE4BB987E47D4823AD10AC7261EB314474CF40

Function 0028C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00223923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00223A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0028C259
KillTimer.USER32(?,00000001,?,?), ref: 0028C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0028C270

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 3c61e2568da8a2128fefef2c38ee74ae943a4f636d396f0bf4c65ff3c491e549
Instruction ID: 42dbc55180ba84f24e2f23ef6d840b26c7d6d4e61d8e99091ccedcf92505d6c8
Opcode Fuzzy Hash: 3c61e2568da8a2128fefef2c38ee74ae943a4f636d396f0bf4c65ff3c491e549
Instruction Fuzzy Hash: 7931E574911354AFEB22DF649899BE7BBEC9B02304F10009AD5DA932C5C7745A84CF61

Function 002586AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,002585CC,?,002E8CC8,0000000C), ref: 00258704
GetLastError.KERNEL32(?,002585CC,?,002E8CC8,0000000C), ref: 0025870E
__dosmaperr.LIBCMT ref: 00258739

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 961dc72a9c19ad7752e6ddeba22cae443de2bb4abb157d2f6cdebe562b51e15d
Instruction ID: 0420c73a8aac0c85115949a29e44ef027f7f8b7b00552dc5af60e306b04d4be2
Opcode Fuzzy Hash: 961dc72a9c19ad7752e6ddeba22cae443de2bb4abb157d2f6cdebe562b51e15d
Instruction Fuzzy Hash: DE016B32A3523027D3646634A84977E674D4F81776F390259FC08AB0D2DEF0CC99C55C

Function 0022DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0022DB7B
DispatchMessageW.USER32(?), ref: 0022DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0022DB9F
Sleep.KERNELBASE(0000000A), ref: 0022DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00271CC9

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 824fb9e39a0dba087bedcfa29e7fb18ea93f1dfc5a63c4b41fc69d3c0a215ba9
Instruction ID: 0d03ebea8cf5eef20a41276c6092328450a6252a7ee6491897dc287621def706
Opcode Fuzzy Hash: 824fb9e39a0dba087bedcfa29e7fb18ea93f1dfc5a63c4b41fc69d3c0a215ba9
Instruction Fuzzy Hash: 9CF054305643459BE730CBA0AC5DFEA73ACEF44350F604619E64AC30D0DB30A468DB16

Function 00231310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 002317F6

Strings

CALL, xrefs: 002317C6

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 7cb5ddab142edd7bec31b01bd93dc0297c91a8ebcdea59976fc9687f51c57d22
Instruction ID: 4cf542b8cab2498947ea251b4b74c14db8b620bc26fe206eebe963245eeaa1a8
Opcode Fuzzy Hash: 7cb5ddab142edd7bec31b01bd93dc0297c91a8ebcdea59976fc9687f51c57d22
Instruction Fuzzy Hash: 07228BB06282029FC714CF14C485A2ABBF1BF89314F58896DF49A8B361D771E875CF92

Function 00223837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00223908

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: fbe9390365780b20ec84b815da85350f32b0149daacf66e8e0ec9884a29ee728
Instruction ID: 7d33a623336e7193e76face38f4b3dcd3d5d860d5600455d369fd3a9a6f90da9
Opcode Fuzzy Hash: fbe9390365780b20ec84b815da85350f32b0149daacf66e8e0ec9884a29ee728
Instruction Fuzzy Hash: 2231C370614311DFD320DF64E8887A7BBF4FB49358F00096EF59987250E7B5AA64CB52

Function 0023F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0023F661

Part of subcall function 0022D730: GetInputState.USER32 ref: 0022D807

Sleep.KERNEL32(00000000), ref: 0027F2DE

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: f15b5a52d9f6d92aac25e939267fb4b9872bd13b4b25c33b034cb0f1e29d2e55
Instruction ID: 2cbeed8758eeb40931406fb17215972fddd4402b25a16671bbc66e4c0429f8ab
Opcode Fuzzy Hash: f15b5a52d9f6d92aac25e939267fb4b9872bd13b4b25c33b034cb0f1e29d2e55
Instruction Fuzzy Hash: 7DF08C71260615AFD354EFB9E549B6AB7E8EF45760F00412AE85DCB261DB70A820CF90

Function 00224ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00224E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00224EDD,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224E9C
Part of subcall function 00224E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00224EAE
Part of subcall function 00224E90: FreeLibrary.KERNEL32(00000000,?,?,00224EDD,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224EFD

Part of subcall function 00224E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00263CDE,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224E62
Part of subcall function 00224E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00224E74
Part of subcall function 00224E59: FreeLibrary.KERNEL32(00000000,?,?,00263CDE,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224E87

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 8ba501b803afddc014bda291145a22845e246e9dc8db5b21722e71dcf879b50b
Instruction ID: 9165d19166438245910549e75d78f8902a7276dbffbb27a8844c76259c1bf493
Opcode Fuzzy Hash: 8ba501b803afddc014bda291145a22845e246e9dc8db5b21722e71dcf879b50b
Instruction Fuzzy Hash: 38112B31630225BADF14FFA0ED02FAD77A4AF80714F20842DF542AA1C1DEB49E649F50

Function 00258402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00258440

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 73f7c652f5c21e14cd02b7c052f8ccd1a229c2cf35b97047dd13e97e3f3a7aa9
Instruction ID: 2266806ce6b862c497b5423898f82be0de67972d58c7a09a4fc47e0a1116d820
Opcode Fuzzy Hash: 73f7c652f5c21e14cd02b7c052f8ccd1a229c2cf35b97047dd13e97e3f3a7aa9
Instruction Fuzzy Hash: 7111487190410AAFCB05DF58E94099A7BF9EF48314F104069FC09AB312DA70EA25CBA9

Function 00255000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00254C7D: RtlAllocateHeap.NTDLL(00000008,00221129,00000000,?,00252E29,00000001,00000364,?,?,?,0024F2DE,00253863,002F1444,?,0023FDF5,?), ref: 00254CBE

_free.LIBCMT ref: 0025506C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 0ac8f6db683a45e2470b25763d3a2a06cfd8ee49c0f82c9167c30876b2391fd1
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: D3014E722147059BE331CF55D84195AFBECFB89371F25051DE984932C0E670A809C778

Function 0024E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 7d1ea05eb78d9f2865ffa2b5102da72049e6bcf5d984387ea757a08f04d03673
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 74F04932530A1096EB353E758C05B56339CAF52331F120715FC20921C1CBB0D4298EA9

Function 00254C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00221129,00000000,?,00252E29,00000001,00000364,?,?,?,0024F2DE,00253863,002F1444,?,0023FDF5,?), ref: 00254CBE

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 60bc0bfb659fa1c2e602188c673db64412bdf2637e536d2924960889764e8be0
Instruction ID: d9ea3b829ac4419893f3b76f219a62865df5199293e896ddfcb47d0547f953bc
Opcode Fuzzy Hash: 60bc0bfb659fa1c2e602188c673db64412bdf2637e536d2924960889764e8be0
Instruction Fuzzy Hash: 34F0E03163212567DB217F629C09B56B748BFC17BBB154123FC15A7290CA70D87446D4

Function 00253820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,002F1444,?,0023FDF5,?,?,0022A976,00000010,002F1440,002213FC,?,002213C6,?,00221129), ref: 00253852

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1fe04642ad8a2eb062ab48bc3b1b7a0909bd0d64c6475862ac610db9ed6fe267
Instruction ID: 541dbb10653d566997e41af8a031730de94258ef838dcb1ac4f4fff6f4aead40
Opcode Fuzzy Hash: 1fe04642ad8a2eb062ab48bc3b1b7a0909bd0d64c6475862ac610db9ed6fe267
Instruction Fuzzy Hash: 59E0E532130226A6D639AE669C0CB9A3649AB427F2F151132BC14A3490CB71DD2586E8

Function 00224F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224F6D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ede91a631d0ee409a2f73d1bdd9e1db4df8831fcf4735653f5d3aaee7c328807
Instruction ID: 7ca1eb96d73b36745abf56e8845b5b528a603f747744f5153c03741c822da1cd
Opcode Fuzzy Hash: ede91a631d0ee409a2f73d1bdd9e1db4df8831fcf4735653f5d3aaee7c328807
Instruction Fuzzy Hash: C0F0A071025722DFDB38AFA4E590812B7E4FF40319320897EE2EA82910C7719854DF10

Function 002B2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 002B2A66

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 7dda8841cb2888788b2f3e3167e51e502e564f441d2e36b3a3c593ee8478564d
Instruction ID: 1a83355c625b72dfb52d4d940fd03f908eb5bbf0a3ddac28cc504f1ac8680d94
Opcode Fuzzy Hash: 7dda8841cb2888788b2f3e3167e51e502e564f441d2e36b3a3c593ee8478564d
Instruction Fuzzy Hash: 1DE04F36371216EAD714FA31EC848FA775CEB503D5710453AED2AD2140DF3099B98AA0

Function 002230F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 0022314E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 7d9a1c640222c28928f8060258fe32964a527d721ed8599bb033692f8a1dce47
Instruction ID: f22478dc578b39e780c351b43a994e6a58f45c4574f691356a4cbe7b2d168042
Opcode Fuzzy Hash: 7d9a1c640222c28928f8060258fe32964a527d721ed8599bb033692f8a1dce47
Instruction Fuzzy Hash: 96F0A770910318DFE752DF24EC4ABE57BBCA701708F0000E5A14896182D7744B98CF41

Function 00222DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00222DC4

Part of subcall function 00226B57: _wcslen.LIBCMT ref: 00226B6A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 3f034e34800208cb7ce0260687868042217625dc172e6e35ca0acb7d68ea0e08
Instruction ID: 4b54c35b0ef49889bf12a2169a167954af089fb30eddc4a2edc72934516fceca
Opcode Fuzzy Hash: 3f034e34800208cb7ce0260687868042217625dc172e6e35ca0acb7d68ea0e08
Instruction Fuzzy Hash: 23E0CD726002245BC72092989C09FDA77DDDFC8794F040171FD09E7248D960AD908950

Function 00222B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00223837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00223908

Part of subcall function 0022D730: GetInputState.USER32 ref: 0022D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00222B6B

Part of subcall function 002230F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0022314E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: da6a405a5250da0b41923d287bb5770a7a5cc4e68ad0905a206095437111aee1
Instruction ID: 3635eeb5af5d018bda97df372e42414068cb60c9ab3a5ed202291bc45a5906e3
Opcode Fuzzy Hash: da6a405a5250da0b41923d287bb5770a7a5cc4e68ad0905a206095437111aee1
Instruction Fuzzy Hash: 7CE0262132022872C604FBF4B81657DE3499BD5351F80053EF14287162CE2946798A62

Function 0026039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00260704,?,?,00000000,?,00260704,00000000,0000000C), ref: 002603B7

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 439e2afdfc01ff27c6ea72bc5da0c2d8138a7fcb2135dfc81b486071f7d61a32
Instruction ID: 6568403c741a34cc695a762eb9c43c37327b09f845659665c75c3f837d208672
Opcode Fuzzy Hash: 439e2afdfc01ff27c6ea72bc5da0c2d8138a7fcb2135dfc81b486071f7d61a32
Instruction Fuzzy Hash: 7CD06C3205010DBBDF028F84ED06EDA3BAAFB48714F114100BE1866020C732E821AB90

Function 00221CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00221CBC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 68d6e5e2a22c7ab459c65fca99cf9af88d3c9565525087df15db450cbb52bc0c
Instruction ID: 2b62ec4eb81a91da899c8af28305356d9c9b3133383a75d6e687dc7f8bf1e43a
Opcode Fuzzy Hash: 68d6e5e2a22c7ab459c65fca99cf9af88d3c9565525087df15db450cbb52bc0c
Instruction Fuzzy Hash: CBC09236280305EFF2288B80BC5EF207764E348B60F948011F609B96E3C3A22820EB60

Non-executed Functions

Function 002B9576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 002B961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002B965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 002B969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002B96C9
SendMessageW.USER32 ref: 002B96F2
GetKeyState.USER32(00000011), ref: 002B978B
GetKeyState.USER32(00000009), ref: 002B9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002B97AE
GetKeyState.USER32(00000010), ref: 002B97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002B97E9
SendMessageW.USER32 ref: 002B9810
SendMessageW.USER32(?,00001030,?,002B7E95), ref: 002B9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 002B992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 002B9941
SetCapture.USER32(?), ref: 002B994A
ClientToScreen.USER32(?,?), ref: 002B99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 002B99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002B99D6
ReleaseCapture.USER32 ref: 002B99E1
GetCursorPos.USER32(?), ref: 002B9A19
ScreenToClient.USER32(?,?), ref: 002B9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 002B9A80
SendMessageW.USER32 ref: 002B9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 002B9AEB
SendMessageW.USER32 ref: 002B9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 002B9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 002B9B4A
GetCursorPos.USER32(?), ref: 002B9B68
ScreenToClient.USER32(?,?), ref: 002B9B75
GetParent.USER32(?), ref: 002B9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 002B9BFA
SendMessageW.USER32 ref: 002B9C2B
ClientToScreen.USER32(?,?), ref: 002B9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 002B9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 002B9CDE
SendMessageW.USER32 ref: 002B9D01
ClientToScreen.USER32(?,?), ref: 002B9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 002B9D82

Part of subcall function 00239944: GetWindowLongW.USER32(?,000000EB), ref: 00239952

GetWindowLongW.USER32(?,000000F0), ref: 002B9E05

Strings

p#/, xrefs: 002B9990
@GUI_DRAGID, xrefs: 002B997D
F, xrefs: 002B9D07

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#/
API String ID: 3429851547-1087944916
Opcode ID: f4c8880f058194889eab73c46b3999dbcf0e0ef6a08564ac21187017b8a440b4
Instruction ID: e80c331d55913dfa8a9a2688d1842a7dc27cea9b5d8d73ff99ed2f42a1aff7bd
Opcode Fuzzy Hash: f4c8880f058194889eab73c46b3999dbcf0e0ef6a08564ac21187017b8a440b4
Instruction Fuzzy Hash: 6A429E70624242AFD724CF24DC48EEABBE9FF89390F144619F695872A1D771E8A0CF51

Function 002B4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 002B48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 002B4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 002B4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 002B494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 002B495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 002B497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 002B49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 002B49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 002B4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 002B4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 002B4A7E
IsMenu.USER32(?), ref: 002B4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 002B4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 002B4B20
GetWindowLongW.USER32(?,000000F0), ref: 002B4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 002B4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 002B4C82
wsprintfW.USER32 ref: 002B4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 002B4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 002B4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 002B4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 002B4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 002B4D5A

Strings

%d/%02d/%02d, xrefs: 002B4CA8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: d7c2fbde266076146ff32339a8275b173964d70ab03c7089f92bc31d537e1f93
Instruction ID: 6500b71b6943dd69c33f1e556a8a671f03ed75dd5e9a5da6a0a31674403f706d
Opcode Fuzzy Hash: d7c2fbde266076146ff32339a8275b173964d70ab03c7089f92bc31d537e1f93
Instruction Fuzzy Hash: 3F120371520215ABEB24AF24DC89FEE7BF8EF44750F104219F915DB2E2DBB49950CB50

Function 0023F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0023F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0027F474
IsIconic.USER32(00000000), ref: 0027F47D
ShowWindow.USER32(00000000,00000009), ref: 0027F48A
SetForegroundWindow.USER32(00000000), ref: 0027F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0027F4AA
GetCurrentThreadId.KERNEL32 ref: 0027F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0027F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0027F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0027F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0027F4DE
SetForegroundWindow.USER32(00000000), ref: 0027F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0027F4F6
keybd_event.USER32(00000012,00000000), ref: 0027F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0027F50B
keybd_event.USER32(00000012,00000000), ref: 0027F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0027F519
keybd_event.USER32(00000012,00000000), ref: 0027F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0027F528
keybd_event.USER32(00000012,00000000), ref: 0027F52D
SetForegroundWindow.USER32(00000000), ref: 0027F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0027F557

Strings

Shell_TrayWnd, xrefs: 0027F46F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: b1cda18beb62eb73682249fe5f9a46db1edc2da94771ad119c309a25dcfb1a11
Instruction ID: 92519dcc7554069e064fab95d3f3764f40d960f3fe06c748220dc711f66ff1b7
Opcode Fuzzy Hash: b1cda18beb62eb73682249fe5f9a46db1edc2da94771ad119c309a25dcfb1a11
Instruction Fuzzy Hash: 27319471A50218BBEB206FB59C4EFBF7E6CEB44B50F204125FA04F61D1C6B05D10AB60

Function 00281201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 002816C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0028170D
Part of subcall function 002816C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0028173A
Part of subcall function 002816C3: GetLastError.KERNEL32 ref: 0028174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00281286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 002812A8
CloseHandle.KERNEL32(?), ref: 002812B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 002812D1
GetProcessWindowStation.USER32 ref: 002812EA
SetProcessWindowStation.USER32(00000000), ref: 002812F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00281310

Part of subcall function 002810BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002811FC), ref: 002810D4
Part of subcall function 002810BF: CloseHandle.KERNEL32(?,?,002811FC), ref: 002810E9

Strings

, xrefs: 0028125A
default, xrefs: 0028130B
Z., xrefs: 00281392
winsta0, xrefs: 002812CC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Z.
API String ID: 22674027-790370899
Opcode ID: 945edb2b74575922a3fbd950526385f461df3e3a3b9480925d34da0646585db7
Instruction ID: 3ea64eaea0d3ad903234a38d9655d1c3428c035f2925c062b3ad1365627a40d4
Opcode Fuzzy Hash: 945edb2b74575922a3fbd950526385f461df3e3a3b9480925d34da0646585db7
Instruction Fuzzy Hash: 3681AF7592220AAFDF11AFA4DC49FEE7BBDEF04704F148129F911A61E0D7718966CB20

Function 00280B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002810F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00281114
Part of subcall function 002810F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00280B9B,?,?,?), ref: 00281120
Part of subcall function 002810F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00280B9B,?,?,?), ref: 0028112F
Part of subcall function 002810F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00280B9B,?,?,?), ref: 00281136
Part of subcall function 002810F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0028114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00280BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00280C00
GetLengthSid.ADVAPI32(?), ref: 00280C17
GetAce.ADVAPI32(?,00000000,?), ref: 00280C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00280C6D
GetLengthSid.ADVAPI32(?), ref: 00280C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00280C8C
HeapAlloc.KERNEL32(00000000), ref: 00280C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00280CB4
CopySid.ADVAPI32(00000000), ref: 00280CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00280CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00280D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00280D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00280D45
HeapFree.KERNEL32(00000000), ref: 00280D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00280D55
HeapFree.KERNEL32(00000000), ref: 00280D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00280D65
HeapFree.KERNEL32(00000000), ref: 00280D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00280D78
HeapFree.KERNEL32(00000000), ref: 00280D7F

Part of subcall function 00281193: GetProcessHeap.KERNEL32(00000008,00280BB1,?,00000000,?,00280BB1,?), ref: 002811A1
Part of subcall function 00281193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00280BB1,?), ref: 002811A8
Part of subcall function 00281193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00280BB1,?), ref: 002811B7

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 2289e66ccac996b2d05f82464bf396ddba7bb8a24d3aa14fceaa5ff877407593
Instruction ID: d1438f28c820329bb0248147aa1db0f2cc83e1a4cdb015405991fe96a65195e7
Opcode Fuzzy Hash: 2289e66ccac996b2d05f82464bf396ddba7bb8a24d3aa14fceaa5ff877407593
Instruction Fuzzy Hash: 7F715C7691120AAFDF50EFA4EC88FAEBBB8FF04310F144625F914A7191D771A919CB60

Function 0029EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(002BCC08), ref: 0029EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0029EB37
GetClipboardData.USER32(0000000D), ref: 0029EB43
CloseClipboard.USER32 ref: 0029EB4F
GlobalLock.KERNEL32(00000000), ref: 0029EB87
CloseClipboard.USER32 ref: 0029EB91
GlobalUnlock.KERNEL32(00000000), ref: 0029EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0029EBC9
GetClipboardData.USER32(00000001), ref: 0029EBD1
GlobalLock.KERNEL32(00000000), ref: 0029EBE2
GlobalUnlock.KERNEL32(00000000), ref: 0029EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0029EC38
GetClipboardData.USER32(0000000F), ref: 0029EC44
GlobalLock.KERNEL32(00000000), ref: 0029EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0029EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0029EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0029ECD2
GlobalUnlock.KERNEL32(00000000), ref: 0029ECF3
CountClipboardFormats.USER32 ref: 0029ED14
CloseClipboard.USER32 ref: 0029ED59

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 1940ae59952a193b9a7f396e75e18db5f661758837b0edea607b1eb56a05afe2
Instruction ID: 918c19a6987b4b0401f6eb15b87b61a4fa4e717beb5920254777ce8995ccb276
Opcode Fuzzy Hash: 1940ae59952a193b9a7f396e75e18db5f661758837b0edea607b1eb56a05afe2
Instruction Fuzzy Hash: 41610174214302AFDB00EF64E898F2A77A8FF84714F15461DF856872A2DB30DD55CB62

Function 0029698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 002969BE
FindClose.KERNEL32(00000000), ref: 00296A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00296A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00296A75

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00296AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00296ADF

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00296B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00296B32
%4d, xrefs: 00296BB1
%03d, xrefs: 00296DA2
%02d, xrefs: 00296C00, 00296C0A, 00296C5A, 00296CAA, 00296CFA, 00296D4A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 23d7944b8b35bc714179e8b38da403078a14ba5962c161d2e92fd530467eac3f
Instruction ID: 684603884a71edcd406ea00e4ddbe37a9c06f5ffdf4388729300b17eee04e646
Opcode Fuzzy Hash: 23d7944b8b35bc714179e8b38da403078a14ba5962c161d2e92fd530467eac3f
Instruction Fuzzy Hash: BED18EB2518310AEC700EFA0D995EAFB7ECAF88704F44491EF585D6191EB34DA58CB62

Function 00299642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00299663
GetFileAttributesW.KERNEL32(?), ref: 002996A1
SetFileAttributesW.KERNEL32(?,?), ref: 002996BB
FindNextFileW.KERNEL32(00000000,?), ref: 002996D3
FindClose.KERNEL32(00000000), ref: 002996DE
FindFirstFileW.KERNEL32(*.*,?), ref: 002996FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0029974A
SetCurrentDirectoryW.KERNEL32(002E6B7C), ref: 00299768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00299772
FindClose.KERNEL32(00000000), ref: 0029977F
FindClose.KERNEL32(00000000), ref: 0029978F

Strings

*.*, xrefs: 002996F5

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 265b289bc08edc55e1356f367dc7ef3aeb235d2cd3356578008ef2bbce5a01e7
Instruction ID: 5415249e5756edbcbffc2a87ab0997698baa0b5c508427e046200626c22ae6ea
Opcode Fuzzy Hash: 265b289bc08edc55e1356f367dc7ef3aeb235d2cd3356578008ef2bbce5a01e7
Instruction Fuzzy Hash: A631C37256021A6BDF14EFF9EC4CADE77AC9F49370F14425AF805E2190DB71D9A08E20

Function 0029979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 002997BE
FindNextFileW.KERNEL32(00000000,?), ref: 00299819
FindClose.KERNEL32(00000000), ref: 00299824
FindFirstFileW.KERNEL32(*.*,?), ref: 00299840
SetCurrentDirectoryW.KERNEL32(?), ref: 00299890
SetCurrentDirectoryW.KERNEL32(002E6B7C), ref: 002998AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 002998B8
FindClose.KERNEL32(00000000), ref: 002998C5
FindClose.KERNEL32(00000000), ref: 002998D5

Part of subcall function 0028DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0028DB00

Strings

*.*, xrefs: 0029983B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 61c89ec453778d6ff5ce1443c7c3a3e2d43f4c2bc25a054e7b39ff04f954b224
Instruction ID: c33b2b8569d7463b8066fadaae5f331b6176cbf54d814f5bec746666f2d0932d
Opcode Fuzzy Hash: 61c89ec453778d6ff5ce1443c7c3a3e2d43f4c2bc25a054e7b39ff04f954b224
Instruction Fuzzy Hash: E831D43156121A6FDF14EFB9EC48ADE77ACAF06370F24425EE850A2191DB70DDA4CE20

Function 002ABE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,002AB6AE,?,?), ref: 002AC9B5
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002AC9F1
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002ACA68
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002ABF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 002ABFA9
RegCloseKey.ADVAPI32(00000000), ref: 002ABFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 002AC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 002AC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 002AC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 002AC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 002AC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 002AC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 002AC382
RegCloseKey.ADVAPI32(00000000), ref: 002AC38F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 17c282895f7c1e739011b68c1bd71aeca7a2fff17e31c23dc5ad43c02c47e50f
Instruction ID: 73a5d3cd94d39e28756958913fda96e7c6945ab76aa90f8e9f89c7abdf14b8ae
Opcode Fuzzy Hash: 17c282895f7c1e739011b68c1bd71aeca7a2fff17e31c23dc5ad43c02c47e50f
Instruction Fuzzy Hash: 22025C71614201AFC714DF28C895E2ABBE5EF89318F18849DF84ADB2A2DB31EC55CF51

Function 00298195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00298257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00298267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00298273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00298310
SetCurrentDirectoryW.KERNEL32(?), ref: 00298324
SetCurrentDirectoryW.KERNEL32(?), ref: 00298356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0029838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00298395

Strings

*.*, xrefs: 0029839B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 5490b1faec2863460e3fe0fdc0908af7647b456fa68d9aa6f179a387d1b17c02
Instruction ID: d51cb6f153cd8930b9bff3c6890a286645d52351c51b1c05614aef4f130ef6e1
Opcode Fuzzy Hash: 5490b1faec2863460e3fe0fdc0908af7647b456fa68d9aa6f179a387d1b17c02
Instruction Fuzzy Hash: 60618C71524345AFCB10EF60D8449AEB3E8FF89310F18496EF98987251DB31E965CF92

Function 0028D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00223AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00223A97,?,?,00222E7F,?,?,?,00000000), ref: 00223AC2

Part of subcall function 0028E199: GetFileAttributesW.KERNEL32(?,0028CF95), ref: 0028E19A

FindFirstFileW.KERNEL32(?,?), ref: 0028D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0028D1DD
MoveFileW.KERNEL32(?,?), ref: 0028D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0028D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0028D237

Part of subcall function 0028D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0028D21C,?,?), ref: 0028D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0028D253
FindClose.KERNEL32(00000000), ref: 0028D264

Strings

\*.*, xrefs: 0028D0CD, 0028D0D6, 0028D0EB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 4bf78ea46a20402494292a2d546042a42de2ca0ec5efde198be57f0a613897f4
Instruction ID: df4269248a2c4242712ca64cdd4068304c2995d7858783f0d3e6b4b250a70d80
Opcode Fuzzy Hash: 4bf78ea46a20402494292a2d546042a42de2ca0ec5efde198be57f0a613897f4
Instruction Fuzzy Hash: 8B61573582211DAACF05FBE0E9929EDB7B5AF14300F644165E802771D6EB306F69CF61

Function 0029ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0029ED91
EmptyClipboard.USER32 ref: 0029ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0029EDAC
CloseClipboard.USER32 ref: 0029EEA3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 063ebb523113cb4fe7d69d3f5398cd89c2c62f23ddaff34f2d7c3e36ecc6095e
Instruction ID: d7f268b891c7376a36601dec5f63845b3d5378079e739891bb5fdb59ab7f96bc
Opcode Fuzzy Hash: 063ebb523113cb4fe7d69d3f5398cd89c2c62f23ddaff34f2d7c3e36ecc6095e
Instruction Fuzzy Hash: 8B41DF31614612AFEB20DF15E88CF19BBE5FF44328F25C199E8558BA62C735EC51CB90

Function 0028E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 002816C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0028170D
Part of subcall function 002816C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0028173A
Part of subcall function 002816C3: GetLastError.KERNEL32 ref: 0028174A

ExitWindowsEx.USER32(?,00000000), ref: 0028E932

Strings

@, xrefs: 0028E925
, xrefs: 0028E95C
SeShutdownPrivilege, xrefs: 0028E902
, xrefs: 0028E920

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 047524d10548e46c9610ced8a611841e2fcc0b503cd0b1d830bfb0c415a3fbb1
Instruction ID: 6a7222d19c3c7c33dffeb2fb3c35b6b0294bcd95b9ef17fcae154ca30892afeb
Opcode Fuzzy Hash: 047524d10548e46c9610ced8a611841e2fcc0b503cd0b1d830bfb0c415a3fbb1
Instruction Fuzzy Hash: 2701FE76632211ABEF643674AC89FBF725C9714750F164521FC13E31D3D6E05C6087A0

Function 002A1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 002A1276
WSAGetLastError.WSOCK32 ref: 002A1283
bind.WSOCK32(00000000,?,00000010), ref: 002A12BA
WSAGetLastError.WSOCK32 ref: 002A12C5
closesocket.WSOCK32(00000000), ref: 002A12F4
listen.WSOCK32(00000000,00000005), ref: 002A1303
WSAGetLastError.WSOCK32 ref: 002A130D
closesocket.WSOCK32(00000000), ref: 002A133C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: c79b03143effcc63d8b3cbbdf5a2d904fd432b8be0a867f832227367d0051241
Instruction ID: cd023e2ac2e53356828f868d3896f975d42dcb971bca7cb277021615ee820bb1
Opcode Fuzzy Hash: c79b03143effcc63d8b3cbbdf5a2d904fd432b8be0a867f832227367d0051241
Instruction Fuzzy Hash: 0F41B631610111AFD710DF64D488B29BBE5BF46328F288188E8569F3D6CB71EC91CBE1

Function 0025B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0025B9D4
_free.LIBCMT ref: 0025B9F8
_free.LIBCMT ref: 0025BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,002C3700), ref: 0025BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,002F121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0025BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,002F1270,000000FF,?,0000003F,00000000,?), ref: 0025BC36
_free.LIBCMT ref: 0025BD4B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 688d1541d6d24867ae5ab3f7c66b571609bb5b5532c7004b5b22ec981ea5bc9d
Instruction ID: e3b1a625d040d47f132730fcdc4492615540dc0143e52a5c1d30b26d0d1caba9
Opcode Fuzzy Hash: 688d1541d6d24867ae5ab3f7c66b571609bb5b5532c7004b5b22ec981ea5bc9d
Instruction Fuzzy Hash: B8C14B71920205EFCB12DF789C45BB9BBB8EF41352F1441AAEC90D7291E7708D69CB58

Function 0028D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00223AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00223A97,?,?,00222E7F,?,?,?,00000000), ref: 00223AC2

Part of subcall function 0028E199: GetFileAttributesW.KERNEL32(?,0028CF95), ref: 0028E19A

FindFirstFileW.KERNEL32(?,?), ref: 0028D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0028D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0028D481
FindClose.KERNEL32(00000000), ref: 0028D498
FindClose.KERNEL32(00000000), ref: 0028D4A1

Strings

\*.*, xrefs: 0028D3F2

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: c676a44ff05b9f0263631c4411d2caac1bc594c0fe2f3c8b75a44eb6c031c93a
Instruction ID: 48671aff44d2ab16af223f0c51691db7f9ac58e3b31435424e480f52203aaee0
Opcode Fuzzy Hash: c676a44ff05b9f0263631c4411d2caac1bc594c0fe2f3c8b75a44eb6c031c93a
Instruction Fuzzy Hash: 53317031029395ABC304FFA4E8558AF77A8BE91310F844A1DF4D1521D1EB30AA2DCB63

Function 0025E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0025E645

Strings

1#SNAN, xrefs: 0025F844
1#INF, xrefs: 0025F852
1#QNAN, xrefs: 0025F84B
1#IND, xrefs: 0025F83D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8ce989eaee878754d2708c1ed1dab39e81260de07ef9c01363415f2799dd48b1
Instruction ID: db503ba8da7fab2c04046fbd1c915d050550f6c6b6a9565edd99deebddec8a13
Opcode Fuzzy Hash: 8ce989eaee878754d2708c1ed1dab39e81260de07ef9c01363415f2799dd48b1
Instruction Fuzzy Hash: 0CC27E71D246298FDF68CE28CD407E9B3B5EB48306F1541EAD80DE7240E774AE998F44

Function 0029648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 002964DC
CoInitialize.OLE32(00000000), ref: 00296639
CoCreateInstance.OLE32(002BFCF8,00000000,00000001,002BFB68,?), ref: 00296650
CoUninitialize.OLE32 ref: 002968D4

Strings

.lnk, xrefs: 002964BA, 00296524, 002965E0

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 0a9d12eaf138a0dcfab374f7f7cc4c02630a09ded08c78d8c0d1c75e3ec5ff49
Instruction ID: f193e02145a160e06700ca821b1758b7e03de5cb443391cf7bff2c5001deabc8
Opcode Fuzzy Hash: 0a9d12eaf138a0dcfab374f7f7cc4c02630a09ded08c78d8c0d1c75e3ec5ff49
Instruction Fuzzy Hash: 16D17A71528211AFC704EF64D885D6BB7E8FF98304F50492DF4858B2A1EB30ED59CB92

Function 002A22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 002A22E8

Part of subcall function 0029E4EC: GetWindowRect.USER32(?,?), ref: 0029E504

GetDesktopWindow.USER32 ref: 002A2312
GetWindowRect.USER32(00000000), ref: 002A2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 002A2355
GetCursorPos.USER32(?), ref: 002A2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 002A23DF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 0bb0288958f155ff3a6de28f02e19fbdb5c4f7636a055e19f9fb7b453204af31
Instruction ID: 388c71e809132e38715e0a30b056689bb69048427ba294e6a9eaaa25e7026f76
Opcode Fuzzy Hash: 0bb0288958f155ff3a6de28f02e19fbdb5c4f7636a055e19f9fb7b453204af31
Instruction Fuzzy Hash: 01310272505305AFDB20DF18DC09F5BB7A9FF86310F100A19F985A7181DB34E918CB92

Function 00299B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00299B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00299C8B

Part of subcall function 00293874: GetInputState.USER32 ref: 002938CB
Part of subcall function 00293874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00293966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00299BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00299C75

Strings

*.*, xrefs: 00299B5D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 44bb47fb5490382482af1f6cb634931c60bfc1e21f0ff413141ecfef1974d706
Instruction ID: b1bb70d8273d12d4d785d32d217155194fc3426acd8f718352eaf1ce4e878bee
Opcode Fuzzy Hash: 44bb47fb5490382482af1f6cb634931c60bfc1e21f0ff413141ecfef1974d706
Instruction Fuzzy Hash: F441847191021AAFCF14DFA8DC59AEE7BB8FF09310F24415AE805A2191DB309EA4CF60

Function 0023997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00239A4E
GetSysColor.USER32(0000000F), ref: 00239B23
SetBkColor.GDI32(?,00000000), ref: 00239B36

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: cb11516f146b22ee6960834039d1193bdab3521c45105b0f8448084b65f7689e
Instruction ID: 2689abbc62e6977fcd6d43806ff9ce49b6aadac5f4bb28d07c942c5068af0f3e
Opcode Fuzzy Hash: cb11516f146b22ee6960834039d1193bdab3521c45105b0f8448084b65f7689e
Instruction Fuzzy Hash: B4A149F1238405EEE7289E3D9C98EBB265DDB43390F10831AF502C6695CAF59DB1C671

