Edit tour

Windows Analysis Report
6eftz6UKDm.exe

Overview

General Information

Sample name:	6eftz6UKDm.exe renamed because original name is a hash value
Original sample name:	2b1706b1a255a25718d22746c3ae418e.exe
Analysis ID:	1575331
MD5:	2b1706b1a255a25718d22746c3ae418e
SHA1:	dedb5907b8746c76ad5bc264e05e06784447dcdd
SHA256:	6c07d9e629e0b333fb62691c0a8c21e63e6c8da54a7e02fb387d6aec8fd031e0
Tags:	exeuser-abuse_ch
Infos:

Detection

Credential Flusher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Credential Flusher

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

6eftz6UKDm.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\6eftz6UKDm.exe" MD5: 2B1706B1A255A25718D22746C3AE418E)

taskkill.exe (PID: 7360 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7464 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7536 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7592 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7656 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7724 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7756 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7772 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7976 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2116 -prefMapHandle 2104 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52efa55a-382f-4f2d-b37e-6cae35593156} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b024f6d510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7456 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3576 -parentBuildID 20230927232528 -prefsHandle 3648 -prefMapHandle 3444 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {392bfc75-40ab-4cc2-89ba-5f11b803c655} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b035f1b810 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7428 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 3068 -prefMapHandle 5384 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127fbe60-ff2d-4b40-bcf2-afa7809184d6} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b03ee3f510 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 6eftz6UKDm.exe PID: 7308	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 6eftz6UKDm.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 6eftz6UKDm.exe

Virustotal: Detection: 22%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: 6eftz6UKDm.exe

Joe Sandbox ML: detected

Source: 6eftz6UKDm.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49877 version: TLS 1.2

Source:	Binary string: freebl3.pdb source: firefox.exe, 0000000E.00000003.2320579255.000002B035CDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rsaenh.pdb source: firefox.exe, 0000000E.00000003.2318788013.000002B0360B5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: kbdus.pdb source: firefox.exe, 0000000E.00000003.2284334248.000002B034FAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wshbth.pdbGCTL source: firefox.exe, 0000000E.00000003.2323604558.000002B034FD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 0000000E.00000003.2323203334.000002B034FD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wshbth.pdb source: firefox.exe, 0000000E.00000003.2323604558.000002B034FD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 0000000E.00000003.2322240119.000002B034FCF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: nssckbi.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptsp.pdb source: firefox.exe, 0000000E.00000003.2318788013.000002B0360B5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: kbdus.pdbGCTL source: firefox.exe, 0000000E.00000003.2284334248.000002B034FAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000E.00000003.2322240119.000002B034FCF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb`rW source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: firefox.exe, 0000000E.00000003.2318788013.000002B0360B5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 0000000E.00000003.2292430631.000002B040621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msimg32.pdb source: firefox.exe, 0000000E.00000003.2320579255.000002B035CDE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 0000000E.00000003.2323203334.000002B034FD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ncrypt.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb` source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntasn1.pdb source: firefox.exe, 0000000E.00000003.2318788013.000002B0360B5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 0000000E.00000003.2292430631.000002B040621000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B0DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B0DBBE
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00ADC2A2 FindFirstFileExW,	0_2_00ADC2A2
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B168EE FindFirstFileW,FindClose,	0_2_00B168EE
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B1698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00B1698F
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B0D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B0D076
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B0D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B0D3A9
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B19642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B19642
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B1979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B1979D
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B19B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00B19B2B
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B15C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00B15C97

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 199MB

Source: unknown

Network traffic detected: DNS query count 31

Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View	IP Address: 151.101.193.91 151.101.193.91

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B1CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00B1CE44

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive

Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://connect.facebook.net//sdk.js*://cdn.optimizely.com/public/.js://static.chartbeat.com/js/chartbeat_video.js://www.rva311.com/static/js/main..chunk.js://connect.facebook.net//all.js://.imgur.com/js/vendor..bundle.js://www.google-analytics.com/analytics.js://www.google-analytics.com/gtm/js://www.everestjs.net/static/st.v3.js* equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2313902349.000002B039B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206504779.000002B039B81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2288168371.000002B039B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2288168371.000002B039BCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302850291.000002B039BCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2262474226.000002B036F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2212745115.000002B036F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2280088084.000002B03D5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262474226.000002B036F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279278035.000002B03E8B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2313902349.000002B039B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2318358499.000002B03642E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206504779.000002B039B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2288168371.000002B039BCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302850291.000002B039BCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["www.facebook.com","facebook.com"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["www.youtube.com","youtube.com"] equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2287272602.000002B03D58D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D58B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2287272602.000002B03D58D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D58B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: chrome://browser/content/cfr-lightning-dark.svgmr2022-onboarding-mobile-download-image-altmr2022-onboarding-mobile-download-titlemr2022-onboarding-existing-pin-headermr2022-onboarding-mobile-download-subtitlechrome://global/skin/icons/search-glass.svgmr2022-onboarding-mobile-download-cta-textresource://nimbus/ExperimentAPI.sys.mjsmr2022-onboarding-pin-private-image-altcfr-doorhanger-milestone-close-buttonetp-promotions?as=u&utm_source=inproduct["www.youtube.com","youtube.com"]mr2022-onboarding-existing-pin-subtitlemr2022-onboarding-set-default-titlemr2022-onboarding-set-default-subtitlemr2022-onboarding-privacy-segmentation-image-altdefault-browser-notification-messagedefault-browser-notification-button["www.wikipedia.org","wikipedia.org"]resource:///modules/ShellService.sys.mjs["www.facebook.com","facebook.com"]services.sync.clients.devices.mobilechrome://browser/content/cfr-lightning.svgmr2022-onboarding-pin-primary-button-labelmr2022-onboarding-secondary-skip-button-labelmr2022-onboarding-existing-pin-checkbox-labelresource://gre/modules/AppConstants.sys.mjsresource://gre/modules/XPCOMUtils.sys.mjsmr2022-onboarding-import-image-altresource://gre/modules/BrowserUtils.sys.mjsmr2022-onboarding-default-image-altbrowser.startup.upgradeDialog.pinPBM.disabledmr2022-onboarding-gratitude-title \| regExpMatch('(?<=complete":)(.)(?=})')fluent:about-private-browsing-focus-promo-text-cfluent:about-private-browsing-learn-more-linkfeltPrivacyShowPreferencesSectionbrowser.dataFeatureRecommendations.enabledScan the QR code to get Firefox Klarmr2022-onboarding-gratitude-subtitle!inMr2022Holdback && doesAppNeedPrivatePinmr2022-onboarding-no-mobile-download-cta-textmr2022-onboarding-privacy-segmentation-text-ctamr2022-onboarding-get-started-primary-subtitlemr2022-onboarding-gratitude-image-altbrowser.firefox-view.feature-tour \| regExpMatch('(?<=screen"s:)s*"(mr2022-onboarding-privacy-segmentation-title \| length - 1] == null \|\| messageImpressions.fx100-thank-you-pin-primary-button-labelonboarding-start-browsing-button-labelmr2022-onboarding-gratitude-primary-button-labelfluent:about-private-browsing-focus-promo-ctacookiebanners.service.mode.privateBrowsing_shouldShowPrivacySegmentationScreenbrowser.shell.checkDefaultBrowserfluent:about-private-browsing-pin-promo-headerchrome://browser/content/assets/focus-promo.pngchrome://browser/content/assets/focus-logo.svgfluent:about-private-browsing-pin-promo-titlechrome://browser/content/assets/klar-qr-code.svgbrowser.privateWindowSeparation.enabledmr2022-onboarding-privacy-segmentation-subtitletracking-protection-icon-containercallout-firefox-view-tab-pickup-titlecallout-firefox-view-tab-pickup-subtitlecallout-primary-advance-button-labelcallout-firefox-view-recently-closed-subtitlecallout-primary-complete-button-labelfirefoxview-spotlight-promo-subtitlemr1-onboarding-get-started-primary-button-labeladd24HourImpressionJEXLTargeting/<bound _onExperimentEnrollmentsUpdatedhandleMesssage(): about to block, data = firefoxview-
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: chrome://browser/content/cfr-lightning-dark.svgmr2022-onboarding-mobile-download-image-altmr2022-onboarding-mobile-download-titlemr2022-onboarding-existing-pin-headermr2022-onboarding-mobile-download-subtitlechrome://global/skin/icons/search-glass.svgmr2022-onboarding-mobile-download-cta-textresource://nimbus/ExperimentAPI.sys.mjsmr2022-onboarding-pin-private-image-altcfr-doorhanger-milestone-close-buttonetp-promotions?as=u&utm_source=inproduct["www.youtube.com","youtube.com"]mr2022-onboarding-existing-pin-subtitlemr2022-onboarding-set-default-titlemr2022-onboarding-set-default-subtitlemr2022-onboarding-privacy-segmentation-image-altdefault-browser-notification-messagedefault-browser-notification-button["www.wikipedia.org","wikipedia.org"]resource:///modules/ShellService.sys.mjs["www.facebook.com","facebook.com"]services.sync.clients.devices.mobilechrome://browser/content/cfr-lightning.svgmr2022-onboarding-pin-primary-button-labelmr2022-onboarding-secondary-skip-button-labelmr2022-onboarding-existing-pin-checkbox-labelresource://gre/modules/AppConstants.sys.mjsresource://gre/modules/XPCOMUtils.sys.mjsmr2022-onboarding-import-image-altresource://gre/modules/BrowserUtils.sys.mjsmr2022-onboarding-default-image-altbrowser.startup.upgradeDialog.pinPBM.disabledmr2022-onboarding-gratitude-title \| regExpMatch('(?<=complete":)(.)(?=})')fluent:about-private-browsing-focus-promo-text-cfluent:about-private-browsing-learn-more-linkfeltPrivacyShowPreferencesSectionbrowser.dataFeatureRecommendations.enabledScan the QR code to get Firefox Klarmr2022-onboarding-gratitude-subtitle!inMr2022Holdback && doesAppNeedPrivatePinmr2022-onboarding-no-mobile-download-cta-textmr2022-onboarding-privacy-segmentation-text-ctamr2022-onboarding-get-started-primary-subtitlemr2022-onboarding-gratitude-image-altbrowser.firefox-view.feature-tour \| regExpMatch('(?<=screen"s:)s*"(mr2022-onboarding-privacy-segmentation-title \| length - 1] == null \|\| messageImpressions.fx100-thank-you-pin-primary-button-labelonboarding-start-browsing-button-labelmr2022-onboarding-gratitude-primary-button-labelfluent:about-private-browsing-focus-promo-ctacookiebanners.service.mode.privateBrowsing_shouldShowPrivacySegmentationScreenbrowser.shell.checkDefaultBrowserfluent:about-private-browsing-pin-promo-headerchrome://browser/content/assets/focus-promo.pngchrome://browser/content/assets/focus-logo.svgfluent:about-private-browsing-pin-promo-titlechrome://browser/content/assets/klar-qr-code.svgbrowser.privateWindowSeparation.enabledmr2022-onboarding-privacy-segmentation-subtitletracking-protection-icon-containercallout-firefox-view-tab-pickup-titlecallout-firefox-view-tab-pickup-subtitlecallout-primary-advance-button-labelcallout-firefox-view-recently-closed-subtitlecallout-primary-complete-button-labelfirefoxview-spotlight-promo-subtitlemr1-onboarding-get-started-primary-button-labeladd24HourImpressionJEXLTargeting/<bound _onExperimentEnrollmentsUpdatedhandleMesssage(): about to block, data = firefoxview-