Function 002A1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002A304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 002A307A
Part of subcall function 002A304E: _wcslen.LIBCMT ref: 002A309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 002A185D
WSAGetLastError.WSOCK32 ref: 002A1884
bind.WSOCK32(00000000,?,00000010), ref: 002A18DB
WSAGetLastError.WSOCK32 ref: 002A18E6
closesocket.WSOCK32(00000000), ref: 002A1915

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 7528fb4b3a567679816296b16fb977b585856273267df1ed37ed9846944cbf0c
Instruction ID: b62058b0fcbb9b75dd1ea8ac7acab51c1c94027ee3a93b512926269acd6b705e
Opcode Fuzzy Hash: 7528fb4b3a567679816296b16fb977b585856273267df1ed37ed9846944cbf0c
Instruction Fuzzy Hash: 1C51D471A10210AFE710AF64D886F2A77E5AF45718F148058F9055F3D3CB75AD61CBA1

Function 002B1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 002B1CC0
IsWindowEnabled.USER32 ref: 002B1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 002B1CDB
IsIconic.USER32 ref: 002B1CE9
IsZoomed.USER32 ref: 002B1CF7

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 5c3300d8896b58b5edce31f45bdae65d2503a0741112ea106f18b8688a01bfc5
Instruction ID: 699e944ddf41a6d61347d010e0d3bd1acc2015bd32215b2ebe5f2b269f87ff8d
Opcode Fuzzy Hash: 5c3300d8896b58b5edce31f45bdae65d2503a0741112ea106f18b8688a01bfc5
Instruction Fuzzy Hash: 4E21F9317502129FD7208F1AD864FAA7FE5EF85394F688059E845CB351CB71EC62CB91

Function 00228060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 002283E8
VUUU, xrefs: 00265DF0
ERCP, xrefs: 0022813C
VUUU, xrefs: 0022843C
VUUU, xrefs: 002283FA

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 4f7c24e2d861abfadc6f6e9e15321725cd12772a0a1099eac0c3b950634750d1
Instruction ID: cae81357299455797165ac4f9c4c415f3691044abe237e5d34aebb1fde548d48
Opcode Fuzzy Hash: 4f7c24e2d861abfadc6f6e9e15321725cd12772a0a1099eac0c3b950634750d1
Instruction Fuzzy Hash: 27A28E70E2162ADBDF24CF98D8447ADB7B1BF54310F2481AAE815A7284DB74DDE1CB90

Function 0028D5EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0028D608
DeviceIoControl.KERNEL32(00000000,t*.,?,0000000C,?,00000028,?,00000000), ref: 0028D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0028D650

Strings

t*., xrefs: 0028D63F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: t*.
API String ID: 33631002-520411257
Opcode ID: 5f45b53a649f45b95983d648ff9821854ffd7d7d42bb403b997eada62c685fbf
Instruction ID: 49d085626c61b59a0cd88a093bdea02ce6b8def213a24f6c951fdeba19410e52
Opcode Fuzzy Hash: 5f45b53a649f45b95983d648ff9821854ffd7d7d42bb403b997eada62c685fbf
Instruction Fuzzy Hash: F4115E75E05228BFDB109F99EC49FAFBBBCEB45B50F108165F904E7290D6704A058BA1

Function 00288298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 002882AA

Strings

(, xrefs: 002882F0
|, xrefs: 002882DA
tb., xrefs: 002884F4

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tb.$|
API String ID: 1659193697-4210434425
Opcode ID: 8b52b745fb313ecfb9b9253a42b54bd47137b103bd4ee525421282a333ceb1ca
Instruction ID: f6676ddc1b867a0bff4a12f650dd7aa40ea5b01a0a4dbe37bcb76f25cd1eacae
Opcode Fuzzy Hash: 8b52b745fb313ecfb9b9253a42b54bd47137b103bd4ee525421282a333ceb1ca
Instruction Fuzzy Hash: 1E324778A11606DFCB28DF19C08096AB7F0FF48710B55C46EE89ADB7A1EB70E951CB40

Function 0028AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0028AAAC
SetKeyboardState.USER32(00000080), ref: 0028AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0028AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0028AB88

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 824bb6e35d22cf7cd0017bf5d61c95503939331fe68d6b739769c533cb8edadd
Instruction ID: e0a7246ac7153df10de36410400f577c6e37a24a4da1833523a30f09a0d30bdc
Opcode Fuzzy Hash: 824bb6e35d22cf7cd0017bf5d61c95503939331fe68d6b739769c533cb8edadd
Instruction Fuzzy Hash: 59315D34A62209AEFF35EF64CC05BFA7BA6AB54314F18421BF081521D1DB7489A1C762

Function 0029CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0029CE89
GetLastError.KERNEL32(?,00000000), ref: 0029CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0029CEFE

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: b251f17249d7d8e129751f5804d4367477ab61b0d1c3e98f1001f1cff893a221
Instruction ID: 911e10b3e7efda460f0683549539ad84b565c0bf8111ad3da349b6ad40173999
Opcode Fuzzy Hash: b251f17249d7d8e129751f5804d4367477ab61b0d1c3e98f1001f1cff893a221
Instruction Fuzzy Hash: 5D21AFB15207069BEF20DF65D948BA7B7FCEB50354F20442EE686D2551E770EE148B60

Function 00295C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00295CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00295D17
FindClose.KERNEL32(?), ref: 00295D5F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: e6626b336898b9bdfaee436125ffeba8b998d5a117a6b9f556b5ec11a7fbe65e
Instruction ID: aaddeb9a1d93672596dedee084063d70eb8265b677559648eb5a0d6ab6b12e55
Opcode Fuzzy Hash: e6626b336898b9bdfaee436125ffeba8b998d5a117a6b9f556b5ec11a7fbe65e
Instruction Fuzzy Hash: B2519B347146129FCB14CF28D498A9AB7E4FF09314F14855EE99A8B3A1CB30EC24CFA1

Function 00252622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0025271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00252724
UnhandledExceptionFilter.KERNEL32(?), ref: 00252731

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b40da19315a605a0f0fd06a76d112a2d89e61d8ee4a6586988e70dff11c5cb4c
Instruction ID: ca2e962379b7c5788157c772c6ff1030afec028da14a9518b0156b8af8bee505
Opcode Fuzzy Hash: b40da19315a605a0f0fd06a76d112a2d89e61d8ee4a6586988e70dff11c5cb4c
Instruction Fuzzy Hash: 6131D7749112289BCB21DF64DC8879CBBB8AF08310F5041DAE90CA7261E7309F958F45

Function 002951CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002951DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00295238
SetErrorMode.KERNEL32(00000000), ref: 002952A1

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: edd7312dbf5146b32dcdb18fe29be71a1bb79a83de30c005a97a34e72ed447e4
Instruction ID: 95f4b86312cc5e5fc9686507463d04a6e15e95325c5ccbbc27bda8ac0ec7cec6
Opcode Fuzzy Hash: edd7312dbf5146b32dcdb18fe29be71a1bb79a83de30c005a97a34e72ed447e4
Instruction Fuzzy Hash: 6E315275A10518EFDB00DF94D484EADBBB4FF48314F148099E805AB362D735E855CB90

Function 002816C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0023FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00240668
Part of subcall function 0023FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00240685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0028170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0028173A
GetLastError.KERNEL32 ref: 0028174A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 458d82e11eef65c5971fb039132e2dd949b4a23d42217538a4fc0bcf8119df33
Instruction ID: 11ade0d27781e8a1468bb7b9b642434587301f526f3f447357e08c64f5206bdc
Opcode Fuzzy Hash: 458d82e11eef65c5971fb039132e2dd949b4a23d42217538a4fc0bcf8119df33
Instruction Fuzzy Hash: 4F1194B2414309AFD718AF54EC8AD6AB7BDEF44714B20852EF05657281EB70BC518B20

Function 00281663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0028168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 002816A1
FreeSid.ADVAPI32(?), ref: 002816B1

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: d6b86dbec7deb9da3e6568de71e3941246e5c9eb3de1bbc9e7624ec4ca65a37b
Instruction ID: 4db1953eb2f61aabc0549f6715ae71e7bd9ee0103392b145cbe17eebfb11f4b9
Opcode Fuzzy Hash: d6b86dbec7deb9da3e6568de71e3941246e5c9eb3de1bbc9e7624ec4ca65a37b
Instruction Fuzzy Hash: FEF0F475950309FBDB00EFE49C89AAEBBBCFB08704F504965E501E2181E774AA448B60

Function 0025C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0025C36C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 8224a430187c9068c2e5e3eddb1a4ec79c2df096f5485063ecd53327ab82fa9b
Instruction ID: 53be17d68f18993212babcaba6930eb40805b6bb01b995a4dd89ea5681e4fe34
Opcode Fuzzy Hash: 8224a430187c9068c2e5e3eddb1a4ec79c2df096f5485063ecd53327ab82fa9b
Instruction Fuzzy Hash: 96414672910319AFCB249FB9CC49EAB77B8EB84315F2042A9FD05C7180F2709D858B54

Function 0027D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0027D28C

Strings

X64, xrefs: 0027D2A8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: fa94653f5019b3920ae4931f7e2147d334ed3ea9ce3cb41db838af6dfb8ea7d4
Instruction ID: 0f0850b5fad751f395da215349050a8ca14ee3138403d334bbac0b893186a12e
Opcode Fuzzy Hash: fa94653f5019b3920ae4931f7e2147d334ed3ea9ce3cb41db838af6dfb8ea7d4
Instruction Fuzzy Hash: 36D0C9B482511DEBCB94DB90EC88DDDB37CBB04305F104652F506A2000DB7095498F10

Function 0024CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: d7dff5f54a4755fc46ef14e45341d2ef65c85257722b82c1626db9c7154b4561
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 61023D71E112199FDF58CFADC8806ADFBF1EF48324F25816AD919E7380D731AA518B84

Function 0022CAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00270C40
p#/, xrefs: 0022CF7F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#/
API String ID: 0-4194470516
Opcode ID: 5b440a269374af8c6626158186ba56785da3036815a2f7c186e41b86d8f60e07
Instruction ID: a0623d7bd9c56966fc5377170c1f32b628f263948e0d123a395236edd9790abf
Opcode Fuzzy Hash: 5b440a269374af8c6626158186ba56785da3036815a2f7c186e41b86d8f60e07
Instruction Fuzzy Hash: 8A328070930229EBCF14DFD0E985AEDB7B5FF05304F24805AE80AAB291D775AD69CB50

Function 002968EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00296918
FindClose.KERNEL32(00000000), ref: 00296961

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 168ffd9b3622b2b98bab43c68de48ca5dd32b18c217ab0eca8b9d4d7eab8762e
Instruction ID: f8e648c25e93784c35f54e5597655f1f7b3f24262bd2b4a810925aa4e6e127ce
Opcode Fuzzy Hash: 168ffd9b3622b2b98bab43c68de48ca5dd32b18c217ab0eca8b9d4d7eab8762e
Instruction Fuzzy Hash: A611D0316142119FDB10CF69D488A1ABBE0FF88328F14C699E8698F6A2C730EC15CB90

Function 002937B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,002A4891,?,?,00000035,?), ref: 002937E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,002A4891,?,?,00000035,?), ref: 002937F4

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 670fe7f9979679eff2d769844e62f7dd066106474f0c0116373a1825b7ce0f7c
Instruction ID: 312de1d8281223c748fef1674d63204f7a9ffb0778f78f0d57ccf1fa03c80dc2
Opcode Fuzzy Hash: 670fe7f9979679eff2d769844e62f7dd066106474f0c0116373a1825b7ce0f7c
Instruction Fuzzy Hash: 99F0E5B06143292AEB2057A69C4DFEB7AAEEFC4761F000265F509D2291D9A09944CAB0

Function 0028B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0028B25D
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 0028B270

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 88fd1c548dbf62d84758df245cfc870e738a21045ddc7baa563cc1992a907145
Instruction ID: 00dec619f7c6dbd69213790a27d8ad2c8c4ea109d637ebb3caa1d50674a14671
Opcode Fuzzy Hash: 88fd1c548dbf62d84758df245cfc870e738a21045ddc7baa563cc1992a907145
Instruction Fuzzy Hash: 68F06D7481424EABDB059FA0C805BEE7BB4FF04305F108009F951A5192C3798611DF94

Function 002810BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002811FC), ref: 002810D4
CloseHandle.KERNEL32(?,?,002811FC), ref: 002810E9

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: bda1215a0a5fc7ac26ebe67325dfa6524cb41bff2db12228159dfb2a01a22a44
Instruction ID: d5844190da23a83be72dc6f3f70b727cc4eb3b949dd03ca1c8f573e67154db33
Opcode Fuzzy Hash: bda1215a0a5fc7ac26ebe67325dfa6524cb41bff2db12228159dfb2a01a22a44
Instruction Fuzzy Hash: 3BE04F72428600AFE7652B11FC09E7377E9EB04310F20892DF4A5804B1DB626CA0DB10

Function 0025676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00256766,?,?,00000008,?,?,0025FEFE,00000000), ref: 00256998

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 91c3ac97ff7e80130d83dbafd7c45c78c1d7ca52ba8357c26a478f5385b259af
Instruction ID: c0385c5b941978171eada72e23b2c248f415ae840b5c3c5b7c0cf52588c4314b
Opcode Fuzzy Hash: 91c3ac97ff7e80130d83dbafd7c45c78c1d7ca52ba8357c26a478f5385b259af
Instruction Fuzzy Hash: 84B17D31620609CFD714CF28C48AB647BE0FF05366F658658EC99CF2A2C335D9A9CB44

Function 0023B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0027851F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b1e1cd78d7c29c1e474e7f79c7796a9f71a8e5c22b0b7da790bc41e0d64411c2
Instruction ID: 857496ec90d1eed1c9d87a099f05b48692bb7d71cb583f2bca3a1e090e03ea1b
Opcode Fuzzy Hash: b1e1cd78d7c29c1e474e7f79c7796a9f71a8e5c22b0b7da790bc41e0d64411c2
Instruction Fuzzy Hash: D2127FB1D202299BCB15CF58C8906EEB7F5FF48310F14819AE949EB251EB709E91CF90

Function 0029EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0029EABD

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 6e2fa86310e62fb602581205b134548d0bf9e7b434c90426ecbf28ee4097872e
Instruction ID: 8558280519f967b139fedb36c9d05f3bc1ca425cbedda99c8cca92cc2f8163c2
Opcode Fuzzy Hash: 6e2fa86310e62fb602581205b134548d0bf9e7b434c90426ecbf28ee4097872e
Instruction Fuzzy Hash: 28E04831220215AFDB10DF59E404E5AF7DDAF98760F15841AFC45C7361D770E8518B90

Function 002409D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,002403EE), ref: 002409DA

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ca2c46020b02a6e3ceab75166eaa4151da51917edca5d9f63237b662bac031ff
Instruction ID: 78c4a14d19aac0623e80df140730586c1e8eb31e72584e3a853b1fe29cc1c3f1
Opcode Fuzzy Hash: ca2c46020b02a6e3ceab75166eaa4151da51917edca5d9f63237b662bac031ff
Instruction Fuzzy Hash:

Function 0024781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0024798B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 748cb2d59fbb92b704feb5c44b7362d1935104f498f25bda2e142006b092c10f
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: D651897163CB4B5BDB3C8D78885E7BE23899B12300F180919D8B2D7282C765DE35E752

Function 00292046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&/, xrefs: 00292053

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: 0&/
API String ID: 0-3005580031
Opcode ID: c7902d06244645459773e24d7e85d390eab8286a99f9513e60cd1e1c02fa7c4c
Instruction ID: 7bce126d4eb5a0425bc2f38175acbf9205c884f5a45c054d1e3b7f8ff57f41bc
Opcode Fuzzy Hash: c7902d06244645459773e24d7e85d390eab8286a99f9513e60cd1e1c02fa7c4c
Instruction Fuzzy Hash: 102196326205158BDB28CE79D81267A73E9A764320F15862EE4A7C37D1DE35A908CB80

Function 00256DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c24327b615b933deefa0dbc69c4fb7a824eb3380075ded0d2ac73372b311817
Instruction ID: b9f76d4493c68b8cfb7ef6981efc49f7a5e0a26b4754a8e6124545a157420bad
Opcode Fuzzy Hash: 7c24327b615b933deefa0dbc69c4fb7a824eb3380075ded0d2ac73372b311817
Instruction Fuzzy Hash: 2832FF22D79F014DD7239A34E826326A249AFB73C6F15D737EC1AB59A6EF39C4874100

Function 0023CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1474095af5bd68df61af12a5ed2db996b61dafb21cc2259f95f97e9bbcd84d
Instruction ID: 7a351b5076a2b2e4c6a4a74848a7b8a8c284a583d6778d638725e4dc0ade58e1
Opcode Fuzzy Hash: 4e1474095af5bd68df61af12a5ed2db996b61dafb21cc2259f95f97e9bbcd84d
Instruction Fuzzy Hash: 34320271A341568BCF28CE39C49467DB7A1EB45304F38C96FD84EAB2A1D630DDA2DB41

Function 00227920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc11d2e2c1862ab1395710ec58d90d3040a58bea50fb02259e59ee521aec6141
Instruction ID: 89e9efc254d0cf18b57e4d78ff9db279b775277d2f253f8d9a7f9299d476f4ee
Opcode Fuzzy Hash: fc11d2e2c1862ab1395710ec58d90d3040a58bea50fb02259e59ee521aec6141
Instruction Fuzzy Hash: 8022D4B0A2461AEFDF14CFA4D981AAEB3F5FF44304F104569E816AB291EB359D60CF50

Function 002291C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245d566c8f46aa549689e9d378b046c56c5363b870516c408dc3aad4158b4764
Instruction ID: 59a611b95518aebafee3a04372eb3e9ef2c4bc9294f1b27794df1060200c72b1
Opcode Fuzzy Hash: 245d566c8f46aa549689e9d378b046c56c5363b870516c408dc3aad4158b4764
Instruction Fuzzy Hash: EE02D7B1E2021AEBDF04DF54E981AADB7B5FF44304F118169E8069B290EB719E70CF91

Function 00259EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3beda40b05560d4ab17dffdeebad9e47800254e3ff5ab24cb71b23bcf827a355
Instruction ID: 180830e5eb9c1d8a643f3fd59b821c8391bfc5cd3c300ca93d53ad72a551f6f6
Opcode Fuzzy Hash: 3beda40b05560d4ab17dffdeebad9e47800254e3ff5ab24cb71b23bcf827a355
Instruction Fuzzy Hash: CFB11420D2AF814DC32396399836336B65CAFBB6D5F91D71BFC1675D22EB2286834180

Function 00247A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1403aa038a1243a936f256984f1b82fc02dc9400a18b641b8f2c76cd866a1aba
Instruction ID: d00b8b71b25f1f8e7dcf054591214eb4ff57f664672c209a8768108942766400
Opcode Fuzzy Hash: 1403aa038a1243a936f256984f1b82fc02dc9400a18b641b8f2c76cd866a1aba
Instruction Fuzzy Hash: 4161AA7123871B56DE3C9E288C95BBE2398EF41708F10091EE9A3DF281DB519E72C756

Function 00247CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776fd66c3cdfcc4338b93cf94c191d9852bb83d4c1bf0aedef60a16b45290871
Instruction ID: 3f594eb3fa168cdea8c2a741ced2dd3a77a92a27f5b77cc5ac20c5682c5cbd09
Opcode Fuzzy Hash: 776fd66c3cdfcc4338b93cf94c191d9852bb83d4c1bf0aedef60a16b45290871
Instruction Fuzzy Hash: 8A61AA31B3870BE6CE3C9E284895BBF2388DF02704F100A59E963DF281DB529D728A55

Function 00273CD2 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df4536ac3451464c1629a885e3e23461e128d776e5c1886b788cc8284ac4094
Instruction ID: a3a8436ed18de627bad2be839693a8c94f6b0c5111a33357cda2c04d2e1e5f72
Opcode Fuzzy Hash: 1df4536ac3451464c1629a885e3e23461e128d776e5c1886b788cc8284ac4094
Instruction Fuzzy Hash: CC61F8B58183E3BFC726CF2484A5595FFE0EF2631072984AFC9D64B152D33199A6DB02

Function 002A2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 002A2B30
DeleteObject.GDI32(00000000), ref: 002A2B43
DestroyWindow.USER32 ref: 002A2B52
GetDesktopWindow.USER32 ref: 002A2B6D
GetWindowRect.USER32(00000000), ref: 002A2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 002A2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 002A2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002A2CF8
GetClientRect.USER32(00000000,?), ref: 002A2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 002A2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002A2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002A2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002A2D80
GlobalLock.KERNEL32(00000000), ref: 002A2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002A2D98
GlobalUnlock.KERNEL32(00000000), ref: 002A2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002A2DA8
GlobalFree.KERNEL32(00000000), ref: 002A2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002A2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,002BFC38,00000000), ref: 002A2DDB
GlobalFree.KERNEL32(00000000), ref: 002A2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 002A2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 002A2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002A2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002A303F

Strings

AutoIt v3, xrefs: 002A2CF2
, xrefs: 002A2FC5
static, xrefs: 002A2D3A, 002A2E91
DISPLAY, xrefs: 002A2EA2

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: d3329a1cf6e93d24e1cbf33f4faafe75291b06a35aac2a1666c3b66d9230524a
Instruction ID: fa9843cba994391e7a860a7be010097fda93c287f5be3713e7521c3060a7541e
Opcode Fuzzy Hash: d3329a1cf6e93d24e1cbf33f4faafe75291b06a35aac2a1666c3b66d9230524a
Instruction Fuzzy Hash: EF026C71510215EFDB14DFA8DC89EAE7BB9EF49320F108658F915AB2A1CB70AD11CF60

Function 002B70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 002B712F
GetSysColorBrush.USER32(0000000F), ref: 002B7160
GetSysColor.USER32(0000000F), ref: 002B716C
SetBkColor.GDI32(?,000000FF), ref: 002B7186
SelectObject.GDI32(?,?), ref: 002B7195
InflateRect.USER32(?,000000FF,000000FF), ref: 002B71C0
GetSysColor.USER32(00000010), ref: 002B71C8
CreateSolidBrush.GDI32(00000000), ref: 002B71CF
FrameRect.USER32(?,?,00000000), ref: 002B71DE
DeleteObject.GDI32(00000000), ref: 002B71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 002B7230
FillRect.USER32(?,?,?), ref: 002B7262
GetWindowLongW.USER32(?,000000F0), ref: 002B7284

Part of subcall function 002B73E8: GetSysColor.USER32(00000012), ref: 002B7421
Part of subcall function 002B73E8: SetTextColor.GDI32(?,?), ref: 002B7425
Part of subcall function 002B73E8: GetSysColorBrush.USER32(0000000F), ref: 002B743B
Part of subcall function 002B73E8: GetSysColor.USER32(0000000F), ref: 002B7446
Part of subcall function 002B73E8: GetSysColor.USER32(00000011), ref: 002B7463
Part of subcall function 002B73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 002B7471
Part of subcall function 002B73E8: SelectObject.GDI32(?,00000000), ref: 002B7482
Part of subcall function 002B73E8: SetBkColor.GDI32(?,00000000), ref: 002B748B
Part of subcall function 002B73E8: SelectObject.GDI32(?,?), ref: 002B7498
Part of subcall function 002B73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 002B74B7
Part of subcall function 002B73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002B74CE
Part of subcall function 002B73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 002B74DB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 38673151ad2a73e5faeec7f14e38713424fad1ec619a0e7a5a813592cc29d451
Instruction ID: c00ca46692c42a8554d8687c5dceb887e0a7fa8ac048fb57a27776268717be81
Opcode Fuzzy Hash: 38673151ad2a73e5faeec7f14e38713424fad1ec619a0e7a5a813592cc29d451
Instruction Fuzzy Hash: 76A19272018301AFD7109F64EC4CE9B7BA9FB89360F200B19F9A6A61E1D771E954CF61

Function 002A2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 002A273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 002A286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 002A28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 002A28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 002A2900
GetClientRect.USER32(00000000,?), ref: 002A290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 002A2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 002A2964
GetStockObject.GDI32(00000011), ref: 002A2974
SelectObject.GDI32(00000000,00000000), ref: 002A2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 002A2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 002A2991
DeleteDC.GDI32(00000000), ref: 002A299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 002A29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 002A29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 002A2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 002A2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 002A2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 002A2A77
GetStockObject.GDI32(00000011), ref: 002A2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 002A2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 002A2A97

Strings

AutoIt v3, xrefs: 002A28F8
static, xrefs: 002A294F, 002A2A71
DISPLAY, xrefs: 002A295A
msctls_progress32, xrefs: 002A2A13

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: b199efaced39516d98d7cf1de51b3f780dd238aecbebf6865d0697f5b499ab20
Instruction ID: 36cdb50309bd5120d108de4c8a0b1e46d32062e92717c1bfbd00fd0abbaa7ef3
Opcode Fuzzy Hash: b199efaced39516d98d7cf1de51b3f780dd238aecbebf6865d0697f5b499ab20
Instruction Fuzzy Hash: 2AB15C71A10219BFEB14DFA8DC49FAEBBA9EF49710F104254F914EB290DB74AD50CB60

Function 00294ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00294AED
GetDriveTypeW.KERNEL32(?,002BCB68,?,\\.\,002BCC08), ref: 00294BCA
SetErrorMode.KERNEL32(00000000,002BCB68,?,\\.\,002BCC08), ref: 00294D36

Strings

Virtual, xrefs: 00294CE5
ATAPI, xrefs: 00294C91
Fixed, xrefs: 00294C09
FileBackedVirtual, xrefs: 00294CEC
RAMDisk, xrefs: 00294BF4
SATA, xrefs: 00294CD0
PhysicalDrive, xrefs: 00294B76
CDROM, xrefs: 00294BFB
USB, xrefs: 00294CB4
ATA, xrefs: 00294C98
MMC, xrefs: 00294CDE
SCSI, xrefs: 00294C8A
SSD, xrefs: 00294C4A
SSA, xrefs: 00294CA6
Network, xrefs: 00294C02
RAID, xrefs: 00294CBB
iSCSI, xrefs: 00294CC2
Fibre, xrefs: 00294CAD
Unknown, xrefs: 00294BED, 00294C83
1394, xrefs: 00294C9F
SAS, xrefs: 00294CC9
Removable, xrefs: 00294C10, 00294C15
\\.\, xrefs: 00294B3F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 2461fd85950e67382010460f843a5e9bc335298c2d28d8e15d0616897a0d1893
Instruction ID: e34b2488001752770669fe1466a4b295ccdc73ac4ab277b05ad8c8c9cd71aa1a
Opcode Fuzzy Hash: 2461fd85950e67382010460f843a5e9bc335298c2d28d8e15d0616897a0d1893
Instruction Fuzzy Hash: 16612330675106EFCF04FF24CA89D6CB7A0AB19384BA04167F806AB291CB71ED72DB51

Function 002B73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 002B7421
SetTextColor.GDI32(?,?), ref: 002B7425
GetSysColorBrush.USER32(0000000F), ref: 002B743B
GetSysColor.USER32(0000000F), ref: 002B7446
CreateSolidBrush.GDI32(?), ref: 002B744B
GetSysColor.USER32(00000011), ref: 002B7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 002B7471
SelectObject.GDI32(?,00000000), ref: 002B7482
SetBkColor.GDI32(?,00000000), ref: 002B748B
SelectObject.GDI32(?,?), ref: 002B7498
InflateRect.USER32(?,000000FF,000000FF), ref: 002B74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002B74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 002B74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 002B752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 002B7554
InflateRect.USER32(?,000000FD,000000FD), ref: 002B7572
DrawFocusRect.USER32(?,?), ref: 002B757D
GetSysColor.USER32(00000011), ref: 002B758E
SetTextColor.GDI32(?,00000000), ref: 002B7596
DrawTextW.USER32(?,002B70F5,000000FF,?,00000000), ref: 002B75A8
SelectObject.GDI32(?,?), ref: 002B75BF
DeleteObject.GDI32(?), ref: 002B75CA
SelectObject.GDI32(?,?), ref: 002B75D0
DeleteObject.GDI32(?), ref: 002B75D5
SetTextColor.GDI32(?,?), ref: 002B75DB
SetBkColor.GDI32(?,?), ref: 002B75E5

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: fb39c61efeb416d540dd910b39b023785b829ee64891d39c04c3de5c159aaa4b
Instruction ID: a7eee78ec2490d5858a76aab51b06860aa52119015fa0652a36a99de50cc711c
Opcode Fuzzy Hash: fb39c61efeb416d540dd910b39b023785b829ee64891d39c04c3de5c159aaa4b
Instruction Fuzzy Hash: 34618172910219AFDF119FA8EC48EEE7F79EB48360F204211F915BB2A1D7709950CFA0

Function 002B0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 002B1128
GetDesktopWindow.USER32 ref: 002B113D
GetWindowRect.USER32(00000000), ref: 002B1144
GetWindowLongW.USER32(?,000000F0), ref: 002B1199
DestroyWindow.USER32(?), ref: 002B11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 002B11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 002B120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 002B121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 002B1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 002B1245
IsWindowVisible.USER32(00000000), ref: 002B12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 002B12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 002B12D0
GetWindowRect.USER32(00000000,?), ref: 002B12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 002B130E
GetMonitorInfoW.USER32(00000000,?), ref: 002B1328
CopyRect.USER32(?,?), ref: 002B133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 002B13AA

Strings

(, xrefs: 002B131B
tooltips_class32, xrefs: 002B11E6
0, xrefs: 002B10D3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: c8e53bf95d87e34d1ffa92a596ef01809dc94bd56b23d63acb6220f83a04dc23
Instruction ID: cff45635e4f5b576c5ae2c55023df10e9170211364e5d22c6c38a5c828828593
Opcode Fuzzy Hash: c8e53bf95d87e34d1ffa92a596ef01809dc94bd56b23d63acb6220f83a04dc23
Instruction Fuzzy Hash: 35B1BE71618351AFD700DF64D898BAABBE4FF84340F40891CF9999B2A1D770E864CF91

Function 002B0241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002B02E5
_wcslen.LIBCMT ref: 002B031F
_wcslen.LIBCMT ref: 002B0389
_wcslen.LIBCMT ref: 002B03F1
_wcslen.LIBCMT ref: 002B0475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 002B04C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 002B0504

Part of subcall function 0023F9F2: _wcslen.LIBCMT ref: 0023F9FD

Part of subcall function 0028223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00282258
Part of subcall function 0028223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0028228A

Strings

FINDITEM, xrefs: 002B0627
GETSUBITEMCOUNT, xrefs: 002B0384, 002B039F
DESELECT, xrefs: 002B059C
VIEWCHANGE, xrefs: 002B0675
GETSELECTEDCOUNT, xrefs: 002B0470, 002B048B
SELECTCLEAR, xrefs: 002B052D
GETTEXT, xrefs: 002B03EC, 002B0407
GETSELECTED, xrefs: 002B05E1
SELECTALL, xrefs: 002B0515
ISSELECTED, xrefs: 002B04DD
SELECT, xrefs: 002B0548
GETITEMCOUNT, xrefs: 002B0316, 002B0337
SELECTINVERT, xrefs: 002B057E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 9ff395166df49ce39a61029e9f83968eee942870947dc46e8cf2de7b0d5c859b
Instruction ID: 2d6e96a500303c90b5c9249de4d2d5044368f3fba1853f55b6d23a5c517e737d
Opcode Fuzzy Hash: 9ff395166df49ce39a61029e9f83968eee942870947dc46e8cf2de7b0d5c859b
Instruction Fuzzy Hash: D0E10F312383019FC725DF24D58096BB3E6BF88394F604A6DF8969B2A1DB30ED65CB41

Function 00238891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00238968
GetSystemMetrics.USER32(00000007), ref: 00238970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0023899B
GetSystemMetrics.USER32(00000008), ref: 002389A3
GetSystemMetrics.USER32(00000004), ref: 002389C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 002389E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 002389F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00238A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00238A3C
GetClientRect.USER32(00000000,000000FF), ref: 00238A5A
GetStockObject.GDI32(00000011), ref: 00238A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00238A81

Part of subcall function 0023912D: GetCursorPos.USER32(?), ref: 00239141
Part of subcall function 0023912D: ScreenToClient.USER32(00000000,?), ref: 0023915E
Part of subcall function 0023912D: GetAsyncKeyState.USER32(00000001), ref: 00239183
Part of subcall function 0023912D: GetAsyncKeyState.USER32(00000002), ref: 0023919D

SetTimer.USER32(00000000,00000000,00000028,002390FC), ref: 00238AA8

Strings

AutoIt v3 GUI, xrefs: 00238A20

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: f51838271771712caa42db2b407da59fc6d1aae9c1dfa94ef598dd372feb4505
Instruction ID: 8ceec2af105d71ca101230c899c7e0402b3ed84e496b1fde3d64d3d537924ea3
Opcode Fuzzy Hash: f51838271771712caa42db2b407da59fc6d1aae9c1dfa94ef598dd372feb4505
Instruction Fuzzy Hash: 0FB18D71A1020ADFDB14DFA8DD49BAE7BB5FB48354F104229FA15AB290DB70E860CF51

Function 00280D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002810F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00281114
Part of subcall function 002810F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00280B9B,?,?,?), ref: 00281120
Part of subcall function 002810F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00280B9B,?,?,?), ref: 0028112F
Part of subcall function 002810F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00280B9B,?,?,?), ref: 00281136
Part of subcall function 002810F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0028114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00280DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00280E29
GetLengthSid.ADVAPI32(?), ref: 00280E40
GetAce.ADVAPI32(?,00000000,?), ref: 00280E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00280E96
GetLengthSid.ADVAPI32(?), ref: 00280EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00280EB5
HeapAlloc.KERNEL32(00000000), ref: 00280EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00280EDD
CopySid.ADVAPI32(00000000), ref: 00280EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00280F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00280F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00280F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00280F6E
HeapFree.KERNEL32(00000000), ref: 00280F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00280F7E
HeapFree.KERNEL32(00000000), ref: 00280F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00280F8E
HeapFree.KERNEL32(00000000), ref: 00280F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00280FA1
HeapFree.KERNEL32(00000000), ref: 00280FA8

Part of subcall function 00281193: GetProcessHeap.KERNEL32(00000008,00280BB1,?,00000000,?,00280BB1,?), ref: 002811A1
Part of subcall function 00281193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00280BB1,?), ref: 002811A8
Part of subcall function 00281193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00280BB1,?), ref: 002811B7

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: fd129f9705f5a51b4c02bb5930e08fb54ef5fb34b4959d1bb502f2b76680faaf
Instruction ID: 445a4237b56d6dca7292a363eb533738a68ce821f49711ea1d7470a687eef2ff
Opcode Fuzzy Hash: fd129f9705f5a51b4c02bb5930e08fb54ef5fb34b4959d1bb502f2b76680faaf
Instruction Fuzzy Hash: 4871737591120AEBDF60AFA4DC88FAEBBB8BF14300F148615F919E6191D7309919CB60

Function 002AC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002AC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,002BCC08,00000000,?,00000000,?,?), ref: 002AC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 002AC5A4
_wcslen.LIBCMT ref: 002AC5F4
_wcslen.LIBCMT ref: 002AC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 002AC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 002AC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 002AC84D
RegCloseKey.ADVAPI32(?), ref: 002AC881
RegCloseKey.ADVAPI32(00000000), ref: 002AC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 002AC960