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2262474226.000002B036F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2212745115.000002B036F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2280088084.000002B03D5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262474226.000002B036F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279278035.000002B03E8B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000013.00000002.3895750768.000002B20EC0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000013.00000002.3895750768.000002B20EC0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000013.00000002.3895750768.000002B20EC0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA0210A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20EC0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA0210A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20EC0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA0210A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20EC0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2313711525.000002B039BA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2288168371.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/injections/js/bug1842437-www.youtube.com-performance-now-precision.js equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2313902349.000002B039B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279278035.000002B03E8B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2318358499.000002B03642E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000E.00000003.2288168371.000002B039BCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287365859.000002B034F85000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2285469247.000002B034F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2166711307.000002B036774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2159725182.000002B03676F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2177863266.000002B036774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000E.00000003.2318358499.000002B03642E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320004662.000002B035DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320004662.000002B035DB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: firefox.exe, 0000000E.00000003.2320004662.000002B035D73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199260685.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199229367.000002B034FAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197959866.000002B034FA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000000E.00000003.2284414490.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2285469247.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293845617.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286497769.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287096665.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2196447974.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323802838.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2253008076.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286193793.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197989719.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2322466556.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2283491958.000002B034F91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSH
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 0000000E.00000003.2196400985.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199260685.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199229367.000002B034FAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: firefox.exe, 0000000E.00000003.2284414490.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2285469247.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293845617.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286497769.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287096665.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2196447974.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323802838.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2253008076.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286193793.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197989719.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2322466556.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2283491958.000002B034F91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0y
Source: firefox.exe, 0000000E.00000003.2274896193.000002B030D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199229367.000002B034FAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197959866.000002B034FA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199260685.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: firefox.exe, 0000000E.00000003.2196400985.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199260685.000002B034F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 0000000E.00000003.2284414490.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2285469247.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293845617.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286497769.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287096665.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2196447974.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323802838.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2253008076.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286193793.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197989719.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2322466556.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2283491958.000002B034F91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4e
Source: firefox.exe, 0000000E.00000003.2284414490.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2285469247.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293845617.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286497769.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287096665.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2196447974.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323802838.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2253008076.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286193793.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197989719.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2322466556.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2283491958.000002B034F91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199260685.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: firefox.exe, 0000000E.00000003.2284414490.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2285469247.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293845617.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286497769.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287096665.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2196447974.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323802838.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2253008076.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286193793.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197989719.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2322466556.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2283491958.000002B034F91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-c
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000000E.00000003.2254681034.000002B03EED8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2211098835.000002B037793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206504779.000002B039B11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2308964621.000002B037794000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302850291.000002B039B13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2318739660.000002B0360E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2281370529.000002B039B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000000E.00000003.2315865175.000002B036425000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210277407.000002B03787D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000000E.00000003.2212093919.000002B036FA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2261908999.000002B036FA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlP
Source: firefox.exe, 0000000E.00000003.2212246887.000002B036F93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2315821659.000002B036432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2155176487.000002B036431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E592000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 0000000E.00000003.2237415683.000002B03F4D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262811793.000002B03F4D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.o
Source: firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000000E.00000003.2318635907.000002B0360F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2155404318.000002B0360FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 0000000E.00000003.2236831544.000002B035A9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2237773730.000002B03EDBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2186112018.000002B035ACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2127063136.000002B03D1C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2236831544.000002B035AEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109926086.000002B035AF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2272807536.000002B0355DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2228849591.000002B03EDC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2232156505.000002B03ED75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2232156505.000002B03ED51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2239672019.000002B03CE4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307407963.000002B0383A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205658846.000002B03D20E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2228548310.000002B0355F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2266818951.000002B035AB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2207395587.000002B03888F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2111779540.000002B0363DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148639644.000002B03D0E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: firefox.exe, 0000000E.00000003.2284414490.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2285469247.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293845617.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286497769.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287096665.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F85000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2196447974.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323802838.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2253008076.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286193793.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197989719.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2322466556.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2283491958.000002B034F91000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 0000000E.00000003.2284414490.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2285469247.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2293845617.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199260685.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286497769.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287096665.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199229367.000002B034FAC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197959866.000002B034FA6000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2196447974.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2200681865.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2323802838.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2253008076.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286193793.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2197989719.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2322466556.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2283491958.000002B034F91000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 0000000E.00000003.2196400985.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199260685.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199229367.000002B034FAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 0000000E.00000003.2274896193.000002B030D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000000E.00000003.2256058106.000002B03EBBD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202883512.000002B03EBBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148067050.000002B03D281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148067050.000002B03D281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000000E.00000003.2256058106.000002B03EBBD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202883512.000002B03EBBD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204644021.000002B03D281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148067050.000002B03D281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 0000000E.00000003.2274896193.000002B030D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: firefox.exe, 0000000E.00000003.2274896193.000002B030D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000000E.00000003.2197959866.000002B034FA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c?
Source: gmpopenh264.dll.tmp.14.dr	String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 0000000E.00000003.2314977336.000002B036459000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000000E.00000003.2211524730.000002B037748000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2211706815.000002B03770A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267240706.000002B035EBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202162724.000002B03EC77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286629691.000002B03F7D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2253423470.000002B03F7D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000000E.00000003.2211524730.000002B037748000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000000E.00000003.2211524730.000002B037748000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulp
Source: mozilla-temp-41.14.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 0000000E.00000003.2253803994.000002B03F784000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204644021.000002B03D281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148067050.000002B03D281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 0000000E.00000003.2253803994.000002B03F784000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204644021.000002B03D281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148067050.000002B03D281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000000E.00000003.2154729808.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2147667747.000002B03D5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2257919712.000002B03D5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000000E.00000003.2134424934.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2207395587.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307117804.000002B0388B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000000E.00000003.2305821055.000002B03E57E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000000E.00000003.2317942672.000002B03D095000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000000E.00000003.2300616283.000002B03D404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000000E.00000003.2210125907.000002B0378AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2315821659.000002B036432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads-us.rd.linksynergy.com/as.php
Source: firefox.exe, 0000000E.00000003.2318358499.000002B03642E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320004662.000002B035DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320004662.000002B035DB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000000E.00000003.2204003684.000002B03E5B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312899369.000002B03E5BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302373011.000002B03CD44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3898130395.000002B20EE03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3898130395.000002B20EE03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 0000000E.00000003.2302763921.000002B039BF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1170143