Strings

REG_SZ, xrefs: 002AC644
REG_QWORD, xrefs: 002AC8C3
REG_EXPAND_SZ, xrefs: 002AC5CD
REG_DWORD, xrefs: 002AC804
REG_MULTI_SZ, xrefs: 002AC6F5
REG_BINARY, xrefs: 002AC913

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: a691f215a7d9aed1dd1f9552571db2d9d34a2973dc3def17d0e63bbf6acf983a
Instruction ID: 7357268832571bec4d9f9df43f20eb1079520e165fda09ff961497646fc86447
Opcode Fuzzy Hash: a691f215a7d9aed1dd1f9552571db2d9d34a2973dc3def17d0e63bbf6acf983a
Instruction Fuzzy Hash: 60126B35628211AFC714DF14D885A2AB7E5FF89714F14885CF84A9B3A2DB31EC61CF81

Function 002B091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002B09C6
_wcslen.LIBCMT ref: 002B0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 002B0A54
_wcslen.LIBCMT ref: 002B0A8A
_wcslen.LIBCMT ref: 002B0B06
_wcslen.LIBCMT ref: 002B0B81

Part of subcall function 0023F9F2: _wcslen.LIBCMT ref: 0023F9FD

Part of subcall function 00282BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00282BFA

Strings

UNCHECK, xrefs: 002B0D3E
GETSELECTED, xrefs: 002B0C4E
GETTEXT, xrefs: 002B0C97
GETTOTALCOUNT, xrefs: 002B09F2, 002B0A17
SELECT, xrefs: 002B0D11
EXPAND, xrefs: 002B0BF8
COLLAPSE, xrefs: 002B0B01, 002B0B1C
ISCHECKED, xrefs: 002B0CE1
EXISTS, xrefs: 002B0B7C, 002B0B97
GETITEMCOUNT, xrefs: 002B0C1E
CHECK, xrefs: 002B0A85, 002B0AA0

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 3735d8cea636a58ca028cddc9e26861a5dc46670a1736967178d038ab41bfb01
Instruction ID: 85fb46dcf954d10f4f6d4f8017261edc597632c8523b8b2874370654e0d4910b
Opcode Fuzzy Hash: 3735d8cea636a58ca028cddc9e26861a5dc46670a1736967178d038ab41bfb01
Instruction Fuzzy Hash: 55E1CC312283029FC715EF24C49096AB7E1FF98388F54895DF8969B3A2D730ED65CB81

Function 002AC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,002AB6AE,?,?), ref: 002AC9B5
_wcslen.LIBCMT ref: 002AC9F1
_wcslen.LIBCMT ref: 002ACA68
_wcslen.LIBCMT ref: 002ACA9E
_wcslen.LIBCMT ref: 002ACAF9
_wcslen.LIBCMT ref: 002ACB2F
_wcslen.LIBCMT ref: 002ACB7F

Strings

HKEY_CLASSES_ROOT, xrefs: 002ACAF3, 002ACAF8
HKLM, xrefs: 002ACA98, 002ACA9D
HKEY_CURRENT_CONFIG, xrefs: 002ACB79, 002ACB7E
HKCU, xrefs: 002ACBCE
HKEY_USERS, xrefs: 002ACBDF
HKEY_LOCAL_MACHINE, xrefs: 002ACA62, 002ACA67
HKCR, xrefs: 002ACB29, 002ACB2E
HKEY_CURRENT_USER, xrefs: 002ACBBD
HKU, xrefs: 002ACBF0
HKCC, xrefs: 002ACBAC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: e92196373b3b1fff090daac75d70f4df7aa04c2ff647d6ceeeffb53de24a73d3
Instruction ID: 0308359c5edd2f6637bca453fa45ada7dd316be95afbb3ee27d7f838c26584c2
Opcode Fuzzy Hash: e92196373b3b1fff090daac75d70f4df7aa04c2ff647d6ceeeffb53de24a73d3
Instruction Fuzzy Hash: 93711433A3016B8BCB20DE7CDD516BA3391AB62764F310525F8569B285EE31CDB5C7A0

Function 002B833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 002B835A
_wcslen.LIBCMT ref: 002B836E
_wcslen.LIBCMT ref: 002B8391
_wcslen.LIBCMT ref: 002B83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 002B83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,002B5BF2), ref: 002B844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 002B8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 002B84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 002B8501
FreeLibrary.KERNEL32(?), ref: 002B850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 002B851D
DestroyIcon.USER32(?,?,?,?,?,002B5BF2), ref: 002B852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 002B8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 002B8555

Strings

.icl, xrefs: 002B8368
.dll, xrefs: 002B83AB
.exe, xrefs: 002B8388

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 54b33446b62662564def0b5c342eb2409ec3ad0d983ef2662abd02a0a1bf4cc8
Instruction ID: cb9deb97ded6913efc351ce8d5696a7160a4668d1e6cfc5e19723eaa349b995d
Opcode Fuzzy Hash: 54b33446b62662564def0b5c342eb2409ec3ad0d983ef2662abd02a0a1bf4cc8
Instruction Fuzzy Hash: B361E171520216BAEB24DF64DC85BFE77ACBF04B50F604609F819E61D1DF74A9A0CBA0

Function 00227778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#OnAutoItStartRegister, xrefs: 00227817
#ce, xrefs: 002278ED
#include, xrefs: 00227847
#include-once, xrefs: 0022782F
#notrayicon, xrefs: 002277E7
", xrefs: 00265153
#pragma compile, xrefs: 002277D3
', xrefs: 00265169
Bad directive syntax error, xrefs: 0026519A
Unterminated group of comments, xrefs: 0026528C
Cannot parse #include, xrefs: 00265279
#comments-start, xrefs: 0022785F, 002278B1
#comments-end, xrefs: 002278D9
#cs, xrefs: 00227873, 002278C5
#requireadmin, xrefs: 002277FF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: ac3c842c643f9bdfb8c0c6dd8fcee91513e623c30f9cd2a5e6f156328a2d4e42
Instruction ID: 741fc19e868a800a1154f2b19e1f5fab6c86d4e170e9f9d27acb953ceb4ee0a0
Opcode Fuzzy Hash: ac3c842c643f9bdfb8c0c6dd8fcee91513e623c30f9cd2a5e6f156328a2d4e42
Instruction Fuzzy Hash: 2F812B71674226BBDB24AFA0EC42FAE7768AF16340F044025FD04AB196EB74D971CB91

Function 00293E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00293EF8
_wcslen.LIBCMT ref: 00293F03
_wcslen.LIBCMT ref: 00293F5A
_wcslen.LIBCMT ref: 00293F98
GetDriveTypeW.KERNEL32(?), ref: 00293FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0029401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00294059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00294087

Strings

wait, xrefs: 00294044
closed, xrefs: 00293F08, 00293F2D, 00293F46, 00293F7E, 00293F97
open, xrefs: 00293F54, 00293F59
type cdaudio alias cd wait, xrefs: 00294001
close, xrefs: 00293EFE, 00293F18
set cd door , xrefs: 00294028
open , xrefs: 00293FE5
close cd wait, xrefs: 00294072

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 65d2d78a7bbc8328c75434368c3e6aacc1bc765b2eddb1d90d9ef07caf1846b3
Instruction ID: 0bbeb6a16f4595526cf9cf78b9fa89d02fa84c0dcf501ebfc46ac3e97105845e
Opcode Fuzzy Hash: 65d2d78a7bbc8328c75434368c3e6aacc1bc765b2eddb1d90d9ef07caf1846b3
Instruction Fuzzy Hash: C971F3325242129FCB10EF24C88486EB7F4EFA4758F50492DF89593251EB31ED66CB91

Function 00285A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00285A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00285A40
SetWindowTextW.USER32(?,?), ref: 00285A57
GetDlgItem.USER32(?,000003EA), ref: 00285A6C
SetWindowTextW.USER32(00000000,?), ref: 00285A72
GetDlgItem.USER32(?,000003E9), ref: 00285A82
SetWindowTextW.USER32(00000000,?), ref: 00285A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00285AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00285AC3
GetWindowRect.USER32(?,?), ref: 00285ACC
_wcslen.LIBCMT ref: 00285B33
SetWindowTextW.USER32(?,?), ref: 00285B6F
GetDesktopWindow.USER32 ref: 00285B75
GetWindowRect.USER32(00000000), ref: 00285B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00285BD3
GetClientRect.USER32(?,?), ref: 00285BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00285C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00285C2F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 19c5a95b9e3358fac069529dddc6b8d4942b265bc26f86ebdcf2caa1af655448
Instruction ID: 529b90767176c0ef59b91704741c53d1b7b9e2e03344c3a34be43791f9b3e290
Opcode Fuzzy Hash: 19c5a95b9e3358fac069529dddc6b8d4942b265bc26f86ebdcf2caa1af655448
Instruction Fuzzy Hash: 7871A135911B16AFDB20EFA8CD89E6EBBF5FF48704F104618E182A25A4D770E950CF50

Function 0029FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0029FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0029FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0029FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0029FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0029FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0029FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0029FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0029FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0029FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0029FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0029FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0029FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0029FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0029FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0029FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0029FECC
GetCursorInfo.USER32(?), ref: 0029FEDC
GetLastError.KERNEL32 ref: 0029FF1E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 645b5b9bf65171aebe5d2fd6ab7384ec43061c3ce57222a9dae081df3f3b0ddf
Instruction ID: 3613e054dd643fce6f18aa7b6e1ed1a9b0861555bb2f3c57bea9ea7a3724084f
Opcode Fuzzy Hash: 645b5b9bf65171aebe5d2fd6ab7384ec43061c3ce57222a9dae081df3f3b0ddf
Instruction Fuzzy Hash: 1E4174B0D0431A6ADB50DFBA9C8985EBFE8FF04354B50452AE11DE7681DB789901CE90

Function 002830F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0028318D
_wcslen.LIBCMT ref: 002831F8

Strings

INSTANCE, xrefs: 00283453
REGEXPCLASS, xrefs: 00283255, 00283266
NAME, xrefs: 00283335, 00283346
TEXT, xrefs: 0028347C
CLASSNN, xrefs: 002831F3, 00283204
CLASS, xrefs: 00283188, 002831A5
[., xrefs: 0028339A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[.
API String ID: 176396367-1021860529
Opcode ID: 8e48f9b90d1f4e41a2ac50cb2765985782070deb08cb38d1e0b0a47221b33ef7
Instruction ID: 809bacf055c944bbc15e124bfe72ef5ffd73b62e0ed9790e4c873b07d9597be8
Opcode Fuzzy Hash: 8e48f9b90d1f4e41a2ac50cb2765985782070deb08cb38d1e0b0a47221b33ef7
Instruction Fuzzy Hash: 89E10936A31526ABCB18EFB8C4517EDF7B0BF44B10F544119E856F7280DB70AE658B90

Function 002400C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 002400C6

Part of subcall function 002400ED: InitializeCriticalSectionAndSpinCount.KERNEL32(002F070C,00000FA0,B42CE972,?,?,?,?,002623B3,000000FF), ref: 0024011C
Part of subcall function 002400ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,002623B3,000000FF), ref: 00240127
Part of subcall function 002400ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,002623B3,000000FF), ref: 00240138
Part of subcall function 002400ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0024014E
Part of subcall function 002400ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0024015C
Part of subcall function 002400ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0024016A
Part of subcall function 002400ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00240195
Part of subcall function 002400ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 002401A0

___scrt_fastfail.LIBCMT ref: 002400E7

Part of subcall function 002400A3: __onexit.LIBCMT ref: 002400A9

Strings

SleepConditionVariableCS, xrefs: 00240154
InitializeConditionVariable, xrefs: 00240148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00240122
WakeAllConditionVariable, xrefs: 00240162
kernel32.dll, xrefs: 00240133

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: c8958ebd4eb84733be8e6fa2321416e489ea00d9a57417f03897387bfa5b3628
Instruction ID: c9a01f6c4258b6ce16ac58047e2b5780d750e04336441007ec5f5fe43050e672
Opcode Fuzzy Hash: c8958ebd4eb84733be8e6fa2321416e489ea00d9a57417f03897387bfa5b3628
Instruction Fuzzy Hash: 85213B32A747026BD7146F68BDCDB697394DF05FA1F100235FA09A2292DB709C608EA0

Function 002944C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,002BCC08), ref: 00294527
_wcslen.LIBCMT ref: 0029453B
_wcslen.LIBCMT ref: 00294599
_wcslen.LIBCMT ref: 002945F4
_wcslen.LIBCMT ref: 0029463F
_wcslen.LIBCMT ref: 002946A7

Part of subcall function 0023F9F2: _wcslen.LIBCMT ref: 0023F9FD

GetDriveTypeW.KERNEL32(?,002E6BF0,00000061), ref: 00294743

Strings

cdrom, xrefs: 0029458F, 00294594
network, xrefs: 0029469D, 002946A2
unknown, xrefs: 00294708
ramdisk, xrefs: 002946F1
all, xrefs: 00294531, 00294536
fixed, xrefs: 00294635, 0029463A
removable, xrefs: 002945EA, 002945EF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 5251bacb2c048b2fd27ea2171918a3f3aa03e9cb31f03d828eb1a2ed21c8f2c6
Instruction ID: ab71dbed23d6fd667a868fb1c79d0a25178741edf3ed74783a386f310affc5d8
Opcode Fuzzy Hash: 5251bacb2c048b2fd27ea2171918a3f3aa03e9cb31f03d828eb1a2ed21c8f2c6
Instruction Fuzzy Hash: B9B123716283029FCB10EF28D890E6EB7E4BFA5764F90491DF496C7291D730D866CB52

Function 002B911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

DragQueryPoint.SHELL32(?,?), ref: 002B9147

Part of subcall function 002B7674: ClientToScreen.USER32(?,?), ref: 002B769A
Part of subcall function 002B7674: GetWindowRect.USER32(?,?), ref: 002B7710
Part of subcall function 002B7674: PtInRect.USER32(?,?,002B8B89), ref: 002B7720

SendMessageW.USER32(?,000000B0,?,?), ref: 002B91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 002B91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 002B91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 002B9225
SendMessageW.USER32(?,000000B0,?,?), ref: 002B923E
SendMessageW.USER32(?,000000B1,?,?), ref: 002B9255
SendMessageW.USER32(?,000000B1,?,?), ref: 002B9277
DragFinish.SHELL32(?), ref: 002B927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 002B9371

Strings

@GUI_DROPID, xrefs: 002B929E
@GUI_DRAGID, xrefs: 002B92E9
p#/, xrefs: 002B92BB
@GUI_DRAGFILE, xrefs: 002B9320

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#/
API String ID: 221274066-3684176132
Opcode ID: 4716acce7d05f6f2dc59a30c043e02556dbf5001c7654db37e38f148fe8bb498
Instruction ID: d8ddcf123893cb663d5ef5bb5a6422e1cad9ba36348bbb63e56977c15662a386
Opcode Fuzzy Hash: 4716acce7d05f6f2dc59a30c043e02556dbf5001c7654db37e38f148fe8bb498
Instruction Fuzzy Hash: 47618E71118301AFC705DF50EC89DAFBBE8EF89390F500A2EF691931A0DB709A59CB52

Function 0022326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(002F1990), ref: 00262F8D
GetMenuItemCount.USER32(002F1990), ref: 0026303D
GetCursorPos.USER32(?), ref: 00263081
SetForegroundWindow.USER32(00000000), ref: 0026308A
TrackPopupMenuEx.USER32(002F1990,00000000,?,00000000,00000000,00000000), ref: 0026309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 002630A9

Strings

0, xrefs: 0022327D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 7f7ba20602370c0421fa941deeb7c3b8a28e10050b1e95c36ca3bb93eceb4ab1
Instruction ID: 3115e936ab1305f529814d7a0f3706734c7ce55f971a8837ec9e5542b98b5a94
Opcode Fuzzy Hash: 7f7ba20602370c0421fa941deeb7c3b8a28e10050b1e95c36ca3bb93eceb4ab1
Instruction Fuzzy Hash: FE711430650216FEEB218F64DC49FAABF69FF04364F200216F9246A1E0C7B1AD74CB90

Function 002B6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 002B6DEB

Part of subcall function 00226B57: _wcslen.LIBCMT ref: 00226B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 002B6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 002B6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 002B6E94
DestroyWindow.USER32(?), ref: 002B6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00220000,00000000), ref: 002B6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 002B6EFD
GetDesktopWindow.USER32 ref: 002B6F16
GetWindowRect.USER32(00000000), ref: 002B6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 002B6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 002B6F4D

Part of subcall function 00239944: GetWindowLongW.USER32(?,000000EB), ref: 00239952

Strings

0, xrefs: 002B6D98
tooltips_class32, xrefs: 002B6E58, 002B6EDD

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 773c8ee8b0b95d84537a95a4f25ed62c2f08a9c41bcf782e18a878f62d916fae
Instruction ID: 8e5565685fcabaa9ad3f7cbe4aa4268994412c770d2c7c44c1418c7fb357417d
Opcode Fuzzy Hash: 773c8ee8b0b95d84537a95a4f25ed62c2f08a9c41bcf782e18a878f62d916fae
Instruction Fuzzy Hash: 39719771510241AFDB24CF28EC48FBABBE9FB89344F54052DF98987261C7B4E925CB11

Function 0029C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0029C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0029C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0029C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0029C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0029C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0029C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0029C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0029C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0029C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0029C5F0
InternetCloseHandle.WININET(00000000), ref: 0029C5FB

Strings

, xrefs: 0029C575

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 674060b9e742f9099b9b02726f82a59459f87d2fe46d72ce55fc07be75fa50b2
Instruction ID: 49f83fcdcc18e4b183a47bc1a52de9bcadba39675e2a3eb17faf5d2315f6315b
Opcode Fuzzy Hash: 674060b9e742f9099b9b02726f82a59459f87d2fe46d72ce55fc07be75fa50b2
Instruction Fuzzy Hash: 36516CB0510209BFEF218F60DD88AAB7BFCFF08754F60451AF946A6210DB70E954EB60

Function 002B856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 002B8592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002B85A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002B85AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002B85BA
GlobalLock.KERNEL32(00000000), ref: 002B85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002B85D7
GlobalUnlock.KERNEL32(00000000), ref: 002B85E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002B85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002B85F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,002BFC38,?), ref: 002B8611
GlobalFree.KERNEL32(00000000), ref: 002B8621
GetObjectW.GDI32(?,00000018,?), ref: 002B8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 002B8671
DeleteObject.GDI32(?), ref: 002B8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 002B86AF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: a1833225157e91772fcb6e58b833b8654e035b88ff921ec339fcdf01d6104310
Instruction ID: 22716f3e4dc177cd790d759b38b3188087caa130c95e2be5730dc1f8aadc7d2c
Opcode Fuzzy Hash: a1833225157e91772fcb6e58b833b8654e035b88ff921ec339fcdf01d6104310
Instruction Fuzzy Hash: 30411975610205AFDB119FA5DC4CEAA7BBCEF89751F204159F909E7260DB70AD01CF60

Function 002914BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00291502
VariantCopy.OLEAUT32(?,?), ref: 0029150B
VariantClear.OLEAUT32(?), ref: 00291517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 002915FB
VarR8FromDec.OLEAUT32(?,?), ref: 00291657
VariantInit.OLEAUT32(?), ref: 00291708
SysFreeString.OLEAUT32(?), ref: 0029178C
VariantClear.OLEAUT32(?), ref: 002917D8
VariantClear.OLEAUT32(?), ref: 002917E7
VariantInit.OLEAUT32(00000000), ref: 00291823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00291625
Default, xrefs: 002916AF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: ffb52b6b3cbab24caf3c61d7dd97b11759749fffd40b2480d08a82e1c6b5e5d9
Instruction ID: f2a3e343ab19986ae1806194f9e28e29dff33a1f36bf03c86012777b678c2306
Opcode Fuzzy Hash: ffb52b6b3cbab24caf3c61d7dd97b11759749fffd40b2480d08a82e1c6b5e5d9
Instruction Fuzzy Hash: 9BD10171A20116EBDF009FA6E888B79B7B5BF45700F628066F446AB290DB70DC71DB61

Function 002AB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 002AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,002AB6AE,?,?), ref: 002AC9B5
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002AC9F1
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002ACA68
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002AB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002AB772
RegDeleteValueW.ADVAPI32(?,?), ref: 002AB80A
RegCloseKey.ADVAPI32(?), ref: 002AB87E
RegCloseKey.ADVAPI32(?), ref: 002AB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 002AB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 002AB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 002AB922
FreeLibrary.KERNEL32(00000000), ref: 002AB983
RegCloseKey.ADVAPI32(00000000), ref: 002AB994

Strings

RegDeleteKeyExW, xrefs: 002AB8FE
advapi32.dll, xrefs: 002AB8ED

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: db40da90fd6d3bef39b04b0d4dd4046c774822d20fe3c7df0b228fb098f98e82
Instruction ID: 3ee6592d38b5011d69d69267e0f8794c66d489e0a820a801d2559a272ee4fccb
Opcode Fuzzy Hash: db40da90fd6d3bef39b04b0d4dd4046c774822d20fe3c7df0b228fb098f98e82
Instruction Fuzzy Hash: 1FC1AC31228202AFC711DF54C494F2ABBE5BF85308F24859CF49A4B6A2CB75EC55CF91

Function 002A255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 002A25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 002A25E8
CreateCompatibleDC.GDI32(?), ref: 002A25F4
SelectObject.GDI32(00000000,?), ref: 002A2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 002A266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 002A26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 002A26D0
SelectObject.GDI32(?,?), ref: 002A26D8
DeleteObject.GDI32(?), ref: 002A26E1
DeleteDC.GDI32(?), ref: 002A26E8
ReleaseDC.USER32(00000000,?), ref: 002A26F3

Strings

(, xrefs: 002A268D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 8e602b5d6ad8da51616cc6d6246cb5262f680480fcba167aa5152aab449d6284
Instruction ID: 4713a2d7f0e57a520ae8de9e47aec1deaf4f97b6a81658ac73c571873318aa0e
Opcode Fuzzy Hash: 8e602b5d6ad8da51616cc6d6246cb5262f680480fcba167aa5152aab449d6284
Instruction Fuzzy Hash: C461E375D10219EFCF04CFA8D984EAEBBB9FF48710F208529E955A7250D770A951CF60

Function 0025DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0025DAA1

Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D659
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D66B
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D67D
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D68F
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D6A1
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D6B3
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D6C5
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D6D7
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D6E9
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D6FB
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D70D
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D71F
Part of subcall function 0025D63C: _free.LIBCMT ref: 0025D731

_free.LIBCMT ref: 0025DA96

Part of subcall function 002529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000), ref: 002529DE
Part of subcall function 002529C8: GetLastError.KERNEL32(00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000,00000000), ref: 002529F0

_free.LIBCMT ref: 0025DAB8
_free.LIBCMT ref: 0025DACD
_free.LIBCMT ref: 0025DAD8
_free.LIBCMT ref: 0025DAFA
_free.LIBCMT ref: 0025DB0D
_free.LIBCMT ref: 0025DB1B
_free.LIBCMT ref: 0025DB26
_free.LIBCMT ref: 0025DB5E
_free.LIBCMT ref: 0025DB65
_free.LIBCMT ref: 0025DB82
_free.LIBCMT ref: 0025DB9A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5e359d7abdf3545672e52669d754ada047806dc6aeebff6a1698882669f3204f
Instruction ID: cc363d0aac93c390edd61f6b1394b54e14642b04fe233f52b015fc7bc7ce91b6
Opcode Fuzzy Hash: 5e359d7abdf3545672e52669d754ada047806dc6aeebff6a1698882669f3204f
Instruction Fuzzy Hash: 6E315C31664306DFEB31AE39E845B9677E9FF01312F215419E848E7291DE31EC68CB28

Function 0028365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0028369C
_wcslen.LIBCMT ref: 002836A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00283797
GetClassNameW.USER32(?,?,00000400), ref: 0028380C
GetDlgCtrlID.USER32(?), ref: 0028385D
GetWindowRect.USER32(?,?), ref: 00283882
GetParent.USER32(?), ref: 002838A0
ScreenToClient.USER32(00000000), ref: 002838A7
GetClassNameW.USER32(?,?,00000100), ref: 00283921
GetWindowTextW.USER32(?,?,00000400), ref: 0028395D

Strings

%s%u, xrefs: 00283734

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 258a0a0e3467506a4be5b6233c5c685741209fd71edb3111902acf643c738d83
Instruction ID: b9a207b18d4bc93e2ca65e27b5e8ea3eaafceedbe0bf684d89876fec08457486
Opcode Fuzzy Hash: 258a0a0e3467506a4be5b6233c5c685741209fd71edb3111902acf643c738d83
Instruction Fuzzy Hash: 5591D575215617AFD709EF24C884FAAF7A8FF44710F004619F999C21D0DB70EA65CB91

Function 00284954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00284994
GetWindowTextW.USER32(?,?,00000400), ref: 002849DA
_wcslen.LIBCMT ref: 002849EB
CharUpperBuffW.USER32(?,00000000), ref: 002849F7
_wcsstr.LIBVCRUNTIME ref: 00284A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00284A64
GetWindowTextW.USER32(?,?,00000400), ref: 00284A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00284AE6
GetClassNameW.USER32(?,?,00000400), ref: 00284B20
GetWindowRect.USER32(?,?), ref: 00284B8B

Strings

ThumbnailClass, xrefs: 00284A6F, 00284AF1

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 508ffd7a93c037e10da4d5ca6f7e590a6473334f402156923d28cdfdee16c5ee
Instruction ID: 73a0a57b68d8dad686b2c7069abf6fee23e31569259ef294bc154726d85269a9
Opcode Fuzzy Hash: 508ffd7a93c037e10da4d5ca6f7e590a6473334f402156923d28cdfdee16c5ee
Instruction Fuzzy Hash: B391BE354262079BDB08FF14C885FAA77A8FF84308F04446AFD859A0D6DB30ED65CBA1

Function 002B8D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 002B8D5A
GetFocus.USER32 ref: 002B8D6A
GetDlgCtrlID.USER32(00000000), ref: 002B8D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 002B8E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 002B8ECF
GetMenuItemCount.USER32(?), ref: 002B8EEC
GetMenuItemID.USER32(?,00000000), ref: 002B8EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 002B8F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 002B8F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 002B8FA1

Strings

0, xrefs: 002B8E9F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 456a2418c971f1644269f5322956e04cadfa45472253c04bf831df5771b11a73
Instruction ID: 76a8fff3fa3f85ef73d866a88bda5d0f05129b7d1e123ac0e79b1bf0393c4d36
Opcode Fuzzy Hash: 456a2418c971f1644269f5322956e04cadfa45472253c04bf831df5771b11a73
Instruction Fuzzy Hash: 0C8181715243029FDB10CF24D884ABBB7EDFF88794F140619F99997291DB70D921CBA2

Function 0028BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(002F1990,000000FF,00000000,00000030), ref: 0028BFAC
SetMenuItemInfoW.USER32(002F1990,00000004,00000000,00000030), ref: 0028BFE1
Sleep.KERNEL32(000001F4), ref: 0028BFF3
GetMenuItemCount.USER32(?), ref: 0028C039
GetMenuItemID.USER32(?,00000000), ref: 0028C056
GetMenuItemID.USER32(?,-00000001), ref: 0028C082
GetMenuItemID.USER32(?,?), ref: 0028C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0028C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0028C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0028C145

Strings

0, xrefs: 0028BF3D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: c1e70b4938536b5d5d7d5815b236f681a4e3ba2f4a764bfe4487e23e442ace72
Instruction ID: 1156bde7537b7c0cd1af287961ed2e3990643aa5c8193a7e7545e1cd2f917c13
Opcode Fuzzy Hash: c1e70b4938536b5d5d7d5815b236f681a4e3ba2f4a764bfe4487e23e442ace72
Instruction Fuzzy Hash: 4961B0B4921246AFDF11EF64DC88EAE7BA8EB05344F604159F815A32C2C775AD24CB70

Function 0028DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0028DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0028DC46
_wcslen.LIBCMT ref: 0028DC50
_wcsstr.LIBVCRUNTIME ref: 0028DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0028DCBC

Strings

StringFileInfo\, xrefs: 0028DC8F
\VarFileInfo\Translation, xrefs: 0028DCB4
DefaultLangCodepage, xrefs: 0028DD1F
04090000, xrefs: 0028DCF2
%u.%u.%u.%u, xrefs: 0028DD9A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 3a2bea0fa0d91ef167cb855433148296d32f7f1753b0b5aa487d4c1fa003f75d
Instruction ID: de9f9636b8bd2e1a658b88d7b83b0d9040f8cdb32682c42ecdf261d9f2a16449
Opcode Fuzzy Hash: 3a2bea0fa0d91ef167cb855433148296d32f7f1753b0b5aa487d4c1fa003f75d
Instruction Fuzzy Hash: 914115729602017ADB18BB75EC07EFF776CEF56750F10006AF900A61C2EBB099359BA5

Function 002ACC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 002ACC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 002ACC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 002ACD48

Part of subcall function 002ACC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 002ACCAA
Part of subcall function 002ACC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 002ACCBD
Part of subcall function 002ACC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 002ACCCF
Part of subcall function 002ACC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 002ACD05
Part of subcall function 002ACC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 002ACD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 002ACCF3

Strings

RegDeleteKeyExW, xrefs: 002ACCC9
advapi32.dll, xrefs: 002ACCB8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 3c01e8716be01b4be0c754cb18a33d7007375db93e96ac92fed530a05c4d8cb7
Instruction ID: 51c3bd3c4c6b38ef0c99c65f9b1dd594a3295cbb05726b9493cd05766778bb85
Opcode Fuzzy Hash: 3c01e8716be01b4be0c754cb18a33d7007375db93e96ac92fed530a05c4d8cb7
Instruction Fuzzy Hash: 79318C71911129BBDB209F95EC8CEFFBB7CEF16750F200565B906E2240DB709A45AAB0

Function 00293D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00293D40
_wcslen.LIBCMT ref: 00293D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00293D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00293DBE
RemoveDirectoryW.KERNEL32(?), ref: 00293DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00293E55
CloseHandle.KERNEL32(00000000), ref: 00293E60
CloseHandle.KERNEL32(00000000), ref: 00293E6B

Strings

:, xrefs: 00293D82
\, xrefs: 00293D77
\??\%s, xrefs: 00293D5B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 6eb884103f28c7c77fc274bcbf3785e1f322be785565959ca5798eb4e706a6fc
Instruction ID: e941c6e22859fa85db196f8804fd3181b07785218ada554557118d562abe63f4
Opcode Fuzzy Hash: 6eb884103f28c7c77fc274bcbf3785e1f322be785565959ca5798eb4e706a6fc
Instruction Fuzzy Hash: 5331907592420AABDB20DFA0DC49FEB37BCEF89700F6041B5F919D6060EB7097548B24

Function 0028E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0028E6B4

Part of subcall function 0023E551: timeGetTime.WINMM(?,?,0028E6D4), ref: 0023E555

Sleep.KERNEL32(0000000A), ref: 0028E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0028E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0028E727
SetActiveWindow.USER32 ref: 0028E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0028E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0028E773
Sleep.KERNEL32(000000FA), ref: 0028E77E
IsWindow.USER32 ref: 0028E78A
EndDialog.USER32(00000000), ref: 0028E79B

Strings

BUTTON, xrefs: 0028E719

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 0a42e3339b5fc10cf46efeb5e677e7b93f11c7dcc7d8434ad8df7932b5277dbc
Instruction ID: 5f800751e052b6140dd6cd7d17e31e2b967e30df770b9b2fb27c6e68dc37a0d7
Opcode Fuzzy Hash: 0a42e3339b5fc10cf46efeb5e677e7b93f11c7dcc7d8434ad8df7932b5277dbc
Instruction Fuzzy Hash: BC2179B8221215EFFB106F20FC8DA367B6DA756B98B610435F905D21E1DAA1AC24DB24

Function 0028E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0028EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0028EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0028EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0028EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0028EAA7

Strings

play PlayMe wait, xrefs: 0028EA91
status PlayMe mode, xrefs: 0028EA58
close PlayMe, xrefs: 0028EA6E, 0028EA9B
alias PlayMe, xrefs: 0028EA36
play PlayMe, xrefs: 0028EAA2
open , xrefs: 0028EA0C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 786c22340d452abd149ed745e8be8629101d44575f04f9700cd0ec1469bdb774
Instruction ID: eccba4a3d8e0f692c1fc0de5f9e687a5671f00371925e6f301505242dcbeae93
Opcode Fuzzy Hash: 786c22340d452abd149ed745e8be8629101d44575f04f9700cd0ec1469bdb774
Instruction Fuzzy Hash: 9C1177356B126979D724F7A6EC4EDFF6A7CEBD2F40F400425B401A20D1DE700965CAB0

Function 00289F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0028A012
SetKeyboardState.USER32(?), ref: 0028A07D
GetAsyncKeyState.USER32(000000A0), ref: 0028A09D
GetKeyState.USER32(000000A0), ref: 0028A0B4
GetAsyncKeyState.USER32(000000A1), ref: 0028A0E3
GetKeyState.USER32(000000A1), ref: 0028A0F4
GetAsyncKeyState.USER32(00000011), ref: 0028A120
GetKeyState.USER32(00000011), ref: 0028A12E
GetAsyncKeyState.USER32(00000012), ref: 0028A157
GetKeyState.USER32(00000012), ref: 0028A165
GetAsyncKeyState.USER32(0000005B), ref: 0028A18E
GetKeyState.USER32(0000005B), ref: 0028A19C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: a02c46f7d07b243bfe4eb42bbdbe4bc962b3e0b3e143dbad9baa38228f03b8c5
Instruction ID: be77599590e2c34fa94a8d6ef42d3d0801151f0256b479f4a4b663576e656e53
Opcode Fuzzy Hash: a02c46f7d07b243bfe4eb42bbdbe4bc962b3e0b3e143dbad9baa38228f03b8c5
Instruction Fuzzy Hash: 14513B2891638929FB35FF6088147EABFB49F11340F0C458FD5C6575C2EE54AA9CCB62

Function 00285CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00285CE2
GetWindowRect.USER32(00000000,?), ref: 00285CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00285D59
GetDlgItem.USER32(?,00000002), ref: 00285D69
GetWindowRect.USER32(00000000,?), ref: 00285D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00285DCF
GetDlgItem.USER32(?,000003E9), ref: 00285DDD
GetWindowRect.USER32(00000000,?), ref: 00285DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00285E31
GetDlgItem.USER32(?,000003EA), ref: 00285E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00285E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00285E67

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 71438245dca7cabf988f6807b20b4a63a7ea3d34303dd3e4b9df826ac19b45ec
Instruction ID: 41591889a21f2fc3c435bc06e43c9701e973650a0eca7b0c46ca1a38f98178e7
Opcode Fuzzy Hash: 71438245dca7cabf988f6807b20b4a63a7ea3d34303dd3e4b9df826ac19b45ec
Instruction Fuzzy Hash: F4513074B10615AFDF18DF68DD89AAEBBB9FB48310F248229F915E7290D7709E10CB50

Function 00238BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00238F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00238BE8,?,00000000,?,?,?,?,00238BBA,00000000,?), ref: 00238FC5

DestroyWindow.USER32(?), ref: 00238C81
KillTimer.USER32(00000000,?,?,?,?,00238BBA,00000000,?), ref: 00238D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00276973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00238BBA,00000000,?), ref: 002769A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00238BBA,00000000,?), ref: 002769B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00238BBA,00000000), ref: 002769D4
DeleteObject.GDI32(00000000), ref: 002769E6