Source: firefox.exe, 0000000E.00000003.2189473848.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2190694062.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2191077360.000002B03718D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 0000000E.00000003.2189473848.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2190694062.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2191077360.000002B03718D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 0000000E.00000003.2189473848.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2190694062.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2189473848.000002B037175000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2189473848.000002B037175000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 0000000E.00000003.2189473848.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2190694062.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2191077360.000002B03718D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601https://bugzilla.mozilla.org/show_bug.cgi?id=126
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D23A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D23A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D23A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D23A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 0000000E.00000003.2189473848.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2190694062.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2191077360.000002B03718D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2189473848.000002B037175000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448resource://activity-stream/data/custom-elements/
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678942
Source: firefox.exe, 0000000E.00000003.2233964780.000002B03653B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2239989737.000002B036549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1817617
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1817617SELECT
Source: firefox.exe, 0000000E.00000003.2189473848.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2190694062.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2191077360.000002B03718D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480https://bugzilla.mozilla.org/show_bug.cgi?id=1189
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=793869
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=806991
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=806991https://bugzilla.mozilla.org/show_bug.cgi?id=1678
Source: firefox.exe, 0000000E.00000003.2189473848.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2189473848.000002B037165000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2190694062.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2189473848.000002B037175000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550All
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=815437
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=815437UPDATE
Source: firefox.exe, 0000000E.00000003.2190694062.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2189473848.000002B037175000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=951422
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000000E.00000003.2101745556.000002B03231D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102011151.000002B03233E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102306751.000002B032381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2101481039.000002B032100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102153601.000002B032360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000000E.00000003.2149874284.000002B03785A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2308597918.000002B03785A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210963420.000002B03785A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3898130395.000002B20EE03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3898130395.000002B20EE03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000000E.00000003.2300343408.000002B03D46B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000000E.00000003.2281499571.000002B0378D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2261749519.000002B0378D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321300389.000002B035C70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210125907.000002B0378AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 0000000E.00000003.2232156505.000002B03ED75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2228849591.000002B03ED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2282757842.000002B03ED7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: firefox.exe, 0000000E.00000003.2225147886.000002B034C65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2274896193.000002B030D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2251000622.000002B034C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000000E.00000003.2225147886.000002B034C65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2251000622.000002B034C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000013.00000002.3895750768.000002B20EC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000000E.00000003.2150966396.000002B03ED0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2152387822.000002B03ED73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000000E.00000003.2253803994.000002B03F762000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 0000000E.00000003.2201049268.000002B03F584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 0000000E.00000003.2254681034.000002B03EEE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2254642881.000002B03F57B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000013.00000002.3895750768.000002B20EC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000013.00000002.3895750768.000002B20ECC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000013.00000002.3895750768.000002B20ECC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000011.00000002.3895035389.000001EA0212F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20EC30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000013.00000002.3895750768.000002B20ECC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000000E.00000003.2300616283.000002B03D404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000013.00000002.3895750768.000002B20ECC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000000E.00000003.2227884987.000002B03D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2238608640.000002B03D163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000000E.00000003.2227884987.000002B03D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2238608640.000002B03D163000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000000E.00000003.2101745556.000002B03231D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102011151.000002B03233E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2101481039.000002B032100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102153601.000002B032360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2201049268.000002B03F584000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D23A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D23A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000000E.00000003.2313612809.000002B03D050000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000000E.00000003.2154729808.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2147667747.000002B03D5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2257919712.000002B03D5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D23A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsync
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncDEPRECATED_SCOPE_ECOSYSTEM_TELEMETRYstarting
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 0000000E.00000003.2311230265.000002B036F32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2282322902.000002B036F32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2212567196.000002B036F32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262316411.000002B036F32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/identity.fxaccounts.remote.pairing.uriERRNO_ENDPOINT_NO_LONGER_SUPP
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetry
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 0000000E.00000003.2300570503.000002B03D419000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: prefs-1.js.14.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D271000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2304616768.000002B03EBE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000000E.00000003.2301169102.000002B03CDF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2306084033.000002B03CDF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2258614827.000002B03CDF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20ECF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000000E.00000003.2278522498.000002B03EE4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2254967349.000002B03EE4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2203754172.000002B03E5C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204003684.000002B03E5B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2303973447.000002B03EE4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/ec1fcff0-0c1b-4e5f-85a5-6e05f
Source: firefox.exe, 00000013.00000002.3895750768.000002B20ECF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submithx
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000000E.00000003.2320579255.000002B035CF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2155812908.000002B035CF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2150301043.000002B035CF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000000E.00000003.2310561531.000002B0370BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000000E.00000003.2134424934.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2207395587.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307117804.000002B0388B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000000E.00000003.2134424934.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2207395587.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307117804.000002B0388B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000000E.00000003.2206504779.000002B039B11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302850291.000002B039B13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2314436334.000002B039B19000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2281370529.000002B039B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: firefox.exe, 0000000E.00000003.2225147886.000002B034C65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2251000622.000002B034C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000000E.00000003.2225147886.000002B034C65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2274896193.000002B030D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2251000622.000002B034C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000000E.00000003.2225147886.000002B034C65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2274896193.000002B030D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2251000622.000002B034C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4C72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA02186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20EC8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4C72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestabout
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199260685.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199229367.000002B034FAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000000E.00000003.2225147886.000002B034C65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2251000622.000002B034C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000000E.00000003.2225147886.000002B034C65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2274896193.000002B030D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2251000622.000002B034C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000000E.00000003.2206504779.000002B039B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 0000000E.00000003.2313612809.000002B03D050000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000000E.00000003.2293251958.000002B03EB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256269817.000002B03EB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286838356.000002B03EB7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000000E.00000003.2141251728.000002B0383DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2208455719.000002B0383DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000000E.00000003.2293251958.000002B03EB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256269817.000002B03EB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286838356.000002B03EB7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000000E.00000003.2293251958.000002B03EB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2256269817.000002B03EB7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2286838356.000002B03EB7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000000E.00000003.2102153601.000002B032360000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000000E.00000003.2232156505.000002B03ED75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2228849591.000002B03ED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2282757842.000002B03ED7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000000E.00000003.2201702985.000002B03ECA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2304406534.000002B03ECA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000000E.00000003.2202883512.000002B03EBA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 0000000E.00000003.2315995552.000002B036417000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000E.00000003.2155176487.000002B036431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2(brows
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2(browser
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000000E.00000003.2147871403.000002B03D2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2258104827.000002B03D2D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204274969.000002B03D2D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000000E.00000003.2155176487.000002B036438000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2150086467.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA02112000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20EC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000013.00000002.3895750768.000002B20EC13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/Error:
Source: firefox.exe, 0000000E.00000003.2155176487.000002B036438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 0000000E.00000003.2298111404.000002B03E9F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2153644677.000002B03E9F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20ECF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202536637.000002B03EC2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320004662.000002B035DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320004662.000002B035DB6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202536637.000002B03EC2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelresource:///modules/sessionstore/SessionStore.sy
Source: places.sqlite-wal.14.dr	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000000E.00000003.2307986059.000002B0378BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2149562705.000002B0378AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210125907.000002B0378AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000000E.00000003.2308597918.000002B037864000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210963420.000002B037864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D291000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2300664441.000002B03D2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204003684.000002B03E5B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280556961.000002B03D2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312899369.000002B03E5BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000000E.00000003.2279780719.000002B03E5E8000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.14.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000000E.00000003.2223492242.000002B0384DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000000E.00000003.2302423376.000002B03CCF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2306344433.000002B03CCF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000000E.00000003.2267240706.000002B035EBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/update-firefox-latest-release