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 59503de27329a3d9203e0beae9fc678bb7bb6225fd994e5006e7be1c1a8112ce
Instruction ID: 83bbaf334f6b595101ce52677e8690aa0bc96fda20cf2b5adcdfed7ba1025bac
Opcode Fuzzy Hash: 59503de27329a3d9203e0beae9fc678bb7bb6225fd994e5006e7be1c1a8112ce
Instruction Fuzzy Hash: 69619E70521B01DFDB299F24E94CB25B7F1FB40362F649929E0469B560CBB1A9B0CF90

Function 00239838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00239944: GetWindowLongW.USER32(?,000000EB), ref: 00239952

GetSysColor.USER32(0000000F), ref: 00239862

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 7329b884cf8b849d790e9626633999e0172e7e2d3618d6f101bb5e5672915ead
Instruction ID: 35384f9b0cff17c89b35e06de7aac5994482b882b49082fcf2de484b3bc1632b
Opcode Fuzzy Hash: 7329b884cf8b849d790e9626633999e0172e7e2d3618d6f101bb5e5672915ead
Instruction Fuzzy Hash: 4C41E471124640AFDB205F3CAC88BBA3BA5EB47330F644615F9A6972E1C7B19CA1DF10

Function 00258D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.$, xrefs: 0025903A, 00258FD0, 00258FF2

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: .$
API String ID: 0-2510666271
Opcode ID: e8f437747c7193994fc20e9700afa02a89a69d1d37d591385a9be8c9a42c8ee4
Instruction ID: 874f730ab4869b4827d9bb45af7d4b017276759bea8aad0a23a649aef0c086f6
Opcode Fuzzy Hash: e8f437747c7193994fc20e9700afa02a89a69d1d37d591385a9be8c9a42c8ee4
Instruction Fuzzy Hash: 57C1F27492424AEFCF11DFA8D845BBDBBB0AF49311F144199EC14A7392C7B08999CF64

Function 002896E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0026F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00289717
LoadStringW.USER32(00000000,?,0026F7F8,00000001), ref: 00289720

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0026F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00289742
LoadStringW.USER32(00000000,?,0026F7F8,00000001), ref: 00289745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00289866

Strings

^ ERROR, xrefs: 002897FB
Error: , xrefs: 0028981D
Line %d:, xrefs: 002897A0
Line %d (File "%s"):, xrefs: 0028978F
%s (%d) : ==> %s: %s %s, xrefs: 0028984A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: e7971bd775551b84fa760fcc6879ff7af0c308c2f44604edd9431d936f50fd23
Instruction ID: ca83f0b7067acf48dc89c5d7b2c4e23af2a381e6a484085d890d7b2d4ae4c1d2
Opcode Fuzzy Hash: e7971bd775551b84fa760fcc6879ff7af0c308c2f44604edd9431d936f50fd23
Instruction Fuzzy Hash: 03414F72820219BACB14FBE0EE46DEEB778AF15740F640465F50572092EB356FA8CF61

Function 002806DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00226B57: _wcslen.LIBCMT ref: 00226B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 002807A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 002807BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 002807DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00280804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0028082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00280837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0028083C

Strings

\IPC$, xrefs: 00280784
\CLSID, xrefs: 00280724
SOFTWARE\Classes\, xrefs: 0028070E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 68c5732795f50771f58405adaf8c1541443d97f0de8424f0c73e39dff043f5ab
Instruction ID: c59c83063603291e62e3d06b149e64c1270b94a13385f31e8892a36ceb6e01ae
Opcode Fuzzy Hash: 68c5732795f50771f58405adaf8c1541443d97f0de8424f0c73e39dff043f5ab
Instruction Fuzzy Hash: 4A411976C20229ABDF15EFE4EC858EDB778BF04350F544569E901A31A1EB305E68CFA0

Function 002B3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 002B403B
CreateCompatibleDC.GDI32(00000000), ref: 002B4042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 002B4055
SelectObject.GDI32(00000000,00000000), ref: 002B405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 002B4068
DeleteDC.GDI32(00000000), ref: 002B4072
GetWindowLongW.USER32(?,000000EC), ref: 002B407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 002B4092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 002B409E

Strings

static, xrefs: 002B3FD3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: ba9025bbc4ee9895bdca656a264c0ffacf9a4d2a80bbe5e237932b71fb4a8def
Instruction ID: 9e34c487697e2a535a1bdf1f7b5fcbbeed447b58eec2207b22faa69d3eb59675
Opcode Fuzzy Hash: ba9025bbc4ee9895bdca656a264c0ffacf9a4d2a80bbe5e237932b71fb4a8def
Instruction Fuzzy Hash: 44316E32511216ABDF21AFA8DC49FEA3B68FF0D364F110311FA58E61A1C775D860DB64

Function 002A3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002A3C5C
CoInitialize.OLE32(00000000), ref: 002A3C8A
CoUninitialize.OLE32 ref: 002A3C94
_wcslen.LIBCMT ref: 002A3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 002A3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 002A3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 002A3F0E
CoGetObject.OLE32(?,00000000,002BFB98,?), ref: 002A3F2D
SetErrorMode.KERNEL32(00000000), ref: 002A3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 002A3FC4
VariantClear.OLEAUT32(?), ref: 002A3FD8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 812da2aaa237ddddca9ec6001d560d73bb7dae9e2cb9d1d2b9402ac1649fa555
Instruction ID: e3cfbafe991a512884eacc70a386e1a35c8af412f64a84147195f433cf332a1f
Opcode Fuzzy Hash: 812da2aaa237ddddca9ec6001d560d73bb7dae9e2cb9d1d2b9402ac1649fa555
Instruction Fuzzy Hash: E3C13471628305AFD700DF68C88492BB7E9FF8A748F10491DF98A9B250DB70EE15CB52

Function 00297A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00297AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00297B8F
SHGetDesktopFolder.SHELL32(?), ref: 00297BA3
CoCreateInstance.OLE32(002BFD08,00000000,00000001,002E6E6C,?), ref: 00297BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00297C74
CoTaskMemFree.OLE32(?,?), ref: 00297CCC
SHBrowseForFolderW.SHELL32(?), ref: 00297D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00297D7A
CoTaskMemFree.OLE32(00000000), ref: 00297D81
CoTaskMemFree.OLE32(00000000), ref: 00297DD6
CoUninitialize.OLE32 ref: 00297DDC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 1e206332b882d39f1f9e0f9078e3974ced19bc7bbc98494ce2617264345123e2
Instruction ID: 171bf87b90cfab1780f1d392e4670d97d6a28fec6dba28946a3a4a973f2ce35a
Opcode Fuzzy Hash: 1e206332b882d39f1f9e0f9078e3974ced19bc7bbc98494ce2617264345123e2
Instruction Fuzzy Hash: 16C14A75A14119AFCB14DFA4D888DAEBBF9FF48304B1485A9F8199B261C730EE51CF90

Function 002B541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 002B5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002B5515
CharNextW.USER32(00000158), ref: 002B5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 002B5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 002B559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002B55AC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: ef130d6fc531c4c31a05e91f71d324e09a4fbe66074e3e661dd7bf9c64defe09
Instruction ID: d68a40f96fcfd6cd4ced73f7f2fc94b63ed827b29009fb3ea618c2d3decb9ba3
Opcode Fuzzy Hash: ef130d6fc531c4c31a05e91f71d324e09a4fbe66074e3e661dd7bf9c64defe09
Instruction Fuzzy Hash: E361B030920629EFDF209F54DC84EFE7B79EB093A1F104145F625AA290D7B49AA0DB60

Function 0027FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0027FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0027FB08
VariantInit.OLEAUT32(?), ref: 0027FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0027FB3A
VariantCopy.OLEAUT32(?,?), ref: 0027FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0027FBA1
VariantClear.OLEAUT32(?), ref: 0027FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0027FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0027FBCC
VariantClear.OLEAUT32(?), ref: 0027FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0027FBE9

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 25300ef7deb80c69273d8a2e05300b9e47d78784fbb7b7e8fec0b84f6c78a6b4
Instruction ID: c03469000f845ecabd229c0e7a51ba7cd26799943b24910aae6de9d3dafe4c8e
Opcode Fuzzy Hash: 25300ef7deb80c69273d8a2e05300b9e47d78784fbb7b7e8fec0b84f6c78a6b4
Instruction Fuzzy Hash: AE418335A14219EFCF00DFA4D9589AEBBB9FF08344F10C065E959A7261DB30EA55CFA0

Function 00289C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00289CA1
GetAsyncKeyState.USER32(000000A0), ref: 00289D22
GetKeyState.USER32(000000A0), ref: 00289D3D
GetAsyncKeyState.USER32(000000A1), ref: 00289D57
GetKeyState.USER32(000000A1), ref: 00289D6C
GetAsyncKeyState.USER32(00000011), ref: 00289D84
GetKeyState.USER32(00000011), ref: 00289D96
GetAsyncKeyState.USER32(00000012), ref: 00289DAE
GetKeyState.USER32(00000012), ref: 00289DC0
GetAsyncKeyState.USER32(0000005B), ref: 00289DD8
GetKeyState.USER32(0000005B), ref: 00289DEA

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 689eb01cb751a86551c6a7049d6d78dd46728c4cf84164eca33c12fac9f6cc95
Instruction ID: b192b43b97eca29978e676b529687d51db49457a42a646491d02dfdea9449d15
Opcode Fuzzy Hash: 689eb01cb751a86551c6a7049d6d78dd46728c4cf84164eca33c12fac9f6cc95
Instruction Fuzzy Hash: 274108385157CB6DFF30BF64C8043B5BEA0AB15304F4C805ADAC2565C2D7A5A9E4C796

Function 002A055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 002A05BC
inet_addr.WSOCK32(?), ref: 002A061C
gethostbyname.WSOCK32(?), ref: 002A0628
IcmpCreateFile.IPHLPAPI ref: 002A0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 002A06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 002A06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 002A07B9
WSACleanup.WSOCK32 ref: 002A07BF

Strings

Ping, xrefs: 002A0676

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 9ae602c9335aaa265a792af39c59c6e681cd9e8352a865503d92a83c1b9a1c59
Instruction ID: af0951451650d66957e3daf3b83457e8202cd9596d235145c94073504df1c1c4
Opcode Fuzzy Hash: 9ae602c9335aaa265a792af39c59c6e681cd9e8352a865503d92a83c1b9a1c59
Instruction Fuzzy Hash: DC919E75524202AFD320CF15D8C8F1ABBE4AF49318F1485A9F46A9B6A2CB70FC55CF91

Function 002A8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 002A8CF3

Part of subcall function 00288E54: _wcslen.LIBCMT ref: 00288E77

_wcslen.LIBCMT ref: 002A8D4E
_wcslen.LIBCMT ref: 002A8D9C
_wcslen.LIBCMT ref: 002A8DDC
_wcslen.LIBCMT ref: 002A8E6E

Strings

none, xrefs: 002A8E65, 002A8E6A
winapi, xrefs: 002A8D96, 002A8D9B
stdcall, xrefs: 002A8DD6, 002A8DDB
cdecl, xrefs: 002A8D48, 002A8D4D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 216ed26f933c761386fde4efa8008e341ed429cae4bdeee618301330afc97090
Instruction ID: aaba70c24c6c216605dc69bf60f66277e5ffec818d6c8c1dd13bd2dd5a6c8678
Opcode Fuzzy Hash: 216ed26f933c761386fde4efa8008e341ed429cae4bdeee618301330afc97090
Instruction Fuzzy Hash: 0A519131A20517DBCF14EF68C9409BEB7A5BF66724B604229F426E7284EF30DD60CB90

Function 002A372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 002A3774
CoUninitialize.OLE32 ref: 002A377F
CoCreateInstance.OLE32(?,00000000,00000017,002BFB78,?), ref: 002A37D9
IIDFromString.OLE32(?,?), ref: 002A384C
VariantInit.OLEAUT32(?), ref: 002A38E4
VariantClear.OLEAUT32(?), ref: 002A3936

Strings

NULL Pointer assignment, xrefs: 002A381E
Failed to create object, xrefs: 002A37E4, 002A389A
Invalid parameter, xrefs: 002A3865

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: ce15242e7cf3874b30e4011e7fe78a9d6efe2537adf4f79e0f026608b28d4c8e
Instruction ID: 4192385f4decce3f9e6b53b326f4705d4c3cd035348c748d7d76b8303bdc8175
Opcode Fuzzy Hash: ce15242e7cf3874b30e4011e7fe78a9d6efe2537adf4f79e0f026608b28d4c8e
Instruction Fuzzy Hash: BB61C170628312AFD311DF54D888F6AB7E4EF4A714F10091DF9859B291CB74EE68CB92

Function 002B8B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

Part of subcall function 0023912D: GetCursorPos.USER32(?), ref: 00239141
Part of subcall function 0023912D: ScreenToClient.USER32(00000000,?), ref: 0023915E
Part of subcall function 0023912D: GetAsyncKeyState.USER32(00000001), ref: 00239183
Part of subcall function 0023912D: GetAsyncKeyState.USER32(00000002), ref: 0023919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 002B8B6B
ImageList_EndDrag.COMCTL32 ref: 002B8B71
ReleaseCapture.USER32 ref: 002B8B77
SetWindowTextW.USER32(?,00000000), ref: 002B8C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 002B8C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 002B8CFF

Strings

@GUI_DROPID, xrefs: 002B8C51
@GUI_DRAGFILE, xrefs: 002B8C9A
p#/, xrefs: 002B8C71

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$p#/
API String ID: 1924731296-3612742004
Opcode ID: 3526746ace176bc4198365df2d89fc15905c2b6a10e5c3daddffd75ed5a8ac01
Instruction ID: 1624bac9635f11297344d03e0156f4157ec57e7b8b4b59f99fda5fbee2c18a7c
Opcode Fuzzy Hash: 3526746ace176bc4198365df2d89fc15905c2b6a10e5c3daddffd75ed5a8ac01
Instruction Fuzzy Hash: 6B519D71114304AFD704DF10EC59FAA77E4FB88790F50062EF996A72A1CB71A964CFA2

Function 00293388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 002933CF

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 002933F0

Strings

"%s" (%d) : ==> %s:, xrefs: 00293522
Incorrect parameters to object property !, xrefs: 002934AB
"%s" (%d) : ==> %s:%s%s, xrefs: 00293504
Error: , xrefs: 002934D1
^ ERROR , xrefs: 0029349E
Line %d (File "%s"):, xrefs: 00293443, 0029345C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: dc0eb3e9cb5a498eb438d0c9afa70ab9788f2841f70f49b86df23a0473b82299
Instruction ID: 5c0d162a3c1e6b492a9bc652df8148fe2bd15d9b63c74a4e60b77321f328136e
Opcode Fuzzy Hash: dc0eb3e9cb5a498eb438d0c9afa70ab9788f2841f70f49b86df23a0473b82299
Instruction Fuzzy Hash: 4D517C7292021ABADF15EBE0ED46EEEB778AF18340F544065B40572091EB256FB8CF61

Function 0028B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0028B5FC
_wcslen.LIBCMT ref: 0028B608
_wcslen.LIBCMT ref: 0028B64D
_wcslen.LIBCMT ref: 0028B68C
_wcslen.LIBCMT ref: 0028B6C7

Strings

REMOVE, xrefs: 0028B602, 0028B607
EXISTS, xrefs: 0028B686, 0028B68B
KEYS, xrefs: 0028B647, 0028B64C
APPEND, xrefs: 0028B6C1, 0028B6C6

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 8a898b4664ee1d939ffb6a5cfe8e4f2bd550b3f46683d953ec86a542b6614bb8
Instruction ID: 94f6ca1620840becad43c7b4c23c153487e1c6c04f0e9494a9237587ed41bfe5
Opcode Fuzzy Hash: 8a898b4664ee1d939ffb6a5cfe8e4f2bd550b3f46683d953ec86a542b6614bb8
Instruction Fuzzy Hash: FF41C736A221379BCB217F7D88905BEB7A9AF60B54B24412DE421D72C4F731CDA1C790

Function 00295393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002953A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00295416
GetLastError.KERNEL32 ref: 00295420
SetErrorMode.KERNEL32(00000000,READY), ref: 002954A7

Strings

INVALID, xrefs: 00295459
NOTREADY, xrefs: 0029544B
UNKNOWN, xrefs: 00295444
READY, xrefs: 00295460, 00295468
READONLY, xrefs: 00295452

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f07371061588d9e66fb45b25a0aa302fb0bc7c430ce45876c76609669debcc09
Instruction ID: 2a8ba46f865d3444e16bc5793c593893719609c38a5f7afd606d684141822a2b
Opcode Fuzzy Hash: f07371061588d9e66fb45b25a0aa302fb0bc7c430ce45876c76609669debcc09
Instruction Fuzzy Hash: 4F31F435B202159FCB52DF68D888EAABBF4FF45305F548065E405DB292D770DDA2CB90

Function 002B3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 002B3C79
SetMenu.USER32(?,00000000), ref: 002B3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002B3D10
IsMenu.USER32(?), ref: 002B3D24
CreatePopupMenu.USER32 ref: 002B3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 002B3D5B
DrawMenuBar.USER32 ref: 002B3D63

Strings

0, xrefs: 002B3C54
F, xrefs: 002B3D4E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: f826b0787f4f0a385eb126d672ef5a48b0b5d721a3b270d3302637553a490f88
Instruction ID: 5f374114b9e69cf29b03192166bc358cf8613ac3b5bf3b1d44a39b854b6294d9
Opcode Fuzzy Hash: f826b0787f4f0a385eb126d672ef5a48b0b5d721a3b270d3302637553a490f88
Instruction Fuzzy Hash: 6E416075611206EFDB24CF54E848EEA7BB5FF49390F140129F946A7360D770AA20CF94

Function 00281EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 00283CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00283CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00281F64
GetDlgCtrlID.USER32 ref: 00281F6F
GetParent.USER32 ref: 00281F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00281F8E
GetDlgCtrlID.USER32(?), ref: 00281F97
GetParent.USER32(?), ref: 00281FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00281FAE

Strings

ListBox, xrefs: 00281F21
ComboBox, xrefs: 00281EEC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 9ffd303e32015c77cb29074a7e6da2e7ea142d42e31278a5dd6c7cf52bc8d8a0
Instruction ID: 3e3c0491700d8d9887a0822f5b8b88e8b1c4eaab7fc2a2ec8687b6ad19432f95
Opcode Fuzzy Hash: 9ffd303e32015c77cb29074a7e6da2e7ea142d42e31278a5dd6c7cf52bc8d8a0
Instruction Fuzzy Hash: E121B074910214BBCF08AFA0DC85DEEBBB8AF59310F100216FA61672D1DB745925DF60

Function 002B3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 002B3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 002B3AA0
GetWindowLongW.USER32(?,000000F0), ref: 002B3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002B3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 002B3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 002B3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 002B3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 002B3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 002B3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 002B3C13

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: fabeaea7b18389d2a205e81780fc89a3cbcdb48398f5dd5f864f4756ec9d475d
Instruction ID: be496239b8cede1ea0e8271302fbe38b58c4f256836546f5a90c1e84afd70da5
Opcode Fuzzy Hash: fabeaea7b18389d2a205e81780fc89a3cbcdb48398f5dd5f864f4756ec9d475d
Instruction Fuzzy Hash: FB619C75910248AFDB10DFA8CC85EEE77B8EB09354F1001AAFA15E7291C770AEA5DF50

Function 00252C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00252C94

Part of subcall function 002529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000), ref: 002529DE
Part of subcall function 002529C8: GetLastError.KERNEL32(00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000,00000000), ref: 002529F0

_free.LIBCMT ref: 00252CA0
_free.LIBCMT ref: 00252CAB
_free.LIBCMT ref: 00252CB6
_free.LIBCMT ref: 00252CC1
_free.LIBCMT ref: 00252CCC
_free.LIBCMT ref: 00252CD7
_free.LIBCMT ref: 00252CE2
_free.LIBCMT ref: 00252CED
_free.LIBCMT ref: 00252CFB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: efcdad96f4c1df2851423b6331c09cfaf470afedc8d2272000100f733a4e2029
Instruction ID: b69f0f88116cd474bef8390dd28121a76ecfd2eced23aef5d574bdf114f74d29
Opcode Fuzzy Hash: efcdad96f4c1df2851423b6331c09cfaf470afedc8d2272000100f733a4e2029
Instruction Fuzzy Hash: 1A11F636120008EFCB02EF54D842CDC3BA5FF06341F6150A0FD486B362D631EA689F94

Function 00297DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00297FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00297FC1
GetFileAttributesW.KERNEL32(?), ref: 00297FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00298005
SetCurrentDirectoryW.KERNEL32(?), ref: 00298017
SetCurrentDirectoryW.KERNEL32(?), ref: 00298060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 002980B0

Strings

*.*, xrefs: 00298066

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 1261387f0c8e65d8fe5a20a4f1e8c4778cc11755eaef5e5497f1e45ab9e407dd
Instruction ID: 5d19c738380e75a5c36151235f7b2b2408a37d3625a23376f7c273994a0ddebe
Opcode Fuzzy Hash: 1261387f0c8e65d8fe5a20a4f1e8c4778cc11755eaef5e5497f1e45ab9e407dd
Instruction Fuzzy Hash: 8B81A1715382429BCF24EF54C844AAEB3E8BF89310F58486EF8C5D7250EB74DD658B52

Function 00225BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00225C7A

Part of subcall function 00225D0A: GetClientRect.USER32(?,?), ref: 00225D30
Part of subcall function 00225D0A: GetWindowRect.USER32(?,?), ref: 00225D71
Part of subcall function 00225D0A: ScreenToClient.USER32(?,?), ref: 00225D99

GetDC.USER32 ref: 002646F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00264708
SelectObject.GDI32(00000000,00000000), ref: 00264716
SelectObject.GDI32(00000000,00000000), ref: 0026472B
ReleaseDC.USER32(?,00000000), ref: 00264733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 002647C4

Strings

U, xrefs: 00264693

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 6f9d08278fc26c85cc1e7f0954a1197353d6a11b5715da1ba0b0ecb6a722b214
Instruction ID: 8af61073cee2c00a8090cda93172022778d1c8d3d8993c236d9a461dc690ee1e
Opcode Fuzzy Hash: 6f9d08278fc26c85cc1e7f0954a1197353d6a11b5715da1ba0b0ecb6a722b214
Instruction Fuzzy Hash: DE710730420206EFCF22AF64D984AFA7BB5FF4A360F144266ED955A166D3309CA1DF50

Function 0029359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 002935E4

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

LoadStringW.USER32(002F2390,?,00000FFF,?), ref: 0029360A

Strings

"%s" (%d) : ==> %s:, xrefs: 00293742
"%s" (%d) : ==> %s:%s%s, xrefs: 00293724
^ ERROR, xrefs: 002936C9
Error: , xrefs: 002936EF
Line %d (File "%s"):, xrefs: 0029366B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: a78f0f28278acd2f19414f1557e51c45ef6b952c08ab047ee0f3e741dee34ffa
Instruction ID: cbd28ef54be98baa9dcade14143751c2f53af3c926f507450cc35d3668d44c2a
Opcode Fuzzy Hash: a78f0f28278acd2f19414f1557e51c45ef6b952c08ab047ee0f3e741dee34ffa
Instruction Fuzzy Hash: 1B515D7282021ABACF14EBE0EC46EEDBB78AF14344F544165F105721A1DB312AE8DFA1

Function 0029C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0029C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0029C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0029C2CA
GetLastError.KERNEL32 ref: 0029C322
SetEvent.KERNEL32(?), ref: 0029C336
InternetCloseHandle.WININET(00000000), ref: 0029C341

Strings

, xrefs: 0029C2BB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: c86f27317532ca60b1ba7f35d63d2d7e1b3e1b423bbad1d0054338505c711663
Instruction ID: 753939387ba634e1c05cf1edf9adda8c9baf37906e410cc11ffbc9013fb4198a
Opcode Fuzzy Hash: c86f27317532ca60b1ba7f35d63d2d7e1b3e1b423bbad1d0054338505c711663
Instruction Fuzzy Hash: E4318FB1620208AFDB219F64DC88AAB7BFCEB49744F20855EF486D2200DB70DD149B65

Function 0028989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00263AAF,?,?,Bad directive syntax error,002BCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 002898BC
LoadStringW.USER32(00000000,?,00263AAF,?), ref: 002898C3

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00289987

Strings

Line %d:, xrefs: 00289912
Error: , xrefs: 00289955
., xrefs: 0028996D
%s (%d) : ==> %s.: %s %s, xrefs: 002898F1
Line %d (File "%s"):, xrefs: 0028992D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 1be16ef5b28551ffff6f68ebe99401809d8391948a62c702468f06da9e75633d
Instruction ID: fb509709b7c1fa6737cfff8e9078047810dc31064eede4c3991010b6ee5f8943
Opcode Fuzzy Hash: 1be16ef5b28551ffff6f68ebe99401809d8391948a62c702468f06da9e75633d
Instruction Fuzzy Hash: 08216D31C6021ABBCF11EF90DC0AEEE7739BF28744F084465F515620A2EA7196B8DF61

Function 0028209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 002820AB
GetClassNameW.USER32(00000000,?,00000100), ref: 002820C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0028214D

Strings

largeicons, xrefs: 002820E1
smallicons, xrefs: 00282115
details, xrefs: 002820FB
SHELLDLL_DefView, xrefs: 002820CC
list, xrefs: 0028212F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 41dcd02b5248676d3d5f9a6f76df04033a6f2e668928a5a25ec8cd3e6371ad6d
Instruction ID: d376f341be3a0250c595848eadedf6f896c79baff0ccf379d5e8949959c8c050
Opcode Fuzzy Hash: 41dcd02b5248676d3d5f9a6f76df04033a6f2e668928a5a25ec8cd3e6371ad6d
Instruction Fuzzy Hash: 13110A7E6F8717F9F6057621EC0EEA6379CDB05328B30011AFB08A90D6FEA168355B14

Function 0025CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0025CEB7
_free.LIBCMT ref: 0025CF22
_free.LIBCMT ref: 0025CF48
_free.LIBCMT ref: 0025CF71
_free.LIBCMT ref: 0025CFA9
_free.LIBCMT ref: 0025CFDA
_free.LIBCMT ref: 0025D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0025D09C
_free.LIBCMT ref: 0025D0B5

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 75ff0f72a334f47e2616f1b0bf0ffb682c3ae528d50f168fc4a8c4a6aec043c2
Instruction ID: 2a7e5f43f8d50f11b9b4f788aa5c401e8ead8debb7b1a3dc691ba8ef70620b19
Opcode Fuzzy Hash: 75ff0f72a334f47e2616f1b0bf0ffb682c3ae528d50f168fc4a8c4a6aec043c2
Instruction Fuzzy Hash: 45615B71924301AFDB21AFB4D885A7D7BD5EF01362F24016EFC00A7282E6319D2CCB98

Function 002B50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 002B5186
ShowWindow.USER32(?,00000000), ref: 002B51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 002B51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 002B51D1

Part of subcall function 002B6FBA: DeleteObject.GDI32(00000000), ref: 002B6FE6

GetWindowLongW.USER32(?,000000F0), ref: 002B520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 002B521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 002B524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 002B5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 002B5296

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 4d4e4484c695506214e27c1a4bb2cf6c289260d64bbf38b878c3e772888afd58
Instruction ID: e9e0014c051b865f00b771e4dc09a93bbb6c0d3b6092094938d94dda5c09d054
Opcode Fuzzy Hash: 4d4e4484c695506214e27c1a4bb2cf6c289260d64bbf38b878c3e772888afd58
Instruction Fuzzy Hash: B451C630A71A29BFEF249F28DC49BD87765EB053A0F144112FA199E2E1C7B599B0DF40

Function 00238B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00276890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 002768A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 002768B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 002768D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 002768F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00238874,00000000,00000000,00000000,000000FF,00000000), ref: 00276901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0027691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00238874,00000000,00000000,00000000,000000FF,00000000), ref: 0027692D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: ce0690023efc04116a0868031e6910215d95d716bf2e2c0fb7fd566d935ac98f
Instruction ID: 12e67e4b7a5903fd8aa3f6adc4a55797a2305cc9854af30ee2809e15d0a57c3e
Opcode Fuzzy Hash: ce0690023efc04116a0868031e6910215d95d716bf2e2c0fb7fd566d935ac98f
Instruction Fuzzy Hash: ED518EB0620706EFDB20CF24DC59FAA77B6EB44354F204518F956DB2A0DBB0E960DB50

Function 0029C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0029C182
GetLastError.KERNEL32 ref: 0029C195
SetEvent.KERNEL32(?), ref: 0029C1A9

Part of subcall function 0029C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0029C272
Part of subcall function 0029C253: GetLastError.KERNEL32 ref: 0029C322
Part of subcall function 0029C253: SetEvent.KERNEL32(?), ref: 0029C336
Part of subcall function 0029C253: InternetCloseHandle.WININET(00000000), ref: 0029C341

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: c427a70d25552c2968a3a348d426e2abc32d0149149d5c52d326ae6c112f214a
Instruction ID: faaf7dcfe90bd70206102ffb8defc692ae87010dd82e0ced8b946ebe29e76d57
Opcode Fuzzy Hash: c427a70d25552c2968a3a348d426e2abc32d0149149d5c52d326ae6c112f214a
Instruction Fuzzy Hash: 8D317071610705AFDF219FA5EC48A66BBF9FF58300B24451EF95A86610DB31E824EF60

Function 002825A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00283A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00283A57
Part of subcall function 00283A3D: GetCurrentThreadId.KERNEL32 ref: 00283A5E
Part of subcall function 00283A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002825B3), ref: 00283A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 002825BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 002825DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 002825DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 002825E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00282601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00282605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0028260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00282623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00282627

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: a43548dd574b4ee91e8b51727721c21d4e4c5f35d1e2512a66626dcfeb85f00a
Instruction ID: 8b0c82fbc65a35ac067f5b5af5e30439b9a4c2ace8613832ba5a62a4fc164793
Opcode Fuzzy Hash: a43548dd574b4ee91e8b51727721c21d4e4c5f35d1e2512a66626dcfeb85f00a
Instruction Fuzzy Hash: EC01D4707A0220BBFB107768AC8EF593F5DDB8EB12F200112F358AE0D1C9F224548A69

Function 00281803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00281449,?,?,00000000), ref: 0028180C
HeapAlloc.KERNEL32(00000000,?,00281449,?,?,00000000), ref: 00281813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00281449,?,?,00000000), ref: 00281828
GetCurrentProcess.KERNEL32(?,00000000,?,00281449,?,?,00000000), ref: 00281830
DuplicateHandle.KERNEL32(00000000,?,00281449,?,?,00000000), ref: 00281833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00281449,?,?,00000000), ref: 00281843
GetCurrentProcess.KERNEL32(00281449,00000000,?,00281449,?,?,00000000), ref: 0028184B
DuplicateHandle.KERNEL32(00000000,?,00281449,?,?,00000000), ref: 0028184E
CreateThread.KERNEL32(00000000,00000000,00281874,00000000,00000000,00000000), ref: 00281868

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: e8c9b38980fc0fd60308f01bfbc8e705505c17374ad1b779d8fc076498b20be7
Instruction ID: 48e8b45d21aa6197b7596cf7e50de7c33b13c0881a9c4e52e98de898d52c13d7
Opcode Fuzzy Hash: e8c9b38980fc0fd60308f01bfbc8e705505c17374ad1b779d8fc076498b20be7
Instruction Fuzzy Hash: 3E01BFB5250304BFE710AFA5EC4DF573BACEB89B11F504521FA05EB191C6709810CB20

Function 00253E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00253F0B
__alldvrm.LIBCMT ref: 0025410C
__alldvrm.LIBCMT ref: 0025412E

Strings

}}$, xrefs: 002540CD
}}$, xrefs: 00253E96, 00253EF1, 00253F0A, 00254090
}}$, xrefs: 00253E8A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}$$}}$$}}$
API String ID: 1036877536-604903683
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 5673f2915f02b6a385ef4d6ec58c5ac581e730be8b1c20e9f6889b3ce7f3be52
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: B2A18832D307829FDB15DF18C8817AEFBE4EF21395F28416DE9459B281C23489A9CB58

Function 002AA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0028D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0028D501
Part of subcall function 0028D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0028D50F
Part of subcall function 0028D4DC: CloseHandle.KERNELBASE(00000000), ref: 0028D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 002AA16D
GetLastError.KERNEL32 ref: 002AA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 002AA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 002AA268
GetLastError.KERNEL32(00000000), ref: 002AA273
CloseHandle.KERNEL32(00000000), ref: 002AA2C4

Strings

SeDebugPrivilege, xrefs: 002AA18F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 61f2a0280a8e9e46134f6f60e878ee1e0e70da70404da23d5bc8872b756c943c
Instruction ID: f410fcf76b05f4e140859f399d4fd50ea0df234b96664389e11401c6b0c7bbbf
Opcode Fuzzy Hash: 61f2a0280a8e9e46134f6f60e878ee1e0e70da70404da23d5bc8872b756c943c
Instruction Fuzzy Hash: 7961C330224242AFD310DF18D494F1ABBE1AF45318F14849CE45A4FBA3CB76EC65CB92

Function 002B3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 002B3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 002B393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 002B3954
_wcslen.LIBCMT ref: 002B3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 002B39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 002B39F4

Strings

SysListView32, xrefs: 002B38F7

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 23cab45d99b7329219f4d49ecd09da591fcd71ca4272b53e7f19bc63bc97a10a
Instruction ID: fdcbd9979ae9c9bcaa003cf2777022d0148fcd1d12abd6ea3cdb36a891139fd6
Opcode Fuzzy Hash: 23cab45d99b7329219f4d49ecd09da591fcd71ca4272b53e7f19bc63bc97a10a
Instruction Fuzzy Hash: DA41B671A10219ABEF21DF64CC49FEA77A9EF48390F100526F558E7281D7B19DA0CB90

Function 0028BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0028BCFD
IsMenu.USER32(00000000), ref: 0028BD1D
CreatePopupMenu.USER32 ref: 0028BD53
GetMenuItemCount.USER32(01284B38), ref: 0028BDA4
InsertMenuItemW.USER32(01284B38,?,00000001,00000030), ref: 0028BDCC

Strings

0, xrefs: 0028BCA8
2, xrefs: 0028BD37

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 3808412f0e6c8b659f18603f4c865fff2e18641d63d313655dac7a75faefeb00
Instruction ID: 5dd5d43fb1398e8e400c1b3736a18341925621063e07e8e74afce7b69ae9cf25
Opcode Fuzzy Hash: 3808412f0e6c8b659f18603f4c865fff2e18641d63d313655dac7a75faefeb00
Instruction Fuzzy Hash: A451F578612206EBDF12EFA8D888BAEBBF4BF45314F24425DE401E72D1D7709954CB61

Function 00242D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00242D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00242D53
_ValidateLocalCookies.LIBCMT ref: 00242DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00242E0C
_ValidateLocalCookies.LIBCMT ref: 00242E61

Strings

csm, xrefs: 00242DF6
&H$, xrefs: 00242DFE, 00242E07, 00242E18

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H$$csm
API String ID: 1170836740-253815091
Opcode ID: bfefc82d3056362a5a5366e5c394be243d4189d6c9afe55c4c2010e69cd8f476
Instruction ID: 9c1f09571472e94064c7f710421cc589f988588252a49e8814cd989398721cde
Opcode Fuzzy Hash: bfefc82d3056362a5a5366e5c394be243d4189d6c9afe55c4c2010e69cd8f476
Instruction Fuzzy Hash: 27412730E20209DBCF18DF69C884A9EBBB4BF44324F548155F815AB392D771AA29CFD0