Source: places.sqlite-wal.14.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.
Source: firefox.exe, 0000000E.00000003.2279780719.000002B03E5E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com/
Source: firefox.exe, 0000000E.00000003.2201338275.000002B03ECF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000000E.00000003.2313612809.000002B03D050000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204644021.000002B03D27D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000000E.00000003.2280088084.000002B03D571000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000000E.00000003.2280088084.000002B03D571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000000E.00000003.2257919712.000002B03D5F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3898130395.000002B20EE03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000000E.00000003.2166711307.000002B036774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2159725182.000002B03676F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2177863266.000002B036774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D571000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2160897194.000002B03676F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2165830389.000002B03676F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2217115199.000002B036760000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2236015232.000002B036767000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2179309627.000002B036774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000000E.00000003.2166711307.000002B036774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2159725182.000002B03676F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2177863266.000002B036774000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2160897194.000002B03676F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2165830389.000002B03676F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2217115199.000002B036760000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2236015232.000002B036767000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2179309627.000002B036774000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/8
Source: firefox.exe, 0000000E.00000003.2280088084.000002B03D571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000000E.00000003.2287272602.000002B03D58D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D58B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3898130395.000002B20EE03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 0000000E.00000003.2287272602.000002B03D58D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D58B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000000E.00000003.2199519568.000002B034FB3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2199260685.000002B034F94000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.14.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 0000000E.00000003.2287272602.000002B03D58D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D58B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000000E.00000003.2280088084.000002B03D571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: firefox.exe, 0000000E.00000003.2153541469.000002B03EA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000000E.00000003.2301169102.000002B03CDAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2306084033.000002B03CDB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000000E.00000003.2153541469.000002B03EA3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000000E.00000003.2153541469.000002B03EA3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2317942672.000002B03D0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 0000000E.00000003.2147093391.000002B03EA8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2305223060.000002B03EB41000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.
Source: firefox.exe, 0000000E.00000003.2279780719.000002B03E5E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 0000000E.00000003.2150966396.000002B03ED0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2152387822.000002B03ED73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/anything/?
Source: places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.
Source: firefox.exe, 0000000E.00000003.2279780719.000002B03E5E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: firefox.exe, 0000000E.00000003.2308597918.000002B037864000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210963420.000002B037864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: firefox.exe, 0000000E.00000003.2278522498.000002B03EE88000.00000004.00000800.00020000.00000000.sdmp, targeting.snapshot.json.tmp.14.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: firefox.exe, 0000000E.00000003.2296872223.000002B03EA8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2305223060.000002B03EB37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279780719.000002B03E5E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2147093391.000002B03EA8C000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 0000000E.00000003.2308597918.000002B037864000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210963420.000002B037864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: firefox.exe, 0000000E.00000003.2279780719.000002B03E5E8000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000000E.00000003.2296872223.000002B03EA8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2305223060.000002B03EB37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279780719.000002B03E5E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2147093391.000002B03EA8C000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20ECF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/G&
Source: firefox.exe, 0000000E.00000003.2300475109.000002B03D433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 0000000E.00000003.2305223060.000002B03EB37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279780719.000002B03E5E8000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.14.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000013.00000002.3895750768.000002B20ECF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/s
Source: firefox.exe, 0000000E.00000003.2134424934.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2207395587.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307117804.000002B0388B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000000E.00000003.2280088084.000002B03D571000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204644021.000002B03D27D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000000E.00000003.2257919712.000002B03D5F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000000E.00000003.2313902349.000002B039B88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206504779.000002B039B81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206504779.000002B039B90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2288168371.000002B039B81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280722462.000002B039B74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280722462.000002B039B90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302850291.000002B039B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: firefox.exe, 0000000E.00000003.2280088084.000002B03D571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000013.00000002.3895750768.000002B20EC0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000000E.00000003.2204644021.000002B03D27D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000000E.00000003.2210277407.000002B03787D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000000E.00000003.2301169102.000002B03CDAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2318122979.000002B03CCF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2