Function 0028C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0028C913

Strings

warning, xrefs: 0028C8FC
stop, xrefs: 0028C8E4
blank, xrefs: 0028C895
info, xrefs: 0028C8B4
question, xrefs: 0028C8CC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: f2ae7d673ee8750468a4f8a0a7ee2785ed38c5a425ad5ba83cf565cf175c719c
Instruction ID: 057d27cf7ec2e531d51b56c2c2be1b1caef1bdbf3b0eeeb3f29a007ea9fd884f
Opcode Fuzzy Hash: f2ae7d673ee8750468a4f8a0a7ee2785ed38c5a425ad5ba83cf565cf175c719c
Instruction Fuzzy Hash: 97115B396FA707BAA7057B10DC82DBA639CDF15364B70006BF800A62C2E7B45E205775

Function 0028DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0028DE42
gethostname.WSOCK32(?,00000100), ref: 0028DE5C
gethostbyname.WSOCK32(?), ref: 0028DE69
inet_ntoa.WSOCK32(?), ref: 0028DEAB
_strcat.LIBCMT ref: 0028DEB9
WSACleanup.WSOCK32 ref: 0028DEDE

Strings

0.0.0.0, xrefs: 0028DE87

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 924da5d91c4d64863b1b67463532fda6f4778fa49dcc9ee2ef55f166140de1f3
Instruction ID: 073081e8c7fb93f8804ab8e6230f1016c99176f191069cafda13257390d82741
Opcode Fuzzy Hash: 924da5d91c4d64863b1b67463532fda6f4778fa49dcc9ee2ef55f166140de1f3
Instruction Fuzzy Hash: 38115675920105AFCB24BF30EC4AEEE77ACDF11310F1002A9F145AA0D1EFB09AA59F60

Function 002B9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

GetSystemMetrics.USER32(0000000F), ref: 002B9FC7
GetSystemMetrics.USER32(0000000F), ref: 002B9FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 002BA224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 002BA242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 002BA263
ShowWindow.USER32(00000003,00000000), ref: 002BA282
InvalidateRect.USER32(?,00000000,00000001), ref: 002BA2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 002BA2CA

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: b00f049b5db9df5b6978071b82acb3444eaf4f1a030a8fb0fbe5c201706f7f71
Instruction ID: 154eefddcffeea197319c235f4a44d7b686030ec2a847739066a6779ff23e8b2
Opcode Fuzzy Hash: b00f049b5db9df5b6978071b82acb3444eaf4f1a030a8fb0fbe5c201706f7f71
Instruction Fuzzy Hash: 30B1DC31610216DFDF14CF68C9897EE7BB2FF44781F088069EC89AB295D731A960CB51

Function 0028ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0028ED2A
_wcslen.LIBCMT ref: 0028ED3B
_wcslen.LIBCMT ref: 0028ED79
_wcslen.LIBCMT ref: 0028EDAF
_wcslen.LIBCMT ref: 0028EDDF
_wcslen.LIBCMT ref: 0028EDEF
_wcslen.LIBCMT ref: 0028EE2B
_wcslen.LIBCMT ref: 0028EE5A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 9376653d6998d4b9e10c545522284a5dd982ad0bf668b487894bade9b43fc757
Instruction ID: 8711d8c9a8f63ee08abc52b5bf819b9b6eb9467c46a2e82ba428de0af683af61
Opcode Fuzzy Hash: 9376653d6998d4b9e10c545522284a5dd982ad0bf668b487894bade9b43fc757
Instruction Fuzzy Hash: F241B365C2121875CB15FBF4888AACFB7ACAF45710F508462E914F3162FB34E265C7A6

Function 0023F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0027682C,00000004,00000000,00000000), ref: 0023F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0027682C,00000004,00000000,00000000), ref: 0027F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0027682C,00000004,00000000,00000000), ref: 0027F454

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 07e5e387dc3cbede0b64bafb86f306ad0216c6b4e53bf199f344aa5c9ea37637
Instruction ID: c91579f2ee6309fd0272eed6e6a7aa40da20e5c09b86985636d709e58eec1000
Opcode Fuzzy Hash: 07e5e387dc3cbede0b64bafb86f306ad0216c6b4e53bf199f344aa5c9ea37637
Instruction Fuzzy Hash: AA415F71A382C1BBC7B48F2CFB8C7367B95AF46324F14853CE08B56660C671A4A0CB11

Function 002B2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 002B2D1B
GetDC.USER32(00000000), ref: 002B2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 002B2D2E
ReleaseDC.USER32(00000000,00000000), ref: 002B2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 002B2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 002B2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,002B5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 002B2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 002B2DE1

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 2b160687d39c984b4e7f45b538f4760fd5b0064fec9963693e75d487129c8ceb
Instruction ID: a5011243f5c9cd12ee7ca4d5b01bc95fd4d2042c057a1fc8b42c285e2c708a7a
Opcode Fuzzy Hash: 2b160687d39c984b4e7f45b538f4760fd5b0064fec9963693e75d487129c8ceb
Instruction Fuzzy Hash: B831A772211210BBEB248F14DC8AFEB3BADEF49751F044165FE08AA291C6B58C50CBA0

Function 00285622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00285637
_memcmp.LIBVCRUNTIME ref: 00285659
_memcmp.LIBVCRUNTIME ref: 00285671
_memcmp.LIBVCRUNTIME ref: 00285684
_memcmp.LIBVCRUNTIME ref: 0028569E
_memcmp.LIBVCRUNTIME ref: 002856B1
_memcmp.LIBVCRUNTIME ref: 002856C9
_memcmp.LIBVCRUNTIME ref: 002856E4

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 559a3c7ba6728736b2806b7fc5c8e4f3babb710de14ebae6fcdf3141a04532ba
Instruction ID: 934f9c33916d62d235825800142acd0b183d4ab0d14ffea43632bb4ad2b92ced
Opcode Fuzzy Hash: 559a3c7ba6728736b2806b7fc5c8e4f3babb710de14ebae6fcdf3141a04532ba
Instruction Fuzzy Hash: C921C575672A3A77D618BD208E82FFA775CAE21384B444021FD049A5C5F760ED7087A5

Function 002A4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 002A502E, 002A5383
Not an Object type, xrefs: 002A5007

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: a0112cb893266b0aabdb35e5834cd14a3fd0d8ce3e51289b07abfadcb24bcfd4
Instruction ID: 714e0f1b3265b4db3d3ec3c73345aefef358f6bf61ebd3cf539800f431395930
Opcode Fuzzy Hash: a0112cb893266b0aabdb35e5834cd14a3fd0d8ce3e51289b07abfadcb24bcfd4
Instruction Fuzzy Hash: D7D1D371A1061AAFDF10CFA8C880BAFB7B5FF49344F148469E915AB281EB70DD55CB90

Function 00261522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,002617FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 002615CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,002617FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00261651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,002617FB,?,002617FB,00000000,00000000,?,00000000,?,?,?,?), ref: 002616E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,002617FB,00000000,00000000,?,00000000,?,?,?,?), ref: 002616FB

Part of subcall function 00253820: RtlAllocateHeap.NTDLL(00000000,?,002F1444,?,0023FDF5,?,?,0022A976,00000010,002F1440,002213FC,?,002213C6,?,00221129), ref: 00253852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,002617FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00261777
__freea.LIBCMT ref: 002617A2
__freea.LIBCMT ref: 002617AE

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 2aa6a372aeb30f0ac45bbc90c66842b6c82cabc6b87c1a6be72450cfa58bae88
Instruction ID: 2975811087b485f6c534a186ae855df8796ad8d63023b4876dbeed5f04526719
Opcode Fuzzy Hash: 2aa6a372aeb30f0ac45bbc90c66842b6c82cabc6b87c1a6be72450cfa58bae88
Instruction Fuzzy Hash: D491C571E302169ADB218E74CC81AEEBBB5AF49310F5C4659E802E7190D735EDB4CBA0

Function 002A4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002A4648
VariantInit.OLEAUT32(?), ref: 002A4749
VariantClear.OLEAUT32(?), ref: 002A4753
VariantClear.OLEAUT32(?), ref: 002A47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 002A472C
Null Object assignment in FOR..IN loop, xrefs: 002A45D8, 002A4706, 002A47BE

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 272ba2b7ab860cd4659cd989f0de511bb60fc4a05281b3c9fd7569fb7941fdbb
Instruction ID: 85deb4aec6904e6c24e68b836377c1d7069525d91c60f50c5f7699dcbdab1755
Opcode Fuzzy Hash: 272ba2b7ab860cd4659cd989f0de511bb60fc4a05281b3c9fd7569fb7941fdbb
Instruction Fuzzy Hash: 4E91B170A20215ABDF24DFA5DC44FAEBBB8EF86714F108559F505AB280DBB0D951CFA0

Function 00291187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0029125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00291284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 002912A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 002912D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0029135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 002913C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00291430

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 86ebe0bdc02c0f4bf2d68011c338408c46b2588a946e14a0f393e254a80be353
Instruction ID: 432eafef56fd25e6ca817212cd179cbcc71160791efc4eb48bdfcaaf6d4556b1
Opcode Fuzzy Hash: 86ebe0bdc02c0f4bf2d68011c338408c46b2588a946e14a0f393e254a80be353
Instruction Fuzzy Hash: CB91C075E2021AAFEF009F95D884BBE77B5FF49314F104029E900EB291D774A961CF90

Function 0023948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 390240421765af8626ff863ce63226e093338d5c958481b9188df5962c013155
Instruction ID: 3257b62ed5643cec0ceb38b55097c532270192776fd00e492da4ff7f573710d5
Opcode Fuzzy Hash: 390240421765af8626ff863ce63226e093338d5c958481b9188df5962c013155
Instruction Fuzzy Hash: 5D9117B1D1021AAFCB10CFA9C884AEEBBB8FF4A320F148555E515B7251D3B4A991CF60

Function 002A3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002A396B
CharUpperBuffW.USER32(?,?), ref: 002A3A7A
_wcslen.LIBCMT ref: 002A3A8A
VariantClear.OLEAUT32(?), ref: 002A3C1F

Part of subcall function 00290CDF: VariantInit.OLEAUT32(00000000), ref: 00290D1F
Part of subcall function 00290CDF: VariantCopy.OLEAUT32(?,?), ref: 00290D28
Part of subcall function 00290CDF: VariantClear.OLEAUT32(?), ref: 00290D34

Strings

Incorrect Parameter format, xrefs: 002A39A6, 002A3BA1
AUTOIT.ERROR, xrefs: 002A3A80, 002A3A85

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 296cda837ac30788542f21a3169a674d04be2f1949e6a630c894532028a9fffb
Instruction ID: 3248d63af5bb8fa5a03e96117f7f4184c0387d08a398c7fd0e1ee147770827f4
Opcode Fuzzy Hash: 296cda837ac30788542f21a3169a674d04be2f1949e6a630c894532028a9fffb
Instruction Fuzzy Hash: 8B9156746283059FC700EF64C48096AB7E5BF8A714F14886EF88A9B351DB30EE55CF92

Function 002A4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0028000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0027FF41,80070057,?,?,?,0028035E), ref: 0028002B
Part of subcall function 0028000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0027FF41,80070057,?,?), ref: 00280046
Part of subcall function 0028000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0027FF41,80070057,?,?), ref: 00280054
Part of subcall function 0028000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0027FF41,80070057,?), ref: 00280064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 002A4C51
_wcslen.LIBCMT ref: 002A4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 002A4DCF
CoTaskMemFree.OLE32(?), ref: 002A4DDA

Strings

NULL Pointer assignment, xrefs: 002A4E23, 002A4E52

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: d45e6b5019594f1bafc1adb1e6101afc750b4c9bdfeb332c92bf7a3e5f45536f
Instruction ID: 77b957ad671a2b45b3c7ea78e482ca7946bb7ea642650b32f02f0f4f90d282ab
Opcode Fuzzy Hash: d45e6b5019594f1bafc1adb1e6101afc750b4c9bdfeb332c92bf7a3e5f45536f
Instruction Fuzzy Hash: 88914A71D1022DEFDF14EFA4D880AEEB7B9BF49310F10416AE915A7251EB709A64CF60

Function 002B20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 002B2183
GetMenuItemCount.USER32(00000000), ref: 002B21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 002B21DD
_wcslen.LIBCMT ref: 002B2213
GetMenuItemID.USER32(?,?), ref: 002B224D
GetSubMenu.USER32(?,?), ref: 002B225B

Part of subcall function 00283A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00283A57
Part of subcall function 00283A3D: GetCurrentThreadId.KERNEL32 ref: 00283A5E
Part of subcall function 00283A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002825B3), ref: 00283A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 002B22E3

Part of subcall function 0028E97B: Sleep.KERNEL32 ref: 0028E9F3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: c9178f0918d013c42dd7212ab655c9611319a27cbf4cc19394ddeb87337b1213
Instruction ID: bc7966819ad71616307cd02c7abb2bf8be6f94f19b9c978efac3073c6e71e281
Opcode Fuzzy Hash: c9178f0918d013c42dd7212ab655c9611319a27cbf4cc19394ddeb87337b1213
Instruction Fuzzy Hash: 6871AC75A20215EFCB10EFA8C845AAEB7F5EF48350F108459E816EB351DB34AE118F90

Function 002B7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01284C78), ref: 002B7F37
IsWindowEnabled.USER32(01284C78), ref: 002B7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 002B801E
SendMessageW.USER32(01284C78,000000B0,?,?), ref: 002B8051
IsDlgButtonChecked.USER32(?,?), ref: 002B8089
GetWindowLongW.USER32(01284C78,000000EC), ref: 002B80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 002B80C3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: d7da40f9c279153508350db807a27df0bb350917ba79cf8da8cee86c08cf7d78
Instruction ID: 1a71dfb3c90ca4a625121350dcf4d492482f9302ac44f37e43780beb2abca2ac
Opcode Fuzzy Hash: d7da40f9c279153508350db807a27df0bb350917ba79cf8da8cee86c08cf7d78
Instruction Fuzzy Hash: 4D71C134629206AFEB249F54CC84FFABBB9EF89380F140459F949576A1CB31A865CB14

Function 0028AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0028AEF9
GetKeyboardState.USER32(?), ref: 0028AF0E
SetKeyboardState.USER32(?), ref: 0028AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0028AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0028AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0028AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0028B020

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 867b3f5501c589974c2f0d650e81cce341a5932072f7b3f0edf53d5941685d98
Instruction ID: d20831565f69be4fbf942768a8666d561d51d2fb06bb92e2bc5a5e0feea8777f
Opcode Fuzzy Hash: 867b3f5501c589974c2f0d650e81cce341a5932072f7b3f0edf53d5941685d98
Instruction Fuzzy Hash: BC5134A4A253D23DFB3766348C45BBABEE95B06304F08848EE2D8458C3C7D9ACE4D751

Function 0028ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0028AD19
GetKeyboardState.USER32(?), ref: 0028AD2E
SetKeyboardState.USER32(?), ref: 0028AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0028ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0028ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0028AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0028AE38

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: ff9d35e1a993b12d8e524cf5c465930554597155fb786f958014c37f287c7acd
Instruction ID: 2ac05b14620e7c56144a89abfb96461ab574c80ba441863d8eec5da80eb13688
Opcode Fuzzy Hash: ff9d35e1a993b12d8e524cf5c465930554597155fb786f958014c37f287c7acd
Instruction Fuzzy Hash: C9513AA49267D23DFB3767348C45B7ABE986B45301F08888AE1D5868C3CB94ECA4D752

Function 0025542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00263CD6,?,?,?,?,?,?,?,?,00255BA3,?,?,00263CD6,?,?), ref: 00255470
__fassign.LIBCMT ref: 002554EB
__fassign.LIBCMT ref: 00255506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00263CD6,00000005,00000000,00000000), ref: 0025552C
WriteFile.KERNEL32(?,00263CD6,00000000,00255BA3,00000000,?,?,?,?,?,?,?,?,?,00255BA3,?), ref: 0025554B
WriteFile.KERNEL32(?,?,00000001,00255BA3,00000000,?,?,?,?,?,?,?,?,?,00255BA3,?), ref: 00255584

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 57ec039ba53e123fbf953f52a14693e2f67a45d672b8cf4baa20819c1dc79caa
Instruction ID: 4a28c64fa8f32435108cf69906cf5775be677df5ff458a001315af49c3bbd247
Opcode Fuzzy Hash: 57ec039ba53e123fbf953f52a14693e2f67a45d672b8cf4baa20819c1dc79caa
Instruction Fuzzy Hash: B25105B0A106099FCB10CFA8D895BEEBBF9EF08301F14412AF955E7291E7309A55CB64

Function 002A10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002A304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 002A307A
Part of subcall function 002A304E: _wcslen.LIBCMT ref: 002A309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 002A1112
WSAGetLastError.WSOCK32 ref: 002A1121
WSAGetLastError.WSOCK32 ref: 002A11C9
closesocket.WSOCK32(00000000), ref: 002A11F9

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 7e54809d13681908b28edcd1d0a8cb1e0c44775c530dcff8178948bb34cd152f
Instruction ID: c900910dc9b2cee2a79abd7586dcc39b503dc8293b3465132435575a16c8140e
Opcode Fuzzy Hash: 7e54809d13681908b28edcd1d0a8cb1e0c44775c530dcff8178948bb34cd152f
Instruction Fuzzy Hash: 99412531210215AFDB109F54D888BA9B7E9EF46324F248159FD099F291CB70ED61CFE0

Function 0028CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0028DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0028CF22,?), ref: 0028DDFD

Part of subcall function 0028DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0028CF22,?), ref: 0028DE16

lstrcmpiW.KERNEL32(?,?), ref: 0028CF45
MoveFileW.KERNEL32(?,?), ref: 0028CF7F
_wcslen.LIBCMT ref: 0028D005
_wcslen.LIBCMT ref: 0028D01B
SHFileOperationW.SHELL32(?), ref: 0028D061

Strings

\*.*, xrefs: 0028CFF3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: fb8d024ac39ede49b07d1de0c43d2d91c9f44851c8b31e5ab77f52a98c9a57cd
Instruction ID: 0094ebf7b2760913cad84ca14f446a5d83b07bcf087188fc27bb67027dd9d60d
Opcode Fuzzy Hash: fb8d024ac39ede49b07d1de0c43d2d91c9f44851c8b31e5ab77f52a98c9a57cd
Instruction Fuzzy Hash: 904178758162195FDF12FFA4D981ADE77B8AF18340F1000E6E505EB182EB34A6A8CF50

Function 002B2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 002B2E1C
GetWindowLongW.USER32(?,000000F0), ref: 002B2E4F
GetWindowLongW.USER32(?,000000F0), ref: 002B2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 002B2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 002B2EE0
GetWindowLongW.USER32(?,000000F0), ref: 002B2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 002B2F0B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 457dc366bee0c5b3e3926619f8678d56ad19c4df3d1d0c762ff425ac5ed3a995
Instruction ID: 718f4cfdcf488239f83eff0b92e6322d585b309de0dd16a52587ef3dbd38b678
Opcode Fuzzy Hash: 457dc366bee0c5b3e3926619f8678d56ad19c4df3d1d0c762ff425ac5ed3a995
Instruction Fuzzy Hash: 20311430614251DFDB218F19EC88FA537E4EB9A7A0F140164FA009B2B2CBB1F864DB51

Function 00287726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00287769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0028778F
SysAllocString.OLEAUT32(00000000), ref: 00287792
SysAllocString.OLEAUT32(?), ref: 002877B0
SysFreeString.OLEAUT32(?), ref: 002877B9
StringFromGUID2.OLE32(?,?,00000028), ref: 002877DE
SysAllocString.OLEAUT32(?), ref: 002877EC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 8c99a36e524a5f26a1e7404919bf8121b3a8b10c321dc4bb088e7e6a2b16dbf6
Instruction ID: fd9f9f49ff646cb65b68d56bd0d0ef74f6e2e5f2d0b23d1677441a36fe8c4ce7
Opcode Fuzzy Hash: 8c99a36e524a5f26a1e7404919bf8121b3a8b10c321dc4bb088e7e6a2b16dbf6
Instruction Fuzzy Hash: D121C77A615219AFDF10EFA8DC88CBBB3ACEB097647248135F904DB190D670DD41C760

Function 002877FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00287842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00287868
SysAllocString.OLEAUT32(00000000), ref: 0028786B
SysAllocString.OLEAUT32 ref: 0028788C
SysFreeString.OLEAUT32 ref: 00287895
StringFromGUID2.OLE32(?,?,00000028), ref: 002878AF
SysAllocString.OLEAUT32(?), ref: 002878BD

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f13ab1f71f8be712084c0c0b7ccbc0fcc5d004c82cd41c7dc7c65ad7c988e803
Instruction ID: 40f145b9584a7b6dfa5c9da8d506abebdfe308128d4ee7a6a22f1767de1c23e1
Opcode Fuzzy Hash: f13ab1f71f8be712084c0c0b7ccbc0fcc5d004c82cd41c7dc7c65ad7c988e803
Instruction Fuzzy Hash: 9721A135619205AFEB10AFA8DC8CDAA77ECEB08360B208125F915CB2A1DA70DC51DB74

Function 002904D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 002904F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0029052E

Strings

nul, xrefs: 00290567

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: b4fa5b76616887ac5816d9583d53e07e4a4b03ff7071cf7f4c46cb74ce4f5b6c
Instruction ID: 4c18a540dc702c9d48e6339a844cf99ae0b30e7a100194c24bf93014850fbecf
Opcode Fuzzy Hash: b4fa5b76616887ac5816d9583d53e07e4a4b03ff7071cf7f4c46cb74ce4f5b6c
Instruction Fuzzy Hash: AF21627591030A9FDF209F29DC88A5A77B4BF44764FA14A29F8A1D62E0D7709960CF20

Function 002905A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 002905C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00290601

Strings

nul, xrefs: 00290639

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 57a2c838d1a11a1356683841a93c97f0bb8c147610b53ce8337f6a104f8e9f6e
Instruction ID: e684483e6f069f19aa8c20234c2e27c6dbff54032a65578382c21ccd001cac9e
Opcode Fuzzy Hash: 57a2c838d1a11a1356683841a93c97f0bb8c147610b53ce8337f6a104f8e9f6e
Instruction Fuzzy Hash: 3021337551030A9FDF209F699C84A5A77ECBF95724F200B19F8A1E72D0D7B09970CB60

Function 002B40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0022600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0022604C
Part of subcall function 0022600E: GetStockObject.GDI32(00000011), ref: 00226060
Part of subcall function 0022600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0022606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 002B4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 002B411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 002B412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 002B4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 002B4145

Strings

Msctls_Progress32, xrefs: 002B40E3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 5701b8e2fcff6db3cca7a9d3a0ee1d3f8194590811487112a392e49e5f15c8a3
Instruction ID: d136f883c82c03251f4de3d2203b8393d90cb160e84472992178c6af71dd21c4
Opcode Fuzzy Hash: 5701b8e2fcff6db3cca7a9d3a0ee1d3f8194590811487112a392e49e5f15c8a3
Instruction Fuzzy Hash: DB11B2B216021ABEEF119F64CC85EE77F5DEF08798F004111BB18A2051C6729C21DBA4

Function 0025D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0025D7A3: _free.LIBCMT ref: 0025D7CC

_free.LIBCMT ref: 0025D82D

Part of subcall function 002529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000), ref: 002529DE
Part of subcall function 002529C8: GetLastError.KERNEL32(00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000,00000000), ref: 002529F0

_free.LIBCMT ref: 0025D838
_free.LIBCMT ref: 0025D843
_free.LIBCMT ref: 0025D897
_free.LIBCMT ref: 0025D8A2
_free.LIBCMT ref: 0025D8AD
_free.LIBCMT ref: 0025D8B8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: e53a58f895afc1d475aedba3eec383fa4110cbf3921a39f76d8dd11b0fd03128
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 1F118171560B04EAD531BFB0CC07FCBBBDCAF09702F400825BA99A6992DA34B52D4E54

Function 0028DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0028DA74
LoadStringW.USER32(00000000), ref: 0028DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0028DA91
LoadStringW.USER32(00000000), ref: 0028DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0028DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0028DAB9

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 2b118d3e95dc466095a3e8644f9d01996370c93a8c277a0ed054b106b30a2b17
Instruction ID: 3b79b41c728964d92f2e3bb11dc8a3c5e86317fb9355c1a6a11ba8b0accba228
Opcode Fuzzy Hash: 2b118d3e95dc466095a3e8644f9d01996370c93a8c277a0ed054b106b30a2b17
Instruction Fuzzy Hash: F90186F69102087FE711EBA4AD8DEF7776CE708301F500592B746E2081EA749E844F74

Function 0029096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0127E3D0,0127E3D0), ref: 0029097B
EnterCriticalSection.KERNEL32(0127E3B0,00000000), ref: 0029098D
TerminateThread.KERNEL32(?,000001F6), ref: 0029099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 002909A9
CloseHandle.KERNEL32(?), ref: 002909B8
InterlockedExchange.KERNEL32(0127E3D0,000001F6), ref: 002909C8
LeaveCriticalSection.KERNEL32(0127E3B0), ref: 002909CF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 01db12abf965f8079b7315c34a8de3c103f74e8e550c0e558e5a99fc2801db78
Instruction ID: 01eb80a6b07d40274fd6d23bddd6e0f8d9d01964e1caf093f45aa73f3d954ea2
Opcode Fuzzy Hash: 01db12abf965f8079b7315c34a8de3c103f74e8e550c0e558e5a99fc2801db78
Instruction Fuzzy Hash: 0EF0CD31442512ABEB555F94EE8DAD67A25BF05702F501126F501508A1C775A875CF90

Function 002A1C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 002A1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 002A1DE1
WSAGetLastError.WSOCK32 ref: 002A1DF2
htons.WSOCK32(?,?,?,?,?), ref: 002A1EDB
inet_ntoa.WSOCK32(?), ref: 002A1E8C

Part of subcall function 002839E8: _strlen.LIBCMT ref: 002839F2

Part of subcall function 002A3224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0029EC0C), ref: 002A3240

_strlen.LIBCMT ref: 002A1F35

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: cc45a47cf4da5140ff72821057aaafc315503a9ba6b8d192b80131893459eff6
Instruction ID: d32558668fb2274f51333a297de9a6b112827adbc453f4dab45c62c8bb344e56
Opcode Fuzzy Hash: cc45a47cf4da5140ff72821057aaafc315503a9ba6b8d192b80131893459eff6
Instruction Fuzzy Hash: E7B1EF71214341AFC324DF64C885E2A7BE5AF85328F54854CF4569F2E2CB71ED62CB92

Function 00225D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00225D30
GetWindowRect.USER32(?,?), ref: 00225D71
ScreenToClient.USER32(?,?), ref: 00225D99
GetClientRect.USER32(?,?), ref: 00225ED7
GetWindowRect.USER32(?,?), ref: 00225EF8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: c93c187a5d5154e399bb3b15db5a05457e1fd6896476dcd14393358e47cbfb23
Instruction ID: bde56fe487060a25a0d23fe7359fb8b3710f915bbab2d82735b030defb7807cd
Opcode Fuzzy Hash: c93c187a5d5154e399bb3b15db5a05457e1fd6896476dcd14393358e47cbfb23
Instruction Fuzzy Hash: C6B18C34A2075AEBDB10DFA8D4807EEB7F1FF54310F14851AE8A9D7250DB30AAA1DB50

Function 002501B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 002500BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002500D6
__allrem.LIBCMT ref: 002500ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0025010B
__allrem.LIBCMT ref: 00250122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00250140

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 3338497e4d88acd61c6b2f98d91aaab074c912bcfcb49b5cc35c030b1d79cc38
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 18811D72A20B069BD7249F78CC81B6B73E8AF41325F254139FC15D76C1E770E9288B55

Function 002561FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,002482D9,002482D9,?,?,?,0025644F,00000001,00000001,8BE85006), ref: 00256258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0025644F,00000001,00000001,8BE85006,?,?,?), ref: 002562DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 002563D8
__freea.LIBCMT ref: 002563E5

Part of subcall function 00253820: RtlAllocateHeap.NTDLL(00000000,?,002F1444,?,0023FDF5,?,?,0022A976,00000010,002F1440,002213FC,?,002213C6,?,00221129), ref: 00253852

__freea.LIBCMT ref: 002563EE
__freea.LIBCMT ref: 00256413

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: a75355bce2494fa04ca61dc2b0b1fb41d19e10f7af3cec5712a08a29c4f4c74b
Instruction ID: 9434fb2552f4b5b21d844ee6e8b8ffc4b351d9ec8fa03d9dabe255a2bc04a1a4
Opcode Fuzzy Hash: a75355bce2494fa04ca61dc2b0b1fb41d19e10f7af3cec5712a08a29c4f4c74b
Instruction Fuzzy Hash: 96511572630217BBEB258FA4CC89EAF77A9EB44B51F544268FC05D7140DB34DC68CA64

Function 002ABBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 002AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,002AB6AE,?,?), ref: 002AC9B5
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002AC9F1
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002ACA68
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002ABCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002ABD25
RegCloseKey.ADVAPI32(00000000), ref: 002ABD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 002ABD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 002ABDF3
RegCloseKey.ADVAPI32(?), ref: 002ABDFF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 35226f8b8a453f8daa54adc3ced5eea70a454ef9c5236c4d09026060c9b90a38
Instruction ID: 8ea407ae55720b88b7ea563beab51adb72eb02173553e5c765af3d54641080a8
Opcode Fuzzy Hash: 35226f8b8a453f8daa54adc3ced5eea70a454ef9c5236c4d09026060c9b90a38
Instruction Fuzzy Hash: 5D818930228241AFC715DF64C885E2ABBE5BF85308F14896DF4598B2A2CB31ED55CF92

Function 0027F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0027F7B9
SysAllocString.OLEAUT32(00000001), ref: 0027F860
VariantCopy.OLEAUT32(0027FA64,00000000), ref: 0027F889
VariantClear.OLEAUT32(0027FA64), ref: 0027F8AD
VariantCopy.OLEAUT32(0027FA64,00000000), ref: 0027F8B1
VariantClear.OLEAUT32(?), ref: 0027F8BB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 13c79cbfaa5e4a7e4fb1973e8d890e2de21a24a64510e13c778bad2891c5877d
Instruction ID: 2466174334a6daa1055e3ee581a22a536ed9bab5321bb4e92d9c35a8a5f4e039
Opcode Fuzzy Hash: 13c79cbfaa5e4a7e4fb1973e8d890e2de21a24a64510e13c778bad2891c5877d
Instruction Fuzzy Hash: 8A51E631538310FACF90AF65D995769B3A4EF45310F24D467E909EF291DB708C60CB66

Function 0029910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00227620: _wcslen.LIBCMT ref: 00227625

Part of subcall function 00226B57: _wcslen.LIBCMT ref: 00226B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 002994E5
_wcslen.LIBCMT ref: 00299506
_wcslen.LIBCMT ref: 0029952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00299585

Strings

X, xrefs: 00299412

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 1b15e30637e62331e9a0feb6d68036c254a9d61c08163add4259fc0090e6c2c9
Instruction ID: 8fedefe05375ee78b772d7575aa645b6ea187e90cec8c3570f4f6181d2d76f8b
Opcode Fuzzy Hash: 1b15e30637e62331e9a0feb6d68036c254a9d61c08163add4259fc0090e6c2c9
Instruction Fuzzy Hash: 08E1C4315283519FCB14DF68D481B6AB7E4BF84310F04896DF8899B2A2DB31DD65CF92

Function 0023920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

BeginPaint.USER32(?,?,?), ref: 00239241
GetWindowRect.USER32(?,?), ref: 002392A5
ScreenToClient.USER32(?,?), ref: 002392C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 002392D3
EndPaint.USER32(?,?,?,?,?), ref: 00239321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 002771EA

Part of subcall function 00239339: BeginPath.GDI32(00000000), ref: 00239357

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 090b1565247434f0cb1d6c8b46c73933e17e21ab0c2aca521832c497355fdee7
Instruction ID: d76a363ca0e910def3fbfdb01436a5db0057230ffdfad465ae6aeb79cf04e6af
Opcode Fuzzy Hash: 090b1565247434f0cb1d6c8b46c73933e17e21ab0c2aca521832c497355fdee7
Instruction Fuzzy Hash: 8041D2B0114301EFD710DF24DC88FBA7BA8EF86360F100669F9A8971A1C7B198A5DF61

Function 002907EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0029080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00290847
EnterCriticalSection.KERNEL32(?), ref: 00290863
LeaveCriticalSection.KERNEL32(?), ref: 002908DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 002908F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00290921

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 4cd22c6bae9d538d1de96f13b61f79efc9090c3aa3e64e382bf50c3e4c712add
Instruction ID: 038c306e1cb3fc88798a1023446ae78c4d53ab22eda94c34df63ce8b4d7de293
Opcode Fuzzy Hash: 4cd22c6bae9d538d1de96f13b61f79efc9090c3aa3e64e382bf50c3e4c712add
Instruction Fuzzy Hash: 30416A71A1020AEFEF14AF54ECC5AAA7778FF04700F1440A9ED04AE296D730DE65DBA0

Function 002B81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0027F3AB,00000000,?,?,00000000,?,0027682C,00000004,00000000,00000000), ref: 002B824C
EnableWindow.USER32(?,00000000), ref: 002B8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 002B82D1
ShowWindow.USER32(?,00000004), ref: 002B82E5
EnableWindow.USER32(?,00000001), ref: 002B830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 002B832F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 07e55c1644076427f8248bce33457f896992a6b2df8e9dbebbc29c94689fb349
Instruction ID: 5e6ab0d095d7d733dd19f3fc714eece2dcbfaf77f5228f0b053e734547087164
Opcode Fuzzy Hash: 07e55c1644076427f8248bce33457f896992a6b2df8e9dbebbc29c94689fb349
Instruction Fuzzy Hash: 9E41B434601685EFDB15CF14D899BF47BE8BB4A794F1842A9E90C4F262CB71AC61CB50

Function 00284C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00284C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00284CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00284CEA
_wcslen.LIBCMT ref: 00284D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00284D10
_wcsstr.LIBVCRUNTIME ref: 00284D1A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 71f70e8efd141847c557208c9a5c546e08e9a7cc9d5d198b265341ed42ff5189
Instruction ID: 0691a0176da34c5591864c7f82100f16616a9973bc9723ffd27c65f60395684a
Opcode Fuzzy Hash: 71f70e8efd141847c557208c9a5c546e08e9a7cc9d5d198b265341ed42ff5189
Instruction Fuzzy Hash: C3213B76615202BBEB197F35EC09E7B7B9CDF45750F10803AF805CA1D1EAA1DC2197A0

Function 0029581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00223AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00223A97,?,?,00222E7F,?,?,?,00000000), ref: 00223AC2

_wcslen.LIBCMT ref: 0029587B
CoInitialize.OLE32(00000000), ref: 00295995
CoCreateInstance.OLE32(002BFCF8,00000000,00000001,002BFB68,?), ref: 002959AE
CoUninitialize.OLE32 ref: 002959CC

Strings

.lnk, xrefs: 00295876, 002958C1, 00295985

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 859cb4438573d5c8cc7db0437e77098b4d3d7274c66a25e7993ded91fd8b75ad
Instruction ID: 959a8b6febca7557382ba8506eb6dceff87837e28a818ffd44d95fbe5518881c
Opcode Fuzzy Hash: 859cb4438573d5c8cc7db0437e77098b4d3d7274c66a25e7993ded91fd8b75ad
Instruction Fuzzy Hash: A6D17271628621AFDB05DF24C490A2ABBE1FF89314F14885DF8899B361DB31EC55CF92

Function 0028175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00280FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00280FCA
Part of subcall function 00280FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00280FD6
Part of subcall function 00280FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00280FE5
Part of subcall function 00280FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00280FEC
Part of subcall function 00280FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00281002

GetLengthSid.ADVAPI32(?,00000000,00281335), ref: 002817AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 002817BA
HeapAlloc.KERNEL32(00000000), ref: 002817C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 002817DA
GetProcessHeap.KERNEL32(00000000,00000000,00281335), ref: 002817EE
HeapFree.KERNEL32(00000000), ref: 002817F5

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 88989617ce4e44d41ea74ee935104e10554027dcab321318de6b7728558e5c6d
Instruction ID: 5e3f5e8bd8164aaa7267f7e8eed4afe4595c3ff0add27ca50fc153e7774fd361
Opcode Fuzzy Hash: 88989617ce4e44d41ea74ee935104e10554027dcab321318de6b7728558e5c6d
Instruction Fuzzy Hash: 8A11E175522205FFDB10AFA4EC48BAEBBBCEF41355F20411DF441A7190C735A921CB60

Function 002814CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 002814FF
OpenProcessToken.ADVAPI32(00000000), ref: 00281506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00281515
CloseHandle.KERNEL32(00000004), ref: 00281520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0028154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00281563

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 08838b58c6c639885cad34a5aa260ba016fdf073e284f811cef99134009df26e
Instruction ID: a1e86b4f58a2f999f962d193ce70bcba4719913ed2ccc6a1991a9860041dba7f
Opcode Fuzzy Hash: 08838b58c6c639885cad34a5aa260ba016fdf073e284f811cef99134009df26e
Instruction Fuzzy Hash: E811677650520EABDF11AFA8ED49FDE7BADEF48704F144164FA05A20A0C375CE61EB60

Function 00243382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00243379,00242FE5), ref: 00243390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0024339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002433B7
SetLastError.KERNEL32(00000000,?,00243379,00242FE5), ref: 00243409

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 685c08f63da4637052a42bd487c2e0c144e94259bda4bb518f8d3ea05735e739
Instruction ID: 68b46e97575bc92dc673a2f2b6d238bf5eef71b08eccbb43c58d8aab29cc0577
Opcode Fuzzy Hash: 685c08f63da4637052a42bd487c2e0c144e94259bda4bb518f8d3ea05735e739
Instruction Fuzzy Hash: CC012D33238313BEA61C6FB4BCC95661E94D7053753300229F420841F5EF114E325D84

Function 00252D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00255686,00263CD6,?,00000000,?,00255B6A,?,?,?,?,?,0024E6D1,?,002E8A48), ref: 00252D78
_free.LIBCMT ref: 00252DAB
_free.LIBCMT ref: 00252DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0024E6D1,?,002E8A48,00000010,00224F4A,?,?,00000000,00263CD6), ref: 00252DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0024E6D1,?,002E8A48,00000010,00224F4A,?,?,00000000,00263CD6), ref: 00252DEC
_abort.LIBCMT ref: 00252DF2

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 053f84fe7b2a967af9a35335e1bbae65e88767b6ddc22e31df4a0be862b62c36
Instruction ID: eaa3a5925dcbe909c3bbaa9e439a426088568a45870a52b5a94861b8143ed143
Opcode Fuzzy Hash: 053f84fe7b2a967af9a35335e1bbae65e88767b6ddc22e31df4a0be862b62c36
Instruction Fuzzy Hash: 95F0F932566901E7C21227747C0AE5A2665ABC37A3F344119FC24E62D2DF308C3D4528

Function 002B8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00239639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00239693
Part of subcall function 00239639: SelectObject.GDI32(?,00000000), ref: 002396A2
Part of subcall function 00239639: BeginPath.GDI32(?), ref: 002396B9
Part of subcall function 00239639: SelectObject.GDI32(?,00000000), ref: 002396E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 002B8A4E
LineTo.GDI32(?,00000003,00000000), ref: 002B8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 002B8A70
LineTo.GDI32(?,00000000,00000003), ref: 002B8A80
EndPath.GDI32(?), ref: 002B8A90
StrokePath.GDI32(?), ref: 002B8AA0

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 2b6ac35928da84aefa9b28fb8ffe0392dd3a210d50d3fdb37de2358e10743c7b
Instruction ID: 04c7e0e233a595fb44ecc7c4a629931dda95a0af18ebe9021f88375bcfb9e8a1
Opcode Fuzzy Hash: 2b6ac35928da84aefa9b28fb8ffe0392dd3a210d50d3fdb37de2358e10743c7b
Instruction Fuzzy Hash: 89110976400149FFDB129F94EC88EAA7F6CEB08390F148522BA199A1A1C7719D65DFA0

Function 002851FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00285218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00285229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00285230
ReleaseDC.USER32(00000000,00000000), ref: 00285238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0028524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00285261

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 0f92f27a72f2199fa50ed41edc35be20eab36a12c6e4dd0e8a3fa156c03ea007
Instruction ID: fac198f173bc03a3f69100a48abf4ba99dc4fd1c06fe5af6eace2cdfbfd2461d
Opcode Fuzzy Hash: 0f92f27a72f2199fa50ed41edc35be20eab36a12c6e4dd0e8a3fa156c03ea007
Instruction Fuzzy Hash: C001A775E05715BBEB106FA99C49E4EBFB8EF44351F144165FA04A7281DA709C10CF60

Function 00221BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00221BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00221BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00221C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00221C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00221C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00221C22

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: dccd7a8c5ca0d5a86ebad2a436ad427afe7b8117fbaf50dcec16b7233fe9232f
Instruction ID: 06e1cef72db98325e859727a62d527820acf9c16e1b36b2508b85fb5923b9ad0
Opcode Fuzzy Hash: dccd7a8c5ca0d5a86ebad2a436ad427afe7b8117fbaf50dcec16b7233fe9232f
Instruction Fuzzy Hash: D80167B0902B5ABDE3008F6A8C85B52FFA8FF59354F00411BA15C4BA42C7F5A864CBE5

Function 0028EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0028EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0028EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0028EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0028EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0028EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0028EB75

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: f28b9119e2c4cd7d6495aa5e3f3b6ca54a7a7aeccf4f183bfa627be8efec39a1
Instruction ID: abedc2bdb503b9108d79dd90895db5a41ecfd2b3a11af6bb859176c90d36e4ff
Opcode Fuzzy Hash: f28b9119e2c4cd7d6495aa5e3f3b6ca54a7a7aeccf4f183bfa627be8efec39a1
Instruction Fuzzy Hash: 35F05472141159BBE7215B52EC0EEEF3F7CEFCAB11F100269F601E1091E7A05A01C6B5

Function 00277439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00277452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00277469
GetWindowDC.USER32(?), ref: 00277475
GetPixel.GDI32(00000000,?,?), ref: 00277484
ReleaseDC.USER32(?,00000000), ref: 00277496
GetSysColor.USER32(00000005), ref: 002774B0

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: b97879ebfa1e5d989d1967a66daf76f261e583c10294b8e0fae03f0ba0feb229
Instruction ID: b16a7aebe375edefe6a1fb11e3c11cbf995b57943ac596bf0c1083ad1385f0e1
Opcode Fuzzy Hash: b97879ebfa1e5d989d1967a66daf76f261e583c10294b8e0fae03f0ba0feb229
Instruction Fuzzy Hash: 62014B31410215EFDB515F64EC0CFAA7BB9FB44321F654264F919A21A1CB711E61EB50

Function 00281874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0028187F
UnloadUserProfile.USERENV(?,?), ref: 0028188B
CloseHandle.KERNEL32(?), ref: 00281894
CloseHandle.KERNEL32(?), ref: 0028189C
GetProcessHeap.KERNEL32(00000000,?), ref: 002818A5
HeapFree.KERNEL32(00000000), ref: 002818AC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 4a9423c803ed76118158ff25e6375626432e6cb5b18f6e7983e459adca52d0a3
Instruction ID: 099ed2cab3953b9cc211a0ca24171806cd0c6a9d048f5292234ba7c7375ecfbf
Opcode Fuzzy Hash: 4a9423c803ed76118158ff25e6375626432e6cb5b18f6e7983e459adca52d0a3
Instruction Fuzzy Hash: A4E0E576004101BBDB016FA5FD0C90ABF79FF49B22B608331F22991070CB329420DF60

Function 0022BBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0022BEB3

Strings

D%/, xrefs: 0022BE9A
D%/, xrefs: 0022BCA2
D%/, xrefs: 0022BDED, 0022BD91, 0022BD1B
D%/D%/, xrefs: 0022BCA5

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%/$D%/$D%/$D%/D%/
API String ID: 1385522511-677403568
Opcode ID: f1519675473f55bac6205b0614cb2a93c985eb31696e4ceca185db086e4f919e
Instruction ID: 15cda14968cf3f8b47712ee912e0346dc540d7f28611298c62d0f9669095e722
Opcode Fuzzy Hash: f1519675473f55bac6205b0614cb2a93c985eb31696e4ceca185db086e4f919e
Instruction Fuzzy Hash: CA917E75A2021AEFCB19CF98D0906B9B7F1FF59310F60816AD941AB350D771ADA1CF90

Function 002A7B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00240242: EnterCriticalSection.KERNEL32(002F070C,002F1884,?,?,0023198B,002F2518,?,?,?,002212F9,00000000), ref: 0024024D
Part of subcall function 00240242: LeaveCriticalSection.KERNEL32(002F070C,?,0023198B,002F2518,?,?,?,002212F9,00000000), ref: 0024028A

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 002400A3: __onexit.LIBCMT ref: 002400A9

__Init_thread_footer.LIBCMT ref: 002A7BFB

Part of subcall function 002401F8: EnterCriticalSection.KERNEL32(002F070C,?,?,00238747,002F2514), ref: 00240202
Part of subcall function 002401F8: LeaveCriticalSection.KERNEL32(002F070C,?,00238747,002F2514), ref: 00240235

Strings

+T', xrefs: 002A7E2E
5, xrefs: 002A7C78
G, xrefs: 002A7C7F
Variable must be of type 'Object'., xrefs: 002A7C3A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +T'$5$G$Variable must be of type 'Object'.
API String ID: 535116098-127623859
Opcode ID: cf8ab7dbd237c251a0ab258d509247a130f3be006666f091ffd74926c4232118
Instruction ID: f38bd7fb663006bdde01923197a8478c399b72742f5777fce33bb1791591b525
Opcode Fuzzy Hash: cf8ab7dbd237c251a0ab258d509247a130f3be006666f091ffd74926c4232118
Instruction Fuzzy Hash: 2F919D70A24209EFCB04EF94D8919BDB7B2FF4A300F50805AF8069B291DB71AE65CF55

Function 0028C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00227620: _wcslen.LIBCMT ref: 00227625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0028C6EE
_wcslen.LIBCMT ref: 0028C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0028C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0028C7CA

Strings

0, xrefs: 0028C6AF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 2c1a9a04bf73293ba4fea4c0204fd52380c49ef695035aea48ca6a554c1afd5a
Instruction ID: 879e37b084341de292441175ede1e7ceae5c8f016e69b693639420a67ca3d518
Opcode Fuzzy Hash: 2c1a9a04bf73293ba4fea4c0204fd52380c49ef695035aea48ca6a554c1afd5a
Instruction Fuzzy Hash: 0A51D1756363129BD714AF28D885A6BB7E8AF89310F240A39F995D31D0DB70D824CF62

Function 002AAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 002AAEA3

Part of subcall function 00227620: _wcslen.LIBCMT ref: 00227625

GetProcessId.KERNEL32(00000000), ref: 002AAF38
CloseHandle.KERNEL32(00000000), ref: 002AAF67

Strings

@, xrefs: 002AAE72
<, xrefs: 002AAE6B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: e04e35cebf969e10e749f2f0d2eca8250639b2747bf0631110655337eb99e8f8
Instruction ID: c8ebde727f6327f873ed59ff950858555ce993e4d3e153c04ec9cf9dc83a79de
Opcode Fuzzy Hash: e04e35cebf969e10e749f2f0d2eca8250639b2747bf0631110655337eb99e8f8
Instruction Fuzzy Hash: 85718870A10225DFCB14DF94D484A9EBBF0BF09300F0484A9E816AB762CB75ED65CF91

Function 0028719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00287206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0028723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0028724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 002872CF

Strings

DllGetClassObject, xrefs: 00287242

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 4e4745606e8a69c729cef1be663c2cd9c3e60b20e58f13ddc6363285b5cff1d8
Instruction ID: de09e141d790da693498bc0793462f507afc18a632c2dbff834f390f5be148f1
Opcode Fuzzy Hash: 4e4745606e8a69c729cef1be663c2cd9c3e60b20e58f13ddc6363285b5cff1d8
Instruction Fuzzy Hash: E0419175625204EFEB15DF54C884A9A7BB9EF44310F2480A9BD099F29ED7B0D950CBA0

Function 002B3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002B3E35
IsMenu.USER32(?), ref: 002B3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 002B3E92
DrawMenuBar.USER32 ref: 002B3EA5

Strings

0, xrefs: 002B3D89

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 17177dde31c2bdc989f706811a39668d88c8c48cf233daf6d0842d2483a899ea
Instruction ID: 4f06afdb769f6be470af4d8c9dede952d2e99d14fc0a7a5d4dad5bccb7aaefaf
Opcode Fuzzy Hash: 17177dde31c2bdc989f706811a39668d88c8c48cf233daf6d0842d2483a899ea
Instruction Fuzzy Hash: 2A414D75A2020AEFDB10DF50D884AEA77B5FF44394F04412AF915AB250D770EE64CF60

Function 00281DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 00283CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00283CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00281E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00281E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00281EA9

Part of subcall function 00226B57: _wcslen.LIBCMT ref: 00226B6A

Strings

ListBox, xrefs: 00281E25
ComboBox, xrefs: 00281DF0

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 7e6a0135660b87b89a7bc702dbea09db86e4d6a942207cf8b2c44ffd7307cf9c
Instruction ID: 71e2d02090c7a310d0e4619aebc228031755181512d851a553aac1b1fde39a25
Opcode Fuzzy Hash: 7e6a0135660b87b89a7bc702dbea09db86e4d6a942207cf8b2c44ffd7307cf9c
Instruction Fuzzy Hash: 99212375A21104BADB18AFA4EC49CFFB7BCEF46354F144129F825A31E0DB74493A8B20

Function 002B2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 002B2F8D
LoadLibraryW.KERNEL32(?), ref: 002B2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 002B2FA9
DestroyWindow.USER32(?), ref: 002B2FB1

Strings

SysAnimate32, xrefs: 002B2F68

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: bd6606eed5802e324a398fd16f6bb8784dd7cbb16ecf02b924b49da0b594839e
Instruction ID: 5068b21f97ac37a00496beb0134ab3635544f716c1e6092bff22ad9bf4fa6315
Opcode Fuzzy Hash: bd6606eed5802e324a398fd16f6bb8784dd7cbb16ecf02b924b49da0b594839e
Instruction Fuzzy Hash: 54218872220206EBEB104EA4AC88EBB37B9EB593A4F104228FA5092590D671DC659B60

Function 00244D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00244D1E,002528E9,?,00244CBE,002528E9,002E88B8,0000000C,00244E15,002528E9,00000002), ref: 00244D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00244DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00244D1E,002528E9,?,00244CBE,002528E9,002E88B8,0000000C,00244E15,002528E9,00000002,00000000), ref: 00244DC3

Strings

mscoree.dll, xrefs: 00244D86
CorExitProcess, xrefs: 00244D98

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a974e1230b3cc50f979cdee9da74a6d2cdc618211ef67181fb9c18dd91e3a752
Instruction ID: 14db5f2fecd2339640cbe833478f90a60685953657a1aa7a4c3e596a4a88186a
Opcode Fuzzy Hash: a974e1230b3cc50f979cdee9da74a6d2cdc618211ef67181fb9c18dd91e3a752
Instruction Fuzzy Hash: 15F0C830960208FBDB195F94EC4DB9DBFF4EF04711F100198F909A2250CB705D50CB90

Function 0027D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0027D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0027D3BF
FreeLibrary.KERNEL32(00000000), ref: 0027D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0027D3B9
X64, xrefs: 0027D2A8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: a0131586833bdb846248f94a49f41dbff70a856ed0ad086c403f2dc8d5bd3dea
Instruction ID: 8807371132b33ef4046de6d83179c301bb8b2844e3e17a6e7442b18734a3cc85
Opcode Fuzzy Hash: a0131586833bdb846248f94a49f41dbff70a856ed0ad086c403f2dc8d5bd3dea
Instruction Fuzzy Hash: 3BF020718366228BD3645B249C4C9697334AF10B01BA1C2A4F90EF205ADBB0CDB18A92

Function 00224E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00224EDD,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00224EAE
FreeLibrary.KERNEL32(00000000,?,?,00224EDD,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224EC0

Strings

kernel32.dll, xrefs: 00224E94
Wow64DisableWow64FsRedirection, xrefs: 00224EA8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 4f8aae1596bc55ecc7c9066e29a4fc18c26c0c29303b1c2715dedb61560ebfce
Instruction ID: ce20dde6c8d959ebbc9b6a5bf77957622f2fc915f8ef579e63089500c6d4e730
Opcode Fuzzy Hash: 4f8aae1596bc55ecc7c9066e29a4fc18c26c0c29303b1c2715dedb61560ebfce
Instruction Fuzzy Hash: 63E0CD75A316336BE2322F69BC1CB5F6558AF82F637160215FD04F3200DBA0CD1240B0

Function 00224E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00263CDE,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00224E74
FreeLibrary.KERNEL32(00000000,?,?,00263CDE,?,002F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00224E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00224E6E
kernel32.dll, xrefs: 00224E5B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 4803f4a184d942796e14c9d7ec2b9540195e2208d90204af1587eeff6120ffff
Instruction ID: 3b52f20a9861f4e747029060e04851247c41e4216339a516be838d9740af1cff
Opcode Fuzzy Hash: 4803f4a184d942796e14c9d7ec2b9540195e2208d90204af1587eeff6120ffff
Instruction Fuzzy Hash: 2DD01235532633676A222F697C1CD8F6A18AF86B553960615F919B6124CF60CD2285E0

Function 00292947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00292C05
DeleteFileW.KERNEL32(?), ref: 00292C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00292C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00292CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00292CC0

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 8ae7d2043fb983f642299c483f9e5daf815687dc46bbbe01b23b3cc14f9ae509
Instruction ID: b05a2eaa58a5c33e53e766d3210df3403c68747b93974aa73c9d43d1bd2807d6
Opcode Fuzzy Hash: 8ae7d2043fb983f642299c483f9e5daf815687dc46bbbe01b23b3cc14f9ae509
Instruction Fuzzy Hash: FEB15D72D20129BBDF25DFA4DC85EDEB7BDEF08350F1040A6F509E6141EA709A588F61

Function 002AA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 002AA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 002AA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 002AA468
CloseHandle.KERNEL32(?), ref: 002AA63D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: f52b7c9ac2f7eb8f37f08143e7f7d5d297f6f875887ac19159538a8f72a2953a
Instruction ID: 483e00f1cad213f23d28c3d3d7c75a382adb26c9019f6e79ad52c334d3206730
Opcode Fuzzy Hash: f52b7c9ac2f7eb8f37f08143e7f7d5d297f6f875887ac19159538a8f72a2953a
Instruction Fuzzy Hash: 7AA1D071614301AFD720DF24D886F2AB7E5AF88714F14885DF55A9B292DBB0EC50CF92

Function 0025BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,002C3700), ref: 0025BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,002F121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0025BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,002F1270,000000FF,?,0000003F,00000000,?), ref: 0025BC36
_free.LIBCMT ref: 0025BB7F

Part of subcall function 002529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000), ref: 002529DE
Part of subcall function 002529C8: GetLastError.KERNEL32(00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000,00000000), ref: 002529F0

_free.LIBCMT ref: 0025BD4B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 2cd09a4eec052abcbd54911a19754d407360c9ccd3958cce8f6a24229094c7f1
Instruction ID: 18082d49278fc21071e7788040473c5d6cc5b316cc1ffdb7db4d1898343563c1
Opcode Fuzzy Hash: 2cd09a4eec052abcbd54911a19754d407360c9ccd3958cce8f6a24229094c7f1
Instruction Fuzzy Hash: 83514C71810219EFCB11EFA5DC859BEB7BCEF41362B10026AEC10E7191EB708D68CB58

Function 0028E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0028DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0028CF22,?), ref: 0028DDFD

Part of subcall function 0028DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0028CF22,?), ref: 0028DE16

Part of subcall function 0028E199: GetFileAttributesW.KERNEL32(?,0028CF95), ref: 0028E19A

lstrcmpiW.KERNEL32(?,?), ref: 0028E473
MoveFileW.KERNEL32(?,?), ref: 0028E4AC
_wcslen.LIBCMT ref: 0028E5EB
_wcslen.LIBCMT ref: 0028E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0028E650

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: d8558c4bf1a3e9981e88a33eb7c43ade96a58943f8ab8bccfe9e89a0dbda3627
Instruction ID: 591a294ea8a682657c45ea73c0441d0093d31e968449119288437c685acbeee6
Opcode Fuzzy Hash: d8558c4bf1a3e9981e88a33eb7c43ade96a58943f8ab8bccfe9e89a0dbda3627
Instruction Fuzzy Hash: 795173B64193455BCB24EFA0D8819DF73ECAF84340F40492EF689D3191EF74A6988B66

Function 002AB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 002AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,002AB6AE,?,?), ref: 002AC9B5
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002AC9F1
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002ACA68
Part of subcall function 002AC998: _wcslen.LIBCMT ref: 002ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002ABAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002ABB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 002ABB63
RegCloseKey.ADVAPI32(?,?), ref: 002ABBA6
RegCloseKey.ADVAPI32(00000000), ref: 002ABBB3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: ec273c88c30b7675fa8c1eb30d5dc83f8f5b71b40caf76ace5f87f41b4fbbe16
Instruction ID: 735b67b57cc732e54e50f4b908c6c1ad1505c922aa68d87ddee5cc4301ac6240
Opcode Fuzzy Hash: ec273c88c30b7675fa8c1eb30d5dc83f8f5b71b40caf76ace5f87f41b4fbbe16
Instruction Fuzzy Hash: B761AF31228241AFC315DF64C490E2ABBE5FF85308F54895CF4998B2A2CB31ED55CF92

Function 00288BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00288BCD
VariantClear.OLEAUT32 ref: 00288C3E
VariantClear.OLEAUT32 ref: 00288C9D
VariantClear.OLEAUT32(?), ref: 00288D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00288D3B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 8282d766589e958d15a6c2af087e6224a2aed18104329afd457a0c6fdf4ab893
Instruction ID: 8a39b92e08b944860c80a9e51f2568e8716cbc27672c1d386140555fb6f74675
Opcode Fuzzy Hash: 8282d766589e958d15a6c2af087e6224a2aed18104329afd457a0c6fdf4ab893
Instruction Fuzzy Hash: 10518AB5A11219EFCB14DF28C884AAAB7F8FF89310B158569E905DB350E730E921CF90

Function 00298AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00298BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00298BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00298C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00298C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00298C5F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 7adcde813ca0c73bb6fb823879ec7380e8cc24ba3192b55e1249bc498eddf668
Instruction ID: 5ff6914af2344a6f0cfdc3c09fe01510f77f548d966b8788a5d4bbd6beddff85
Opcode Fuzzy Hash: 7adcde813ca0c73bb6fb823879ec7380e8cc24ba3192b55e1249bc498eddf668
Instruction Fuzzy Hash: 9C514835A10219AFCB05DFA4D884A6DBBF5FF49314F088059E849AB362CB35ED61CF90

Function 002A8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 002A8F40
GetProcAddress.KERNEL32(00000000,?), ref: 002A8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 002A8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 002A9032
FreeLibrary.KERNEL32(00000000), ref: 002A9052

Part of subcall function 0023F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00291043,?,7644E610), ref: 0023F6E6
Part of subcall function 0023F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0027FA64,00000000,00000000,?,?,00291043,?,7644E610,?,0027FA64), ref: 0023F70D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 669425a4fc90ac0690ce71f201903a7b84bb1860e8acf43aeb50de2a8abb7a1e
Instruction ID: 4d1cf0ae328736118ed73744a4c29d2e709f04d15f9e82bced832cbe55334386
Opcode Fuzzy Hash: 669425a4fc90ac0690ce71f201903a7b84bb1860e8acf43aeb50de2a8abb7a1e
Instruction Fuzzy Hash: 00514A34610216EFC711DF68D4848ADBBB1FF4A314F5480A8E819AB762DB31ED95CF90

Function 002B6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 002B6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 002B6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 002B6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0029AB79,00000000,00000000), ref: 002B6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 002B6CC7

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 8453de23c78bdb2ed8f8e5db2454ddd98446dab61c36565f46684d6e48d705ec
Instruction ID: d6cc31722bee8d7f4e1e40a35bca2173821d59868ed5b8661f28927530909269
Opcode Fuzzy Hash: 8453de23c78bdb2ed8f8e5db2454ddd98446dab61c36565f46684d6e48d705ec
Instruction Fuzzy Hash: 4B41B235624105AFD724CF68CC5CFF97FA5EB093A0F140269F995A72E0C3B5AD61CA90

Function 00252051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 002520C3
_free.LIBCMT ref: 002520E3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d7c00508dfd03e8f5ec28f9609ae9273d03f66b27299dd049cfc1842b96423c0
Instruction ID: 7db52e9b8133a484b0b79a6e64f95253210a1f602c79cf93228997ec16715a7f
Opcode Fuzzy Hash: d7c00508dfd03e8f5ec28f9609ae9273d03f66b27299dd049cfc1842b96423c0
Instruction Fuzzy Hash: 5541E472E10200DFCB24DF78C980A5EB3A5EF8A314F258568E915EB3D2D731AD19CB94

Function 0023912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00239141
ScreenToClient.USER32(00000000,?), ref: 0023915E
GetAsyncKeyState.USER32(00000001), ref: 00239183
GetAsyncKeyState.USER32(00000002), ref: 0023919D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 2961968ce8457940772cfd749ea75a2b90f3b5f956a910e345c5d8984c2ced6b
Instruction ID: 9eff21cd682185dd78cea891292ac311a2fcf4052203ca596f7a6a99d9e0f761
Opcode Fuzzy Hash: 2961968ce8457940772cfd749ea75a2b90f3b5f956a910e345c5d8984c2ced6b
Instruction Fuzzy Hash: 0A416071A1861BFBDF159F64C848BEEB774FB05320F208216E46DA3290C77059A4DF91

Function 00293874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 002938CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00293922
TranslateMessage.USER32(?), ref: 0029394B
DispatchMessageW.USER32(?), ref: 00293955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00293966

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 989da1d681fa4078d405b5df84f58c943e98291d91150ad351279fcc5d169a0f
Instruction ID: 07e58cf428c6ed6f418039f30d53c6e6b0c086db3fef0be0b1c47813e2c15880
Opcode Fuzzy Hash: 989da1d681fa4078d405b5df84f58c943e98291d91150ad351279fcc5d169a0f
Instruction Fuzzy Hash: A831E070924342DEFF35CF34A80CBB637E8AB11350F54056DE466C21A0E3F0AAA4CB21

Function 0029CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0029C21E,00000000), ref: 0029CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0029CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0029C21E,00000000), ref: 0029CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0029C21E,00000000), ref: 0029CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0029C21E,00000000), ref: 0029CFF2

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: c60d0f257c04f5c24db19f6007dd9a2fc91751f120873a2fac7568abaf268520
Instruction ID: 04bf6a2ca544a33dee44ed5a226bb86f821c514e95b789d5d81922fd62447912
Opcode Fuzzy Hash: c60d0f257c04f5c24db19f6007dd9a2fc91751f120873a2fac7568abaf268520
Instruction Fuzzy Hash: BB315EB1920206EFDF20DFA5D9889ABBBF9EF14350B20442FF506D2551DB30AE50DB60

Function 00281901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00281915
PostMessageW.USER32(00000001,00000201,00000001), ref: 002819C1
Sleep.KERNEL32(00000000,?,?,?), ref: 002819C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 002819DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 002819E2

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 41f76b9e6c0bea590852b47c4951a26aa7c77987e4524a2fb874fa958517831a
Instruction ID: c4d460bc1638b9f770c316215482a62b0d63feb1277a99551fe958143a74e534
Opcode Fuzzy Hash: 41f76b9e6c0bea590852b47c4951a26aa7c77987e4524a2fb874fa958517831a
Instruction Fuzzy Hash: 8A31F175910219EFCB04CFA8DC88AEE3BB9EB44314F104325F961A72D0C3B09961CB90

Function 002B5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 002B5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 002B579D
_wcslen.LIBCMT ref: 002B57AF
_wcslen.LIBCMT ref: 002B57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 002B5816

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 66328fb701b3b1d392bfe6645eca697e8f89bd91f5f15503c6f8b4ed732c3e38
Instruction ID: d7c1cc0430942c0ff4a9091762419a21510f3fa569f70c61f580398a65b8756f
Opcode Fuzzy Hash: 66328fb701b3b1d392bfe6645eca697e8f89bd91f5f15503c6f8b4ed732c3e38
Instruction Fuzzy Hash: CD216471924629DADB209F60DC45BEDB778FF447A4F104216FA299E180D77089A5CF50

Function 002A0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 002A0951
GetForegroundWindow.USER32 ref: 002A0968
GetDC.USER32(00000000), ref: 002A09A4
GetPixel.GDI32(00000000,?,00000003), ref: 002A09B0
ReleaseDC.USER32(00000000,00000003), ref: 002A09E8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: f451c41feec071cdb4b995bff4ded39dd2dddcccdb6b3504caf340afa0a5d7f2
Instruction ID: 7349af73c457e2f4e03a34af2d4ebb6c8dee22676fc25f56128aab0ab71cd890
Opcode Fuzzy Hash: f451c41feec071cdb4b995bff4ded39dd2dddcccdb6b3504caf340afa0a5d7f2
Instruction Fuzzy Hash: 22218435610214AFD704EFA9D889A5EB7E9EF45700F14816DF85A97752CB70AC14CF50

Function 0025CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0025CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0025CDE9

Part of subcall function 00253820: RtlAllocateHeap.NTDLL(00000000,?,002F1444,?,0023FDF5,?,?,0022A976,00000010,002F1440,002213FC,?,002213C6,?,00221129), ref: 00253852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0025CE0F
_free.LIBCMT ref: 0025CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0025CE31

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 223016f828e9291ddb5936244c36f995b13f9f8a4d64b2c61108095f165f30f8
Instruction ID: abb17648a81539489499f73aafad70cdd42b1dd1a9067327400f0659c6473e63
Opcode Fuzzy Hash: 223016f828e9291ddb5936244c36f995b13f9f8a4d64b2c61108095f165f30f8
Instruction Fuzzy Hash: 9201D8726213167F23211A7A6C4EC7B696DDEC6BA23350229FD05D7200FA71CD2581B8

Function 00239639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00239693
SelectObject.GDI32(?,00000000), ref: 002396A2
BeginPath.GDI32(?), ref: 002396B9
SelectObject.GDI32(?,00000000), ref: 002396E2

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 9584fab8e47dd395ce5c864e015535301058d29aab809fd36a14bd7fc8abb076
Instruction ID: 0d08cc0fb945da646d9eaf57eb9237d74145f71694b6282dc2fa487df5c8f995
Opcode Fuzzy Hash: 9584fab8e47dd395ce5c864e015535301058d29aab809fd36a14bd7fc8abb076
Instruction Fuzzy Hash: 342160B082224AEBDB119F29FC1D7B93B6CBB117A5F504225F414A61A0D3F098B1CFD0

Function 00285711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00285726
_memcmp.LIBVCRUNTIME ref: 00285744
_memcmp.LIBVCRUNTIME ref: 00285757
_memcmp.LIBVCRUNTIME ref: 0028576F
_memcmp.LIBVCRUNTIME ref: 00285787

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b63e0b020210d9c72265cc327c3ab0d2086fd519a850b8aff002d5086b5b4830
Instruction ID: 348b2b0faea85cca48f136011402f3fe48718256b685254306817db96ca2ba9a
Opcode Fuzzy Hash: b63e0b020210d9c72265cc327c3ab0d2086fd519a850b8aff002d5086b5b4830
Instruction Fuzzy Hash: 9401B9696B2615BBE20CA910DE42FFBB75C9B25394F448031FD049A2C1F760ED7087A4

Function 00252DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0024F2DE,00253863,002F1444,?,0023FDF5,?,?,0022A976,00000010,002F1440,002213FC,?,002213C6), ref: 00252DFD
_free.LIBCMT ref: 00252E32
_free.LIBCMT ref: 00252E59
SetLastError.KERNEL32(00000000,00221129), ref: 00252E66
SetLastError.KERNEL32(00000000,00221129), ref: 00252E6F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 3425ba5f23bf39e712e80b6c2e078cb2a38e10fbe1846e2e1f6e4196ac4eae6e
Instruction ID: d2427e307dad7fdf2ef2dcdd4d842d34696fc833384180448d1ac3bc47b23470
Opcode Fuzzy Hash: 3425ba5f23bf39e712e80b6c2e078cb2a38e10fbe1846e2e1f6e4196ac4eae6e
Instruction Fuzzy Hash: E901F932175A01E7C6126B747C8BD2B2659ABD33A7B344129FC25E22D3EE70AC3D4528

Function 0028000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0027FF41,80070057,?,?,?,0028035E), ref: 0028002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0027FF41,80070057,?,?), ref: 00280046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0027FF41,80070057,?,?), ref: 00280054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0027FF41,80070057,?), ref: 00280064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0027FF41,80070057,?,?), ref: 00280070

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: a2083c27ebc939bbf88e1e6e3787ac091133ad83afae559c6401c7dbae497b78
Instruction ID: 8f4a8d01c39ac0be13e7af29a5af86f1eee13acd0624507203aeaa251b7e2845
Opcode Fuzzy Hash: a2083c27ebc939bbf88e1e6e3787ac091133ad83afae559c6401c7dbae497b78
Instruction Fuzzy Hash: BB01267A611214FFDB515FA8EC88BAA7BFDEF44352F244224F805D2250D771DD049BA0

Function 0028E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0028E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0028E9A5
Sleep.KERNEL32(00000000), ref: 0028E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0028E9B7
Sleep.KERNEL32 ref: 0028E9F3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 1a8acac1279d190ceea47aeab0a9fb688d3265208206c60cc6df9bd7619239c2
Instruction ID: 3d0d86988b0dd15912183d927784d62fafd17c48d20ed25d3d4616f805f64ef0
Opcode Fuzzy Hash: 1a8acac1279d190ceea47aeab0a9fb688d3265208206c60cc6df9bd7619239c2
Instruction Fuzzy Hash: EC016D35C22529DBCF00AFE8EC4D6DDBB78FF08301F110656E942B2180CB709564CB62

Function 002810F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00281114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00280B9B,?,?,?), ref: 00281120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00280B9B,?,?,?), ref: 0028112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00280B9B,?,?,?), ref: 00281136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0028114D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 286891890a9d71a58584e20db3ea77757374e6cef03d38e06bf4d1d3ee14b280
Instruction ID: f4ea56d67171f7d2dc4c0bff51df7479e04be9547e7d210ee0ea9600ed4d2c1f
Opcode Fuzzy Hash: 286891890a9d71a58584e20db3ea77757374e6cef03d38e06bf4d1d3ee14b280
Instruction Fuzzy Hash: CF018179101205BFDB115F64EC4DEAA3F6EEF85360B204425FA45D3390DB31DC109B60

Function 00280FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00280FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00280FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00280FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00280FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00281002

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ac6cbeaa3a0e6d3b335164bc05ddfba23d44a7b2c6d7c4648a161479dd8232c7
Instruction ID: a7148da38a975cd2aa4fbfe89932f2dce981293d98cfb25aa97168fc64f54a9a
Opcode Fuzzy Hash: ac6cbeaa3a0e6d3b335164bc05ddfba23d44a7b2c6d7c4648a161479dd8232c7
Instruction Fuzzy Hash: 35F0C279101301EBD7212FA4EC4DF563BADEF89761F204425FD09D7290CA30DC508B60

Function 00281014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0028102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00281036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00281045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0028104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00281062

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: afe80ba2a4a5c21f42a99dffe63235604d47cc4a4ec9a2e8a0915003ac971214
Instruction ID: 2946468a0922ba78fa7a0fd717c7d3764de37cfb9424234fd4d4d0fcf9924bf7
Opcode Fuzzy Hash: afe80ba2a4a5c21f42a99dffe63235604d47cc4a4ec9a2e8a0915003ac971214
Instruction Fuzzy Hash: A8F0CD79201312EBDB212FA8EC4CF573BADEF89761F200425FE09D7291CA30D8608B60

Function 0029030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0029017D,?,002932FC,?,00000001,00262592,?), ref: 00290324
CloseHandle.KERNEL32(?,?,?,?,0029017D,?,002932FC,?,00000001,00262592,?), ref: 00290331
CloseHandle.KERNEL32(?,?,?,?,0029017D,?,002932FC,?,00000001,00262592,?), ref: 0029033E
CloseHandle.KERNEL32(?,?,?,?,0029017D,?,002932FC,?,00000001,00262592,?), ref: 0029034B
CloseHandle.KERNEL32(?,?,?,?,0029017D,?,002932FC,?,00000001,00262592,?), ref: 00290358
CloseHandle.KERNEL32(?,?,?,?,0029017D,?,002932FC,?,00000001,00262592,?), ref: 00290365

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 57b624b10f7ce1235eb469247b845ef2db406d17dbf29c589a354c46c6cd6092
Instruction ID: c4357eff34d4cad67b2ae1936cd2367e4ed056a8e9b7c18b6ce2c7823b167c86
Opcode Fuzzy Hash: 57b624b10f7ce1235eb469247b845ef2db406d17dbf29c589a354c46c6cd6092
Instruction Fuzzy Hash: F801AE72810B1A9FCB30AF66D8C0816FBF9BF603153158A7FD19652931C3B1A968DF84

Function 0025D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0025D752

Part of subcall function 002529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000), ref: 002529DE
Part of subcall function 002529C8: GetLastError.KERNEL32(00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000,00000000), ref: 002529F0

_free.LIBCMT ref: 0025D764
_free.LIBCMT ref: 0025D776
_free.LIBCMT ref: 0025D788
_free.LIBCMT ref: 0025D79A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e4ce31c8b12759628ea500673370b75b27713b77ac407b75ed616ceb06079c06
Instruction ID: f5405337d6cd145b878048215df7a735b8a58ddd154b0bc6d8cdbda7731980fc
Opcode Fuzzy Hash: e4ce31c8b12759628ea500673370b75b27713b77ac407b75ed616ceb06079c06
Instruction Fuzzy Hash: 45F06832560249EB8635EF54F9C5C56BBDDBB093127B41805F848E7542C730FC988A68

Function 00285C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00285C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00285C6F
MessageBeep.USER32(00000000), ref: 00285C87
KillTimer.USER32(?,0000040A), ref: 00285CA3
EndDialog.USER32(?,00000001), ref: 00285CBD

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: ac3a9bbec0a1b7b6187ea3320b7fda289a158a72c01ee83554c20b189ac8d48f
Instruction ID: 273f377e3eaa33bac6c118050bc33fe5c462869f0a7450e0031f05ab7d55e7ef
Opcode Fuzzy Hash: ac3a9bbec0a1b7b6187ea3320b7fda289a158a72c01ee83554c20b189ac8d48f
Instruction Fuzzy Hash: 59018134511B14ABFB216F10ED4EFA677BCBB00B05F00166AB583A14E1DBF4A9A48F90

Function 002522A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 002522BE

Part of subcall function 002529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000), ref: 002529DE
Part of subcall function 002529C8: GetLastError.KERNEL32(00000000,?,0025D7D1,00000000,00000000,00000000,00000000,?,0025D7F8,00000000,00000007,00000000,?,0025DBF5,00000000,00000000), ref: 002529F0

_free.LIBCMT ref: 002522D0
_free.LIBCMT ref: 002522E3
_free.LIBCMT ref: 002522F4
_free.LIBCMT ref: 00252305

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1db071fca0244fec60901206ea7ddc69d41dabb79f04b4371dcf519500ff9879
Instruction ID: 879c9efd148be99a1362aadb72df5063d7a5c7b01ea13e60e1daa61de81c8d0e
Opcode Fuzzy Hash: 1db071fca0244fec60901206ea7ddc69d41dabb79f04b4371dcf519500ff9879
Instruction Fuzzy Hash: EDF054B4460121DB8713AF94BC498A83B64F7197B2B601626FC14E63F2CB31043ADFE8

Function 002395C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 002395D4
StrokeAndFillPath.GDI32(?,?,002771F7,00000000,?,?,?), ref: 002395F0
SelectObject.GDI32(?,00000000), ref: 00239603
DeleteObject.GDI32 ref: 00239616
StrokePath.GDI32(?), ref: 00239631

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: a438505f8152d24eff81daae2c0aba1b7ea8cb0203913efaec1c7a080898f79a
Instruction ID: 49d1915aadc830d853fa4a09f3fbfee186086769c5a5fb60c75af54bc7f1eee8
Opcode Fuzzy Hash: a438505f8152d24eff81daae2c0aba1b7ea8cb0203913efaec1c7a080898f79a
Instruction Fuzzy Hash: A6F01930026249EBDB126F69FD1C7793B65AB113B2F548324F469550F0C7B089B5DFA0

Function 00250F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 002510F9
__freea.LIBCMT ref: 00251117

Part of subcall function 00251537: _free.LIBCMT ref: 0025154F

Strings

am/pm, xrefs: 0025117A
a/p, xrefs: 002511DE

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 9f84cf6e46497aa6764927e8908b7a7932702da719733053900909016500f8eb
Instruction ID: b3c03a4479d511ba6da97e41bd5606c36e35f67fff374cf9496672bcdd7ccb7d
Opcode Fuzzy Hash: 9f84cf6e46497aa6764927e8908b7a7932702da719733053900909016500f8eb
Instruction Fuzzy Hash: B6D1F531930207EACB249F68C8A5BFAB7B0FF05702F244199ED059B650D3759DB8CB99

Function 002A61D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00240242: EnterCriticalSection.KERNEL32(002F070C,002F1884,?,?,0023198B,002F2518,?,?,?,002212F9,00000000), ref: 0024024D
Part of subcall function 00240242: LeaveCriticalSection.KERNEL32(002F070C,?,0023198B,002F2518,?,?,?,002212F9,00000000), ref: 0024028A

Part of subcall function 002400A3: __onexit.LIBCMT ref: 002400A9

__Init_thread_footer.LIBCMT ref: 002A6238

Part of subcall function 002401F8: EnterCriticalSection.KERNEL32(002F070C,?,?,00238747,002F2514), ref: 00240202
Part of subcall function 002401F8: LeaveCriticalSection.KERNEL32(002F070C,?,00238747,002F2514), ref: 00240235

Part of subcall function 0029359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 002935E4
Part of subcall function 0029359C: LoadStringW.USER32(002F2390,?,00000FFF,?), ref: 0029360A

Strings

x#/, xrefs: 002A6353
x#/, xrefs: 002A633A
x#/, xrefs: 002A636F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#/$x#/$x#/
API String ID: 1072379062-3600581103
Opcode ID: ff67f24447bc04dd187d43e6c17680d5b5453c5c328f0e5cedb5a8765f4fbae8
Instruction ID: 7d29373aa3a85645da91d9b49d3b1aea3781c16bcd76fb7116b8f524448a6f09
Opcode Fuzzy Hash: ff67f24447bc04dd187d43e6c17680d5b5453c5c328f0e5cedb5a8765f4fbae8
Instruction Fuzzy Hash: 56C1B371A2010AAFDB14DF98C894EBEB7B9FF49310F148069F9059B291DB70ED65CB90

Function 00255AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JO", xrefs: 00255BA8, 00255C6C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: JO"
API String ID: 0-550355754
Opcode ID: 070a17d10a6c071d0bf8ba95c25965022680de6810bfc3b5af9d33cb7e4671ad
Instruction ID: fc98933ac9fb4ef9b82b627cd50da5ac9dec6d0235f7c4d4b21f7dd49dff68a2
Opcode Fuzzy Hash: 070a17d10a6c071d0bf8ba95c25965022680de6810bfc3b5af9d33cb7e4671ad
Instruction Fuzzy Hash: AB510671D3062A9FCF10DFA4C959FAE7BB4AF45316F10005AFC04A7291C7719929CB69

Function 00258A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00258B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00258B7A
__dosmaperr.LIBCMT ref: 00258B81

Strings

.$, xrefs: 00258A63

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .$
API String ID: 2434981716-2510666271
Opcode ID: 5c3309bacc8d386d2c3ed3a8b2f258d362d040f7ed06f3360438e1d86ce5c571
Instruction ID: 1b766f853f4f32b5671cb9a430466e06682508a221e15305842aa49513cee003
Opcode Fuzzy Hash: 5c3309bacc8d386d2c3ed3a8b2f258d362d040f7ed06f3360438e1d86ce5c571
Instruction Fuzzy Hash: 2941A070634045AFD7249F14D884A797FE9DB85305F2841A9FC88E7552DDB1CC268798

Function 00282716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0028B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002821D0,?,?,00000034,00000800,?,00000034), ref: 0028B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00282760

Part of subcall function 0028B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002821FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0028B3F8

Part of subcall function 0028B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0028B355
Part of subcall function 0028B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00282194,00000034,?,?,00001004,00000000,00000000), ref: 0028B365
Part of subcall function 0028B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00282194,00000034,?,?,00001004,00000000,00000000), ref: 0028B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 002827CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0028281A

Strings

@, xrefs: 00282832

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: fbeba701c755507ead8c17e357e773650112b24177892f4ba00ebdfc8f009a42
Instruction ID: 18c972625f869d49538a7c42df05179a25e8bfc0d6f562ed937237a56016ebd5
Opcode Fuzzy Hash: fbeba701c755507ead8c17e357e773650112b24177892f4ba00ebdfc8f009a42
Instruction Fuzzy Hash: C7412C76901218BFDB11EFA4CD55ADEBBB8AB09300F104099EA55B7181DA706E59CB60

Function 0025172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00251769
_free.LIBCMT ref: 00251834
_free.LIBCMT ref: 0025183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00251760, 00251767, 00251796, 002517CE

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-3695852857
Opcode ID: 1c555aa3d0fa39a49d61b38a44be9792d1367b26a7182a8dca377e4931c39042
Instruction ID: 318bf7dc5525e789616a4f8de4890e2c4165ce94e0d878929119a7b4fef9d69d
Opcode Fuzzy Hash: 1c555aa3d0fa39a49d61b38a44be9792d1367b26a7182a8dca377e4931c39042
Instruction Fuzzy Hash: 7631C475A10218EFDB21DF99DC85EAEBBFCEB85351B104166FC0497211D7B04E68CB94

Function 0028C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0028C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0028C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,002F1990,01284B38), ref: 0028C395

Strings

0, xrefs: 0028C2DF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 4ad26a61523a1aaedfe9e627a9009599c1dad87b0d125b00d230bf136bb9765c
Instruction ID: 0a0b758ae284db2889fa93cb7174c646420c1cf153d8e3b45f021fa177dd9fa1
Opcode Fuzzy Hash: 4ad26a61523a1aaedfe9e627a9009599c1dad87b0d125b00d230bf136bb9765c
Instruction Fuzzy Hash: 0041F5352153029FD720EF24D884B1ABBE4FF85310F2086ADF8A5972D1C730E855CB62

Function 002B4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,002BCC08,00000000,?,?,?,?), ref: 002B44AA
GetWindowLongW.USER32 ref: 002B44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 002B44D7

Strings

SysTreeView32, xrefs: 002B447C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 8016e7f9b2a9547f2ec87e7ac681f9af494cf37eed5bf759a8f844d066dbc015
Instruction ID: 7f4c8017a55dcc7bfdb56e76dae527cc6d635e94cfa5cdc1b436736301516bd9
Opcode Fuzzy Hash: 8016e7f9b2a9547f2ec87e7ac681f9af494cf37eed5bf759a8f844d066dbc015
Instruction Fuzzy Hash: C0318F71220606AFDB209E78DC85BEA77A9EB09374F204725F975921D1D770EC709B50

Function 00286E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00286EED
VariantCopyInd.OLEAUT32(?,?), ref: 00286F08
VariantClear.OLEAUT32(?), ref: 00286F12

Strings

*j(, xrefs: 00286E8B, 00286E90, 00286EF8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j(
API String ID: 2173805711-1614557683
Opcode ID: 75a112fa08e0058e9531dd6db721ebdaeb3d558d6de32a3499cf6b0a46be6612
Instruction ID: 23a49c443b5102db50a99d7276740a83b78cb9a0b3a284464cc3c039c199a773
Opcode Fuzzy Hash: 75a112fa08e0058e9531dd6db721ebdaeb3d558d6de32a3499cf6b0a46be6612
Instruction Fuzzy Hash: E731AF76625255EBCB05BFA4E8589BE3776EF98300B2004A8FA034B6E1C770D931DB90

Function 002A304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002A335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,002A3077,?,?), ref: 002A3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 002A307A
_wcslen.LIBCMT ref: 002A309B
htons.WSOCK32(00000000,?,?,00000000), ref: 002A3106

Strings

255.255.255.255, xrefs: 002A3095, 002A309A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 10fbde197a5be618ceaebab2b765704e3d4e6529f7c69f03c86280d163b5e811
Instruction ID: be83a9a17d019c9f778eaa8e5f58a69106ea5692445836b60dc238211381053e
Opcode Fuzzy Hash: 10fbde197a5be618ceaebab2b765704e3d4e6529f7c69f03c86280d163b5e811
Instruction Fuzzy Hash: 6931E7352142069FCB10CF68C485EA977E0EF16314F248159F9158B392DF72DE55CB60

Function 002B3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 002B3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 002B3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 002B3F78

Strings

SysMonthCal32, xrefs: 002B3F0B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 2495235846949108b37cda0786c7cb083545c6007bd96a6e55425e6bd064f6fb
Instruction ID: baddf80814f95c8e13d660bd2b75191ee73756e95040d099e563474da0dd0054
Opcode Fuzzy Hash: 2495235846949108b37cda0786c7cb083545c6007bd96a6e55425e6bd064f6fb
Instruction Fuzzy Hash: 4021BF32620219BBDF25CF90DC46FEA3B79EF48754F110214FA556B1D0D6B1A960CB90

Function 002B4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 002B4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 002B4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 002B471A

Strings

msctls_updown32, xrefs: 002B4684

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 6ec916597fbdafd9f25da7f00f1ab090f438d0b50d91dfbe6b15ff9832d79f63
Instruction ID: a8ff30032c5d1f9cf7ad78816f4c1ac472907de7353858e0bfe70063f222d133
Opcode Fuzzy Hash: 6ec916597fbdafd9f25da7f00f1ab090f438d0b50d91dfbe6b15ff9832d79f63
Instruction Fuzzy Hash: EC2171B5610209AFDB10EF68ECC5DB777ADEF5A3A4B140059FA009B251CB71EC61DA60

Function 002895AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0028961D

Strings

#OnAutoItStartRegister, xrefs: 002895F3
#notrayicon, xrefs: 002895B7
#requireadmin, xrefs: 002895D9

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: a3c5fd9918a2b51ff15ac18d401d6a2d43b25f69378e2161b03544ecf19c9bc4
Instruction ID: 78b74ed17c47b6b00d6d46c97cfcc46786b901819325b3346299f2c5798b35e9
Opcode Fuzzy Hash: a3c5fd9918a2b51ff15ac18d401d6a2d43b25f69378e2161b03544ecf19c9bc4
Instruction Fuzzy Hash: A421683623553266D335BE289C02FBB739C9F51300F484026FA49970C1FB94ADB1C791

Function 002B37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 002B3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 002B3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 002B3876

Strings

Listbox, xrefs: 002B380F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 3364ee6e7996df79cd66174c39be469ef249255d08b2bf4801457fe779109b7f
Instruction ID: 71329f56b634007f88d31315ee2291d1580c1bd2d6f942c8d91f4e7d17d73954
Opcode Fuzzy Hash: 3364ee6e7996df79cd66174c39be469ef249255d08b2bf4801457fe779109b7f
Instruction Fuzzy Hash: BF21B072620119BBEB11CF54DC45EFB776EEF897A0F108124F9449B190CA71DC619BA0

Function 002949F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00294A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00294A5C
SetErrorMode.KERNEL32(00000000,?,?,002BCC08), ref: 00294AD0

Strings

%lu, xrefs: 00294A6F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 68348fa222ae011e24610c84ca9bb0614395fa15d62b8eea3bb3ee33584eb8d1
Instruction ID: b1b01281c298c0e3fb795d519c50b44bc3433b9503c71c7b838184f9e70f8d80
Opcode Fuzzy Hash: 68348fa222ae011e24610c84ca9bb0614395fa15d62b8eea3bb3ee33584eb8d1
Instruction Fuzzy Hash: DB317375A10109AFDB10DF54D885EAABBF8EF08308F1440A5F909EB252D771EE56CF61

Function 002B41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 002B424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 002B4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 002B4271

Strings

msctls_trackbar32, xrefs: 002B4226

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: c39af8d68845d679adbe3b2e30ee78bce1942abc604fd87b057f1042717dd6e7
Instruction ID: fe5c39c34d2e8a5429f3b68ce72b2e0348a82f9161b7fb4737ce9f3de5a135ce
Opcode Fuzzy Hash: c39af8d68845d679adbe3b2e30ee78bce1942abc604fd87b057f1042717dd6e7
Instruction Fuzzy Hash: 2A11E331260248BEEF206E69CC46FEB3BACEF95BA4F110124FA55E2091D2B1DC219B50

Function 00282F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00226B57: _wcslen.LIBCMT ref: 00226B6A

Part of subcall function 00282DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00282DC5
Part of subcall function 00282DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00282DD6
Part of subcall function 00282DA7: GetCurrentThreadId.KERNEL32 ref: 00282DDD
Part of subcall function 00282DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00282DE4

GetFocus.USER32 ref: 00282F78

Part of subcall function 00282DEE: GetParent.USER32(00000000), ref: 00282DF9

GetClassNameW.USER32(?,?,00000100), ref: 00282FC3
EnumChildWindows.USER32(?,0028303B), ref: 00282FEB

Strings

%s%d, xrefs: 00282FFF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 36f9a592bde85d5480e29613296d8fd6c66c9670882ca3f7c911d8cf482e29b4
Instruction ID: e7e5793ea22d1fbdc9e8817fe599dcbd62a5f962498ed60ce38496c12049b010
Opcode Fuzzy Hash: 36f9a592bde85d5480e29613296d8fd6c66c9670882ca3f7c911d8cf482e29b4
Instruction Fuzzy Hash: 84110679620205ABCF10BF709C89EED376AAF84304F144075FD09AB192DE3099298F70

Function 0028D66A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0028D682
DeviceIoControl.KERNEL32(00000000,t*.,00000007,0000000C,?,0000000C,?,00000000), ref: 0028D6BF
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0028D6C8

Strings

t*., xrefs: 0028D6B9

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: t*.
API String ID: 33631002-520411257
Opcode ID: 88ee042839d0096aa2430e3a0663df5f2dba3fe42df587b96fc3171b829d8e07
Instruction ID: 92c9003f704a31d4ecb0ec2cd77dd2c46a5bdbcb8fd0dd7d2736a365261ee02c
Opcode Fuzzy Hash: 88ee042839d0096aa2430e3a0663df5f2dba3fe42df587b96fc3171b829d8e07
Instruction Fuzzy Hash: 560175B1D11229BBE710ABADEC49FAFBBBCEB08750F104655B914F71D0D2B45A0587E0

Function 002B5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 002B58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 002B58EE
DrawMenuBar.USER32(?), ref: 002B58FD

Strings

0, xrefs: 002B588F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 4670f3d8d316b2076063689390e1c3ddd27a9f3d10298ac85ce716d2380b64b8
Instruction ID: 9e9ff5510d127657e165b3e28af9207c03687fa0e81b8304fca592b79b545c91
Opcode Fuzzy Hash: 4670f3d8d316b2076063689390e1c3ddd27a9f3d10298ac85ce716d2380b64b8
Instruction Fuzzy Hash: 8301A171520219EFDB209F11EC44BEEBBB4FF453A0F148099E848DA151DB308AA0DF60

Function 0028007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a71b7bc047dc2af94d894793776d66fd9686765098c8fa50c9397e52f417757
Instruction ID: 7170190a6fb7c7a944cdf327ba473cfcfb90c2507670177451d6279e14a817a1
Opcode Fuzzy Hash: 7a71b7bc047dc2af94d894793776d66fd9686765098c8fa50c9397e52f417757
Instruction Fuzzy Hash: 3DC18D79A11206EFDB54DF94C888BAEB7B5FF48314F208598E805EB291C770EE55CB90

Function 002A342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 002A3459
CoUninitialize.OLE32 ref: 002A3463
VariantInit.OLEAUT32(?), ref: 002A346E
VariantClear.OLEAUT32(?), ref: 002A371B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 01725a5d8e27fbe29f9918a018fa193ab3b5f86949c971c3648ed86b120eefe0
Instruction ID: 72b1e6fadffc94c8d01bb264425b9399bdb08f09ce4660d948f320f08d33780d
Opcode Fuzzy Hash: 01725a5d8e27fbe29f9918a018fa193ab3b5f86949c971c3648ed86b120eefe0
Instruction Fuzzy Hash: A8A16A75624310AFC700DF68C585A2AB7E4FF89710F148859F98A9B362DB30EE20CF91

Function 00280436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,002BFC08,?), ref: 002805F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,002BFC08,?), ref: 00280608
CLSIDFromProgID.OLE32(?,?,00000000,002BCC40,000000FF,?,00000000,00000800,00000000,?,002BFC08,?), ref: 0028062D
_memcmp.LIBVCRUNTIME ref: 0028064E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 070c96e79efa718b309f45aa09b0daa78ec06b412de85596c4534b1732eacd19
Instruction ID: 4cb4b4619ba70954d729eaa700b8bf82fa29c2f025532e01c66c43874eaa1f92
Opcode Fuzzy Hash: 070c96e79efa718b309f45aa09b0daa78ec06b412de85596c4534b1732eacd19
Instruction Fuzzy Hash: B3815B75A10109EFCB04DF94C984EEEB7B9FF89305F244158E506AB290DB71AE1ACF60

Function 002AA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 002AA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 002AA6BA

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Process32NextW.KERNEL32(00000000,?), ref: 002AA79C
CloseHandle.KERNEL32(00000000), ref: 002AA7AB

Part of subcall function 0023CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00263303,?), ref: 0023CE8A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 5e27c8733c34fb7e3568517c2f4e4db81749c75c40c45dde5034c783ed06e4df
Instruction ID: e7de5e72e17e8193c089585242a63f0d029def0dae2a2ece6a7103cd45a656f8
Opcode Fuzzy Hash: 5e27c8733c34fb7e3568517c2f4e4db81749c75c40c45dde5034c783ed06e4df
Instruction Fuzzy Hash: DC517CB1518310AFD310EF64D886A6BBBE8FF89714F40492DF58997262EB30D914CF92

Function 00261391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 002614C0

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 647b50c0b2fea58a0558fd7b7ed99e5233826e14cf1a29cf01d1e21807605ba0
Instruction ID: cdd168c13b6c6c4bffc6e2b4666c458825e863241bdb439391a41c98150454f2
Opcode Fuzzy Hash: 647b50c0b2fea58a0558fd7b7ed99e5233826e14cf1a29cf01d1e21807605ba0
Instruction Fuzzy Hash: 38416D31930111ABDB25BFB89C466BE3AA4EF41330F2C4225F819D3291EA7498F15A61

Function 002B6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002B62E2
ScreenToClient.USER32(?,?), ref: 002B6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 002B6382

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: fbf7bbf6fc114743bf108511c93e78ed4fd70722e4bd49a7e4bc3cdfa86eb674
Instruction ID: 7aeb3f1a7632d2d8418d52797f425348520faa54485f7930d810c4295648f535
Opcode Fuzzy Hash: fbf7bbf6fc114743bf108511c93e78ed4fd70722e4bd49a7e4bc3cdfa86eb674
Instruction Fuzzy Hash: E0515C7091020AEFDB10CF58D8889EE7BF5EF457A0F1082A9F91597290D734EDA1CB90

Function 002A1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 002A1AFD
WSAGetLastError.WSOCK32 ref: 002A1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 002A1B8A
WSAGetLastError.WSOCK32 ref: 002A1B94

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 459741f4972a6b1bb3650fffe4e82d69e997aa2fb4e8d0b7bf5c82488c031b1f
Instruction ID: 3e7b2154feac3915a183672a0474c8974c126929ca0f1ffe27e7416832d06b33
Opcode Fuzzy Hash: 459741f4972a6b1bb3650fffe4e82d69e997aa2fb4e8d0b7bf5c82488c031b1f
Instruction Fuzzy Hash: FD410674610301AFD720AF20D88AF2977E5AF44718F548448FA1A9F7D2DB72DD61CBA0

Function 0025B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fc48e3c75ad1cc68a17555ef145229c3e67c7bade1897bc41e3d0c65e3acbf
Instruction ID: a4b3f2a5a5e91c40752bffaea14425a1ee128c0a5088d0b6e734b73c041a4351
Opcode Fuzzy Hash: 54fc48e3c75ad1cc68a17555ef145229c3e67c7bade1897bc41e3d0c65e3acbf
Instruction Fuzzy Hash: 3F412B72A20314BFD725DF38CC41B6ABBE9EB88711F20452EF941DB2C1D771A9658B84

Function 002956D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00295783
GetLastError.KERNEL32(?,00000000), ref: 002957A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 002957CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 002957FA

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 3fe2b7fd04d9fd49629dc0f453a78bc758a517f5b6d6ec9376d23c79708b95d7
Instruction ID: 8dda5113d4182d317f270f2fa9fe6f7b4dea23fa26b2132d0c03115fa8072972
Opcode Fuzzy Hash: 3fe2b7fd04d9fd49629dc0f453a78bc758a517f5b6d6ec9376d23c79708b95d7
Instruction Fuzzy Hash: E1414D35214621EFCB11EF55D544A5EBBE1EF89320B188488EC4A6B362CB34FD60CF91

Function 0025D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00246D71,00000000,00000000,002482D9,?,002482D9,?,00000001,00246D71,?,00000001,002482D9,002482D9), ref: 0025D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0025D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0025D9AB
__freea.LIBCMT ref: 0025D9B4

Part of subcall function 00253820: RtlAllocateHeap.NTDLL(00000000,?,002F1444,?,0023FDF5,?,?,0022A976,00000010,002F1440,002213FC,?,002213C6,?,00221129), ref: 00253852

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 64402c1010aa6d3601398c9d3eb9418f8180cffd0a105ac5e9b0dc1cf8ebfe28
Instruction ID: c9e864563aebb457047af201fa617abe9440cc9b197e5257eed81a6f9e4dbdb2
Opcode Fuzzy Hash: 64402c1010aa6d3601398c9d3eb9418f8180cffd0a105ac5e9b0dc1cf8ebfe28
Instruction Fuzzy Hash: 2B31F472A2020AABDF24DF64DC45EAE7BA5EF41311F150168FC04D7150EB35DD68CB90

Function 002B52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 002B5352
GetWindowLongW.USER32(?,000000F0), ref: 002B5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 002B5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002B53A8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: b9aee92f18e600c5a70f34bb67bf71d81491a412aecbd8faa3a9ae24a9a9be65
Instruction ID: 5ab7e42ae7ab4acb53564c3ebfafa944b5ea8a7d8ff790c9b635fca2ffcc1b1f
Opcode Fuzzy Hash: b9aee92f18e600c5a70f34bb67bf71d81491a412aecbd8faa3a9ae24a9a9be65
Instruction Fuzzy Hash: 02310630A75A29EFEB349E14DC09FE837E5AB043D0F584181FA509A3E1C3F5A9A0DB41

Function 0028AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 0028ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0028AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0028AC74
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 0028ACC6

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d5fe76a661945f45007753e99174176296ef3b72ff706c0c17fec9f2e0c6b939
Instruction ID: 54aad377b4e028ca516a82262e484c0db0235c0002243936161cf3edf168e926
Opcode Fuzzy Hash: d5fe76a661945f45007753e99174176296ef3b72ff706c0c17fec9f2e0c6b939
Instruction Fuzzy Hash: 4B314B74A227196FFF35EF698C08BFE7BA5AB89310F08431BE481521D1CB7589A18752

Function 002B7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 002B769A
GetWindowRect.USER32(?,?), ref: 002B7710
PtInRect.USER32(?,?,002B8B89), ref: 002B7720
MessageBeep.USER32(00000000), ref: 002B778C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a25576e5d7e0110c8bf6f1ca95451580ea8a820daad36b7214de554919b9297a
Instruction ID: 26cb4184128e7c3d06f1f2c8cf2df4ac614a5b58bc9a2ef1d4648c2b2a21916e
Opcode Fuzzy Hash: a25576e5d7e0110c8bf6f1ca95451580ea8a820daad36b7214de554919b9297a
Instruction Fuzzy Hash: 9441CC34A19215DFCB01CF58D888EE9B7F4FF88394F1481A8E8159B261CB70E961DF90

Function 002B16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 002B16EB

Part of subcall function 00283A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00283A57
Part of subcall function 00283A3D: GetCurrentThreadId.KERNEL32 ref: 00283A5E
Part of subcall function 00283A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002825B3), ref: 00283A65

GetCaretPos.USER32(?), ref: 002B16FF
ClientToScreen.USER32(00000000,?), ref: 002B174C
GetForegroundWindow.USER32 ref: 002B1752

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 12e7b109962902a4392bcdb2748e72811eaf8d7629eb6ee06d991b5137bdd747
Instruction ID: 6eadf65052ef6a7aadd79402509645c2ae1eca00291415f707888d7a407d8536
Opcode Fuzzy Hash: 12e7b109962902a4392bcdb2748e72811eaf8d7629eb6ee06d991b5137bdd747
Instruction Fuzzy Hash: 0F317E71D10109AFCB00EFA9D885CEEBBF9EF48304B5480AAE415E7211EB309E55CFA0

Function 0028DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00227620: _wcslen.LIBCMT ref: 00227625

_wcslen.LIBCMT ref: 0028DFCB
_wcslen.LIBCMT ref: 0028DFE2
_wcslen.LIBCMT ref: 0028E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0028E018

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 503b9efb1ca60ca78b3f9c833a86d109a86fc96622a68d8750241b89ae16811a
Instruction ID: aab6fd0b4fc2562f4ab2493dbd7cc9b36c90e1ef3ced5ef0969b6e8b72d1bff9
Opcode Fuzzy Hash: 503b9efb1ca60ca78b3f9c833a86d109a86fc96622a68d8750241b89ae16811a
Instruction Fuzzy Hash: CB21E275D11215AFCB20EFA8D981BAEB7F8EF45710F114064E904FB285D6709E51CBA1

Function 002B8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

GetCursorPos.USER32(?), ref: 002B9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00277711,?,?,?,?,?), ref: 002B9016
GetCursorPos.USER32(?), ref: 002B905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00277711,?,?,?), ref: 002B9094

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 19a98bd656522c0d08d69a1099390e1569479d89e68c471dd2980af85a1e72d7
Instruction ID: e2d2ae5a68caef839db349846ee4989788af30884457c18430db20698f4946e0
Opcode Fuzzy Hash: 19a98bd656522c0d08d69a1099390e1569479d89e68c471dd2980af85a1e72d7
Instruction Fuzzy Hash: D321F131210018FFCB259F94DC98EFA7BB9EF8A3A0F100565FA0557261C371A9A0DF60

Function 0028D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,002BCB68), ref: 0028D2FB
GetLastError.KERNEL32 ref: 0028D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0028D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,002BCB68), ref: 0028D376

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 7c51fc4c31bfada9afadb19df8b9cc7bd897a53781ef3974ee943f51f0faf50f
Instruction ID: a2f6e9f8357d02edcdb7b93a41497bcd9e6724364c5bd2502cbe65741473b859
Opcode Fuzzy Hash: 7c51fc4c31bfada9afadb19df8b9cc7bd897a53781ef3974ee943f51f0faf50f
Instruction Fuzzy Hash: 8721F334526302AF8700EF24D88046EB7E4EE5A324F604A5DF899C32E1D730C959CF93

Function 00281571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00281014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0028102A
Part of subcall function 00281014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00281036
Part of subcall function 00281014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00281045
Part of subcall function 00281014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0028104C
Part of subcall function 00281014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00281062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 002815BE
_memcmp.LIBVCRUNTIME ref: 002815E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00281617
HeapFree.KERNEL32(00000000), ref: 0028161E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 87ba1dfff08ddbaf1fdc5b5536bc34630c19540d15aba5fcf9a6452d618499c1
Instruction ID: c0c43fada595a4ac4ab0520de722cce6b94c2035bcb06798e81e9b2b442cd2e3
Opcode Fuzzy Hash: 87ba1dfff08ddbaf1fdc5b5536bc34630c19540d15aba5fcf9a6452d618499c1
Instruction Fuzzy Hash: 29217C71E11119EFDB04EFA4C949BEEB7BCEF44344F184459E445AB281E734AA26CB60

Function 002B2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 002B280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 002B2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 002B2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 002B2840

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 633af1b2c5272ff189fb2032e59cc6c4cf787ad86b84b59591e18f250413a186
Instruction ID: 14dcf6108cc66e151a063c01c0a88600fa3b23cb478dae5d2e0e5478ced3c328
Opcode Fuzzy Hash: 633af1b2c5272ff189fb2032e59cc6c4cf787ad86b84b59591e18f250413a186
Instruction Fuzzy Hash: B521C431224211EFD7149F24D844FAAB799EF45364F248258F4268B6E2CB71FC56CBE0

Function 002878F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00288D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0028790A,?,000000FF,?,00288754,00000000,?,0000001C,?,?), ref: 00288D8C
Part of subcall function 00288D7D: lstrcpyW.KERNEL32(00000000,?,?,0028790A,?,000000FF,?,00288754,00000000,?,0000001C,?,?,00000000), ref: 00288DB2
Part of subcall function 00288D7D: lstrcmpiW.KERNEL32(00000000,?,0028790A,?,000000FF,?,00288754,00000000,?,0000001C,?,?), ref: 00288DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00288754,00000000,?,0000001C,?,?,00000000), ref: 00287923
lstrcpyW.KERNEL32(00000000,?,?,00288754,00000000,?,0000001C,?,?,00000000), ref: 00287949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00288754,00000000,?,0000001C,?,?,00000000), ref: 00287984

Strings

cdecl, xrefs: 0028797B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 9ce18ee496acc3a9293a40e1ad2d04a528ce7f84ef3f07c420df61dffcbb87f9
Instruction ID: 3260860e6605ac029736ec61b21cf168cbe4d8c33fc9bc255f396eb09f00e1d7
Opcode Fuzzy Hash: 9ce18ee496acc3a9293a40e1ad2d04a528ce7f84ef3f07c420df61dffcbb87f9
Instruction Fuzzy Hash: 1211E93E221342ABCB15AF39D845D7A77A9FF45390B60402AF946C72A5EF31D821C751

Function 002B7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 002B7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 002B7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 002B7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0029B7AD,00000000), ref: 002B7D6B

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: d2d8531ba2d4b27dfe72257865e753e4dc968803e527fe67ecd7949cdd274831
Instruction ID: d5b07001494fd8a65d625f7d420ec98f6d8a1de289fa5db8b652c80e1be450b3
Opcode Fuzzy Hash: d2d8531ba2d4b27dfe72257865e753e4dc968803e527fe67ecd7949cdd274831
Instruction Fuzzy Hash: 2C119031624616AFCB109F28DC08AB63BA5AF853F0B654724F839D72F0D7319960CB90

Function 002B5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 002B56BB
_wcslen.LIBCMT ref: 002B56CD
_wcslen.LIBCMT ref: 002B56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 002B5816

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 550f06422a1b1f1535c3ce8021b66e1c9406c6051d525baaf092c118b64aa016
Instruction ID: df48a75b6d989b3c69173cd4427bdfdf303c1465f4c73cd8ed7d4c54515a3c5b
Opcode Fuzzy Hash: 550f06422a1b1f1535c3ce8021b66e1c9406c6051d525baaf092c118b64aa016
Instruction Fuzzy Hash: 54110631620629AADB209F61CC85BEE777CFF107E4F504026FA05DA081EBB0C9A0CF60

Function 00251D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14dbfe1c8e5acd048b211ef72d08e5cb5d4515395062d415a4c84d632caaa9bf
Instruction ID: a1055f0f6b1ce28fd6c2d89305de060ac9402a9477687fb62c6b9d5406348c61
Opcode Fuzzy Hash: 14dbfe1c8e5acd048b211ef72d08e5cb5d4515395062d415a4c84d632caaa9bf
Instruction Fuzzy Hash: 5C018FB222661A7EF6212A787CC0F67662CDF817BAB300325FD31611D2DB708C788578

Function 00281A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00281A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00281A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00281A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00281A8A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e30a444b1b09f26a414574c3a1349c3233bce911f58cbfbd076e103fa30bcf75
Instruction ID: f6340263f4717c9d7ba3455c7960a2abd10c295a1a2bfc01d21892fed27aaac2
Opcode Fuzzy Hash: e30a444b1b09f26a414574c3a1349c3233bce911f58cbfbd076e103fa30bcf75
Instruction Fuzzy Hash: 6B113C3AD01219FFEB14DBA4CD85FADBB78EB08750F200091E610B7294D6716E61DB94

Function 0028E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0028E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0028E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0028E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0028E24D

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 33eff8a064f9cfe3923d9f00c8a9291e322c58d2b24f40328dc15abc399916ec
Instruction ID: d9b21afd50b7fe898b9e6a5a5794508b96c9e1f726a020179a0d1793237ee577
Opcode Fuzzy Hash: 33eff8a064f9cfe3923d9f00c8a9291e322c58d2b24f40328dc15abc399916ec
Instruction Fuzzy Hash: D5112676914214BBCB01AFA8BC0DAAE7FADAB45320F504365FC24E32D5D6B0CD20C7A0

Function 0024D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0024CFF9,00000000,00000004,00000000), ref: 0024D218
GetLastError.KERNEL32 ref: 0024D224
__dosmaperr.LIBCMT ref: 0024D22B
ResumeThread.KERNEL32(00000000), ref: 0024D249

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: b4a5d18e07cf26e033a18aad9e4419dc97751ec47d241d547278d48d94add371
Instruction ID: 8a3a4b57566300d88cc8a576f95d59b3f602953ce8841bbe9ae839ba4330377a
Opcode Fuzzy Hash: b4a5d18e07cf26e033a18aad9e4419dc97751ec47d241d547278d48d94add371
Instruction Fuzzy Hash: 3A012632825205BBCB189FB5DC09BAE7A68DF81330F200319FC29960D1CBF0C820CAA0

Function 002B9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00239BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00239BB2

GetClientRect.USER32(?,?), ref: 002B9F31
GetCursorPos.USER32(?), ref: 002B9F3B
ScreenToClient.USER32(?,?), ref: 002B9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 002B9F7A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 94158d528e0b5d29784c49e44b34f21a3ac9d369ad733b66d257fb4c8efa8c45
Instruction ID: 1e66c5b1c092b518f88d59ebee0d7b8bdc7640dd96f2a5aca89cbe82d9362de3
Opcode Fuzzy Hash: 94158d528e0b5d29784c49e44b34f21a3ac9d369ad733b66d257fb4c8efa8c45
Instruction Fuzzy Hash: BC11483291011AEBDB10DFA8D8899FEB7B9FB463A1F500551FA01E3550D770BAE1CBA1

Function 0022600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0022604C
GetStockObject.GDI32(00000011), ref: 00226060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0022606A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 0f5e9011eb0e050ef9ce993ec15e3fd999276a496e3b5d0b4f5189e7f081cfc8
Instruction ID: 3b574c1f9a82c7188db7dca89d4e7fa872083547e0ff92023cbfcf1372e65335
Opcode Fuzzy Hash: 0f5e9011eb0e050ef9ce993ec15e3fd999276a496e3b5d0b4f5189e7f081cfc8
Instruction Fuzzy Hash: 11118B73111519BFEF124FA4AC48EEABB6DFF093A4F100211FA0452010C7729D60EBA0

Function 00243B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00243B56

Part of subcall function 00243AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00243AD2
Part of subcall function 00243AA3: ___AdjustPointer.LIBCMT ref: 00243AED

_UnwindNestedFrames.LIBCMT ref: 00243B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00243B7C
CallCatchBlock.LIBVCRUNTIME ref: 00243BA4

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 808b51c1511c84339218f2e41d362fe78137b5a765e7d7738f0878f98145b31b
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: CA012932110149BBDF16AE95CC42EEB3B69EF48758F044014FE4896121C732E971DFA0

Function 00253073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,002213C6,00000000,00000000,?,0025301A,002213C6,00000000,00000000,00000000,?,0025328B,00000006,FlsSetValue), ref: 002530A5
GetLastError.KERNEL32(?,0025301A,002213C6,00000000,00000000,00000000,?,0025328B,00000006,FlsSetValue,002C2290,FlsSetValue,00000000,00000364,?,00252E46), ref: 002530B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0025301A,002213C6,00000000,00000000,00000000,?,0025328B,00000006,FlsSetValue,002C2290,FlsSetValue,00000000), ref: 002530BF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 822f5f0047f8e76a78c1d941c4c104cc4a6c0dd1022fa4bd8841d2b7537b8610
Instruction ID: 3e86a80a1dbbb0b0b41a08f0c3a52cdd7fefd46c2d1c3c5687909a09181857a6
Opcode Fuzzy Hash: 822f5f0047f8e76a78c1d941c4c104cc4a6c0dd1022fa4bd8841d2b7537b8610
Instruction Fuzzy Hash: 8E018832731327ABCB218E79AC4896777989F45BE2B215720FD05E7180D731D929C6E4

Function 00287464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0028747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00287497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 002874AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 002874CA

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 01723db62b6a2d71281273cc00d1fc521dbf3541d2221f346f300dd19a0dddc7
Instruction ID: 4c49c70ae47e4b50ca538c1ebbf63fc6f9c93b4c4bd72fa671a7621275d4bbea
Opcode Fuzzy Hash: 01723db62b6a2d71281273cc00d1fc521dbf3541d2221f346f300dd19a0dddc7
Instruction Fuzzy Hash: 2511A1B92263119BF7209F54EC08B937FFCEB00B10F208569A656D6191D7B0E914DB60

Function 0028B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0028ACD3,?,00008000), ref: 0028B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0028ACD3,?,00008000), ref: 0028B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0028ACD3,?,00008000), ref: 0028B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0028ACD3,?,00008000), ref: 0028B126

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 146adf30688c985ab718d6a6bcc399611fccbee614ccbfa63615fe7896d1f5bb
Instruction ID: cca293793bab86fd1e949b019080cce2b8cc3eb7dc18a850c01959aa6fc2fd1c
Opcode Fuzzy Hash: 146adf30688c985ab718d6a6bcc399611fccbee614ccbfa63615fe7896d1f5bb
Instruction Fuzzy Hash: 2F118B34C2252DE7CF01EFE8E99C6EEBB78FF09311F10419AD985B6181CB3056608B51

Function 002B7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002B7E33
ScreenToClient.USER32(?,?), ref: 002B7E4B
ScreenToClient.USER32(?,?), ref: 002B7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 002B7E8A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: e127fd6647b9a4e57e666f451099ebd82b555c773737134d12544f4f5e4a6b5d
Instruction ID: 73c80c9107852106d78718bfeddd63082a2190b82cae2735d38ae9fddc60544a
Opcode Fuzzy Hash: e127fd6647b9a4e57e666f451099ebd82b555c773737134d12544f4f5e4a6b5d
Instruction Fuzzy Hash: BF1156B9D0020AAFDB41DF98D8849EEBBF9FF48310F505166E915E3210D735AA54CF50

Function 00282DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00282DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00282DD6
GetCurrentThreadId.KERNEL32 ref: 00282DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00282DE4

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: ddd34b99d4fef75af22ccfb199fbfd1e42b19432983bec19572fa24dab5b4f94
Instruction ID: bbd928b849f851c857f63296c13bb457290084d60b02bbdccfb84003d74e5830
Opcode Fuzzy Hash: ddd34b99d4fef75af22ccfb199fbfd1e42b19432983bec19572fa24dab5b4f94
Instruction Fuzzy Hash: 36E09276512224BBD7202F72AC0DFEB3F6CEF83BA1F100225F505D10809AA0D844C7B0

Function 002B8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00239639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00239693
Part of subcall function 00239639: SelectObject.GDI32(?,00000000), ref: 002396A2
Part of subcall function 00239639: BeginPath.GDI32(?), ref: 002396B9
Part of subcall function 00239639: SelectObject.GDI32(?,00000000), ref: 002396E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 002B8887
LineTo.GDI32(?,?,?), ref: 002B8894
EndPath.GDI32(?), ref: 002B88A4
StrokePath.GDI32(?), ref: 002B88B2

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 7159ca724379e3e019ef182ebf61231fd6d8560f9c241d627a4fc696e1adb822
Instruction ID: 1879701922a5107d017abea2e2132ea08aabf24f646bcfe9d6cd3258088ec104
Opcode Fuzzy Hash: 7159ca724379e3e019ef182ebf61231fd6d8560f9c241d627a4fc696e1adb822
Instruction Fuzzy Hash: E8F0343605225AFBEB126F94AC0EFDA3A69AF06360F548200FA11650E2C7B55561CFE9

Function 002398B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 002398CC
SetTextColor.GDI32(?,?), ref: 002398D6
SetBkMode.GDI32(?,00000001), ref: 002398E9
GetStockObject.GDI32(00000005), ref: 002398F1

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: a0553164077b79a109c69e4695b5b72ba1dad4b96a3eb2ccba242912d2e836d4
Instruction ID: 3a080a16bb0b6e55217e6ec97eb648740726a2ad940ecc41adfb1bbb535292b5
Opcode Fuzzy Hash: a0553164077b79a109c69e4695b5b72ba1dad4b96a3eb2ccba242912d2e836d4
Instruction Fuzzy Hash: 21E06D31254280AADB215F78BC0DBE83F20AB12336F24C319F6FE681E1C37146909B20

Function 0028162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00281634
OpenThreadToken.ADVAPI32(00000000,?,?,?,002811D9), ref: 0028163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,002811D9), ref: 00281648
OpenProcessToken.ADVAPI32(00000000,?,?,?,002811D9), ref: 0028164F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 44c68ebff5566a36172e50bd0b198d6f31fd964d231de31d764b890bdd8c2bbd
Instruction ID: 8549f88992fbfa2a0f436640f17f215362f1089f39f01e2cc1e85a754ee3726c
Opcode Fuzzy Hash: 44c68ebff5566a36172e50bd0b198d6f31fd964d231de31d764b890bdd8c2bbd
Instruction Fuzzy Hash: E8E08635606221DBD7203FA0BD0DB863B7CAF44791F288918F785C90C0E6344451C760

Function 0027D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0027D858
GetDC.USER32(00000000), ref: 0027D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0027D882
ReleaseDC.USER32(?), ref: 0027D8A3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 706a4e61720bb54f5cfcca99616fba52f270c43e2bcfeca9389089e5ea906bcf
Instruction ID: 63c302b8f3dd5b93b38849e0293c4da29bb3438e65745d3d1dfbbbedf2f4dd61
Opcode Fuzzy Hash: 706a4e61720bb54f5cfcca99616fba52f270c43e2bcfeca9389089e5ea906bcf
Instruction Fuzzy Hash: 73E01AB4C10205EFCB41AFE4E90CA6DBBB5FB88310F208509E816E7250C7784912AF50

Function 0027D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0027D86C
GetDC.USER32(00000000), ref: 0027D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0027D882
ReleaseDC.USER32(?), ref: 0027D8A3

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f05a24af50d765be6166ac0b75a31aa5b63a5d6f30af9b0a320450cd8fdc1ef3
Instruction ID: 10906066f80132f912714e974d154be390c2cf591ecf05b4d17a05ffecff837c
Opcode Fuzzy Hash: f05a24af50d765be6166ac0b75a31aa5b63a5d6f30af9b0a320450cd8fdc1ef3
Instruction Fuzzy Hash: E4E04FB4C10204EFCF40AFA4E80CA6DBBB5FB88310F208509F916E7350C73859119F50

Function 00294D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00227620: _wcslen.LIBCMT ref: 00227625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00294ED4

Strings

*, xrefs: 00294E10
LPT, xrefs: 00294DFB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: addf166ac5ec2643f4713da591ccfd937a10cef8066732d09c61a812f7fbb80a
Instruction ID: 5110d190070b55ed004c424892c1e26d1b4e3d23d816700ed92121d3d23df87c
Opcode Fuzzy Hash: addf166ac5ec2643f4713da591ccfd937a10cef8066732d09c61a812f7fbb80a
Instruction Fuzzy Hash: F4919275A10215AFCB14DF54C484EAABBF1BF48304F148099E84A9F762C771ED96CF90

Function 002A7771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0027569E,00000000,?,002BCC08,?,00000000,00000000), ref: 002A78DD

Part of subcall function 00226B57: _wcslen.LIBCMT ref: 00226B6A

CharUpperBuffW.USER32(0027569E,00000000,?,002BCC08,00000000,?,00000000,00000000), ref: 002A783B

Strings

<s., xrefs: 002A77C8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <s.
API String ID: 3544283678-183820828
Opcode ID: de6e6dc44db25b31412b9e01e6b14431f6addffd4c423527953fbc615fb27e3a
Instruction ID: c2a96966c998c33295d0d811126a10032ff21b0ada0e99a0296e092a177a7fa1
Opcode Fuzzy Hash: de6e6dc44db25b31412b9e01e6b14431f6addffd4c423527953fbc615fb27e3a
Instruction Fuzzy Hash: 83614B3293412AABCF04EFE4DC91DFEB378BF19700B544126E542A3091EF745A65DBA4

Function 0023E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0023E1B1

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: ed2df7b13617a6fb4de205ad39f6e6e4d4fb47165ec047d5b1dbb9482e4821b8
Instruction ID: 52594728b780e5136f2f4ff4de4b89b3089da37640b037645d227244b814fef2
Opcode Fuzzy Hash: ed2df7b13617a6fb4de205ad39f6e6e4d4fb47165ec047d5b1dbb9482e4821b8
Instruction Fuzzy Hash: 55515671520247EFDF18DF68C081ABABBA8EF29310F258095FC959B2D0D6309D76CB60

Function 0023F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0023F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0023F2BB

Strings

@, xrefs: 0023F2AF

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 3df66db070d523cec7b96060353c55f4d0c967e08aeb96dd7da15b92488e3270
Instruction ID: caeb8a18d2734812700ec0a6084de46f858c58632571b36c1eac8be97a04e54f
Opcode Fuzzy Hash: 3df66db070d523cec7b96060353c55f4d0c967e08aeb96dd7da15b92488e3270
Instruction Fuzzy Hash: 5C512971418744ABD320AF90E886BAFB7F8FB84300F91885DF5D9411A5EB708939CB66

Function 002A5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 002A57E0
_wcslen.LIBCMT ref: 002A57EC

Strings

CALLARGARRAY, xrefs: 002A57E6, 002A57EB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: ff713328b4a5715c32d142f638c83ec6841d3fd1e25a1cb6418eead230151d4d
Instruction ID: e014e0d35fa3f873de069b5689968de3d4df600b5ccf3037b1a637ecb8c7a009
Opcode Fuzzy Hash: ff713328b4a5715c32d142f638c83ec6841d3fd1e25a1cb6418eead230151d4d
Instruction Fuzzy Hash: 2641B271E20219DFCB14DFA8C8859BEBBB5FF5A310F144029E505A7291EB749DA1CFA0

Function 0029D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0029D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0029D13A

Strings

|, xrefs: 0029D10B

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: da0b783c5ef75669190f624b87015994b668894bf65a515f5cec12e8d71e0a8b
Instruction ID: 315c6f8c43d20bb76a45cc863985369f708c4994f2454887fc43b7c6c0027a9b
Opcode Fuzzy Hash: da0b783c5ef75669190f624b87015994b668894bf65a515f5cec12e8d71e0a8b
Instruction Fuzzy Hash: BF310A72D11119ABCF15EFA4DC85EEE7FB9FF04300F100019E819A6166D731A966DF50

Function 002B356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 002B3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 002B365C

Strings

static, xrefs: 002B35BC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 5a8ab4a0161f9edf89ff089529c117809541c389ac9b56eb9654704287852bc0
Instruction ID: 2abb25fec488b2ca8feb40434d6ce57ab001904db256a7795ca683296fb0600e
Opcode Fuzzy Hash: 5a8ab4a0161f9edf89ff089529c117809541c389ac9b56eb9654704287852bc0
Instruction Fuzzy Hash: DB319271120605AEDB24DF68DC40EFB73ADFF88764F108619F8A597190DA30ADA1DB64

Function 002B4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 002B461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 002B4634

Strings

', xrefs: 002B458E

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: d36f829c6c2b04e46f727fa3fe46c860fe9dcf17455836a3e2739435308e5de8
Instruction ID: 5b678ca48b40266e93583246f74fd2a235d048e65d09690adebfb788aa889cb8
Opcode Fuzzy Hash: d36f829c6c2b04e46f727fa3fe46c860fe9dcf17455836a3e2739435308e5de8
Instruction Fuzzy Hash: 6A315974A1070AAFDF14DFA9C980BEA7BB9FF19340F54406AE904AB342D770A951CF90

Function 002B31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 002B327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002B3287

Strings

Combobox, xrefs: 002B3249

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 577f582e366c05cd5c8c35d2dad210ea5e51ff1ea7490b5dbc7b4483c2cf1a6f
Instruction ID: a98db6002f01c7bf61e6c00a74cc9643d724828c070006c6a29b24099d3fd042
Opcode Fuzzy Hash: 577f582e366c05cd5c8c35d2dad210ea5e51ff1ea7490b5dbc7b4483c2cf1a6f
Instruction Fuzzy Hash: A211B2713202097FFF25DE94DC85EFB376AEB983E4F104228FA1897290D6719D618B60

Function 002B3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0022600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0022604C
Part of subcall function 0022600E: GetStockObject.GDI32(00000011), ref: 00226060
Part of subcall function 0022600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0022606A

GetWindowRect.USER32(00000000,?), ref: 002B377A
GetSysColor.USER32(00000012), ref: 002B3794

Strings

static, xrefs: 002B3757

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: e95c1b21e36d79dd4538120ba3754896a761720ee5cbc3da8baf6cc2dbc634ca
Instruction ID: e37740c0dd1dcf421c1fe3e882db9bf0352aaa8a3d99031d9f39db61ef8601bc
Opcode Fuzzy Hash: e95c1b21e36d79dd4538120ba3754896a761720ee5cbc3da8baf6cc2dbc634ca
Instruction Fuzzy Hash: 3B112CB262020AAFDB00DFA8DC45EEA7BB8FB08354F104514F955E2250EB75E961DB50

Function 0029CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0029CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0029CDA6

Strings

<local>, xrefs: 0029CD66

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 037003c0df01325d10fcba78ca74fb5916ef36d30454227d10f89b618afcc963
Instruction ID: 40941ad6869ed92d552ddea8c4332889422b1e6a1a73a0cf817b336532bb793b
Opcode Fuzzy Hash: 037003c0df01325d10fcba78ca74fb5916ef36d30454227d10f89b618afcc963
Instruction Fuzzy Hash: 6911E9B12256327ADB384F668C49FF7BE6CEF127A4F204236B10983080D7B09860D6F0

Function 002B3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 002B34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 002B34BA

Strings

edit, xrefs: 002B348F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 011f4eec0886831a93b43c37bc04bd1e30d557b47da0820cb236488902da0cfe
Instruction ID: e5a32c4cfbfb5ed0efe01bccea09d16d29e94f5078d7edb4003a0d3ab06915cf
Opcode Fuzzy Hash: 011f4eec0886831a93b43c37bc04bd1e30d557b47da0820cb236488902da0cfe
Instruction Fuzzy Hash: 46119E71120209AFEB228E68EC44AFB377AEF053B4F604324FA65931E0C771DD619B60

Function 00286C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

CharUpperBuffW.USER32(?,?,?), ref: 00286CB6
_wcslen.LIBCMT ref: 00286CC2

Strings

STOP, xrefs: 00286CBC, 00286CC1

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 606c7f103ee779508c87ca96ce9a5679b235f8ac5718b9452bf6cf5b72436ebd
Instruction ID: 1e10075d772e93f11995c88cc7aeefdf5cb27cac08e839525a1277e6ed1a8ac0
Opcode Fuzzy Hash: 606c7f103ee779508c87ca96ce9a5679b235f8ac5718b9452bf6cf5b72436ebd
Instruction Fuzzy Hash: ED010036A315278BCB21BFFDDC889BF77A5FB61710B50053AE862921D0EA31D860CB50

Function 00281CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 00283CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00283CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00281D4C

Strings

ListBox, xrefs: 00281D16
ComboBox, xrefs: 00281CEB

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 01b47ad1d7b110c52f06e0206e34b77c6b81091fbaa155cccddb5df667aa86c0
Instruction ID: 33de849f702dd364e12ff5fc1e704da0c07aba1ad88642d20010f506eb7aedfa
Opcode Fuzzy Hash: 01b47ad1d7b110c52f06e0206e34b77c6b81091fbaa155cccddb5df667aa86c0
Instruction Fuzzy Hash: 9101F579632228ABCB08FFA0DC11DFE7368FB46350F04061AE822572C1EA3059398B60

Function 00281BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 00283CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00283CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00281C46

Strings

ListBox, xrefs: 00281C10
ComboBox, xrefs: 00281BE5

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7b62d8332899068b6852d1d0c60d9e74de2e34dd284afd58ed4c5beca71d2cd6
Instruction ID: 6d443e4c845fe701717fdc4c6b616321145a4d669d0d876bf8c9ed25d3ee7354
Opcode Fuzzy Hash: 7b62d8332899068b6852d1d0c60d9e74de2e34dd284afd58ed4c5beca71d2cd6
Instruction Fuzzy Hash: C9018479AA211966CB08FB90D9519FF77ACAB16340F54001AA506672C1EA609A398BB2

Function 00281C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 00283CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00283CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00281CC8

Strings

ListBox, xrefs: 00281C94
ComboBox, xrefs: 00281C69

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: fbb5a7076a9d3ee53725cb35aef4086dee9995961159b1ddb3fdb6ee8720e7ea
Instruction ID: 1b59f4f229d08d5b6b4dc1359c6d4fdca76d572724f4dc5a328b80258b8ef6e3
Opcode Fuzzy Hash: fbb5a7076a9d3ee53725cb35aef4086dee9995961159b1ddb3fdb6ee8720e7ea
Instruction Fuzzy Hash: 7301A7B96B212977CB04FB91DA11AFE73ACAB15340F540016B801732C1EA609F398B72

Function 0023A4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0023A529

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Strings

3y', xrefs: 0023A545, 0023A54D, 0023A552
,%/, xrefs: 0023A509

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%/$3y'
API String ID: 2551934079-3540759730
Opcode ID: 42b11595a60f2514d3043998e69e2724ec651b48fb8ff56d714ea4e242272b1e
Instruction ID: ad363af171e5762f599cd4cd3330f7b30e5582501e15ace791482ce3d75d3ea8
Opcode Fuzzy Hash: 42b11595a60f2514d3043998e69e2724ec651b48fb8ff56d714ea4e242272b1e
Instruction Fuzzy Hash: 1F012B71B3161497C508F7A8EC5BB6D73549B06760F900034F646571C2DE609DA58E97

Function 00281D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00229CB3: _wcslen.LIBCMT ref: 00229CBD

Part of subcall function 00283CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00283CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00281DD3

Strings

ListBox, xrefs: 00281DA0
ComboBox, xrefs: 00281D75

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 79c9bc5c92ed5b2e385b17a07087cdc40f72ca18c66734036ac097aa9a54bcc2
Instruction ID: 19f2884e396686ab0eeecf79cbd4e94122d4bb0b562f18f0bb8c14e38745ef54
Opcode Fuzzy Hash: 79c9bc5c92ed5b2e385b17a07087cdc40f72ca18c66734036ac097aa9a54bcc2
Instruction Fuzzy Hash: 0EF0F975A7222877D704FBE4DC51FFE736CAB06344F440919F822632C1DA6059398760

Function 002B8172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,002F3018,002F305C), ref: 002B81BF
CloseHandle.KERNEL32 ref: 002B81D1

Strings

\0/, xrefs: 002B818A

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0/
API String ID: 3712363035-4000318828
Opcode ID: b794f064a2b270b732f0fee95367b92e7611ffe5521cdcb14520943bae3af8a5
Instruction ID: d02a7abdf7fead3470402aaebfddf43509e11f5f608a6bb6df2094a7830af05a
Opcode Fuzzy Hash: b794f064a2b270b732f0fee95367b92e7611ffe5521cdcb14520943bae3af8a5
Instruction Fuzzy Hash: C0F054B2650304BAF310AB65BC49FB77A5CDB047A0F400476BB08D51A2DA758A14C7B4

Function 002A747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 002A7493
_wcslen.LIBCMT ref: 002A74B9

Strings

3, 3, 16, 1, xrefs: 002A7483

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: e52d508157bf50ac9aec17141192a38b7d8705157d7f77cc730c6fdd09029a45
Instruction ID: f35a5a05e94f9dc21f59d0d8340c5ece9e09a582c469509ac2c801f449efcc06
Opcode Fuzzy Hash: e52d508157bf50ac9aec17141192a38b7d8705157d7f77cc730c6fdd09029a45
Instruction Fuzzy Hash: E1E02B16234261119235267A9CC1A7F579DDFCF750710182BF981C2266EE948DB2A3B4

Function 00280B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00280B23

Strings

AutoIt, xrefs: 00280B17
Error allocating memory., xrefs: 00280B1C

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: ee9b87d7bd314b33953e5ade9d853e51df88f079dc5ab083713358fcb00b8d51
Instruction ID: 88550bc5e278a5b65d46450f01c250b4f5fbb3d05ff6d0d8d56eb640a17436bc
Opcode Fuzzy Hash: ee9b87d7bd314b33953e5ade9d853e51df88f079dc5ab083713358fcb00b8d51
Instruction Fuzzy Hash: BEE0D8322A431837D2143A947C07FC9BA848F06B64F200426FB88594C38AE124700AE9

Function 00240D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0023F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00240D71,?,?,?,0022100A), ref: 0023F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0022100A), ref: 00240D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0022100A), ref: 00240D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00240D7F

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: e8ff47710ef891cbae8d66eec67d9860e855fe583ef0b5fea93c7d5cb11c560a
Instruction ID: 14c164fcb2591d4a8476e11f9c5e4eab714215125b24707de06f2c13e4e82e46
Opcode Fuzzy Hash: e8ff47710ef891cbae8d66eec67d9860e855fe583ef0b5fea93c7d5cb11c560a
Instruction Fuzzy Hash: 8AE06D70A103118BE3649FB8E9487527BE0EF04780F008A2DE982C6656DBB5E4988BA1

Function 0023E398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0023E3D5

Strings

0%/, xrefs: 0023E3B5
8%/, xrefs: 0023E3CA

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%/$8%/
API String ID: 1385522511-1744123779
Opcode ID: c872c500e826489b43340b66639ca6205b2d439bbe514d8ce77cc3b4cebea11f
Instruction ID: af2aace1338374143521b35badd15669d5e16a6b98818867275c9cc9063dd58b
Opcode Fuzzy Hash: c872c500e826489b43340b66639ca6205b2d439bbe514d8ce77cc3b4cebea11f
Instruction Fuzzy Hash: 3CE02671430914CBCE0CEB18BA98ABC3353AB06370F9101F5F6028B1D19B702CADCA44

Function 00293017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0029302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00293044

Strings

aut, xrefs: 00293038

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: c554c12ca5873886945e68862653fd767aa77ee23c4f6cd0e64dcb6812e664b7
Instruction ID: 8e6c32ecf4e25f0805872dbd67a987479ac9ca701f7f734c3644b9c1eff19d83
Opcode Fuzzy Hash: c554c12ca5873886945e68862653fd767aa77ee23c4f6cd0e64dcb6812e664b7
Instruction Fuzzy Hash: CDD05E7294032867DA20A7A5AC0EFCB3A6CDB05750F4002A1BB55E2091DAB09984CBE0

Function 0027D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0027D220

Strings

%.3d, xrefs: 0027D22B
X64, xrefs: 0027D2A8

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: ee43a5e932e71e6b1da5f32bba2d056ffc6784de66be5572056e374c2bfc975b
Instruction ID: 08d65cfbfb3e42dad0ed99edd49a2b7a5fae67b8eb69d1c6459e58a69ecfb479
Opcode Fuzzy Hash: ee43a5e932e71e6b1da5f32bba2d056ffc6784de66be5572056e374c2bfc975b
Instruction Fuzzy Hash: 83D012A1C38109EACB9096D0DC498B9B37CAF08301F60C452FD0AA1043D674D5296B61

Function 002B2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 002B232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 002B233F

Part of subcall function 0028E97B: Sleep.KERNEL32 ref: 0028E9F3

Strings

Shell_TrayWnd, xrefs: 002B2325

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 58a4596958b9414b58358dca23821acbb5638108fba554580fc075a72b9bb0c1
Instruction ID: 23ddd1388fa9687a33b140c2de2de081988de79b7aaeb8021efaa36b79740936
Opcode Fuzzy Hash: 58a4596958b9414b58358dca23821acbb5638108fba554580fc075a72b9bb0c1
Instruction Fuzzy Hash: CDD022363E0300B7E678B730EC0FFD6BA089B00B00F100A02B385AA0D0C8F0A800CB00

Function 002B2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 002B236C
PostMessageW.USER32(00000000), ref: 002B2373

Part of subcall function 0028E97B: Sleep.KERNEL32 ref: 0028E9F3

Strings

Shell_TrayWnd, xrefs: 002B2365

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 8f449215747c5a8680fac1e38a1bfcde5d97b7a58b0e5ad455dddeb2d4cefdb9
Instruction ID: 0049ace1f7027f18f7ca864a1f693cd8679ccbb6a8ca20a090fb785974f40811
Opcode Fuzzy Hash: 8f449215747c5a8680fac1e38a1bfcde5d97b7a58b0e5ad455dddeb2d4cefdb9
Instruction Fuzzy Hash: FDD0A9323D13007AE668B730AC0FFC6A6089B04B00F500A02B381AA0D0C8E0A8008B04

Function 0025BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0025BE93
GetLastError.KERNEL32 ref: 0025BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0025BEFC

Memory Dump Source

Source File: 00000000.00000002.2236847637.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.2236796498.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237206915.00000000002E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237633630.00000000002EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2237674788.00000000002F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: afeabf10b77df41b47cf924e0b520c58046ff41a622b4d209684875fe23296ba
Instruction ID: 9bb9f3e213ffd9d9d796bd68282058f84c99c3d2b3c5dda0bad1df87e36af17d
Opcode Fuzzy Hash: afeabf10b77df41b47cf924e0b520c58046ff41a622b4d209684875fe23296ba
Instruction Fuzzy Hash: EE411935624207AFCF268F64DC45ABABBA4EF41312F244169FD59971E1DB309C28CF64

Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View	IP Address: 151.101.193.91 151.101.193.91

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000000E.00000003.2262835549.000001634465B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262624431.0000016344650000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2261204841.00000163445AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2405666960.00000163416DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2409368583.000001634EC1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2374106736.000001634F216000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2397624996.000001634F217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2359061915.000001634F179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2374749812.000001634F173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2374749812.000001634F179000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2359061915.000001634F179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2374749812.000001634F173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2374749812.000001634F179000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2394600759.0000016344EDA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2389286686.0000016344EE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2427531031.0000016344EEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2374106736.000001634F216000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2397624996.000001634F217000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2404910454.00000163472CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2414963686.00000163472F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2386866752.00000163472CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2404910454.00000163472CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2414963686.00000163472F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2386866752.00000163472CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2359061915.000001634F179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2374749812.000001634F173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2374749812.000001634F179000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2359061915.000001634F179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2374749812.000001634F173000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2374749812.000001634F179000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3425118502.0000022EA5E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.3425410443.00000177CAA0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3425118502.0000022EA5E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.3425410443.00000177CAA0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2426917226.0000016345741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3425118502.0000022EA5E0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000002.3425410443.00000177CAA0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2358475998.000001634F1F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://6edd4cbe-8a9f-4158-beca-90f5feba9c8c/injections/js/bug1842437-www.youtube.com-performance-now-precision.js equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2401669080.000001634404B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2409227988.000001634EC5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2394600759.0000016344EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2401669080.000001634404B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2359061915.000001634F179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2322523265.0000016340E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2409227988.000001634EC5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2386012941.000001634C231000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2430081166.000001634475F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2242651262.000001634475F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.6:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49923 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_e4f85075-9617-4c0b-a77b-ff6ecf9aeea1.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_e4f85075-9617-4c0b-a77b-ff6ecf9aeea1.json.tmp

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Local\Temp\tmpaddon

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre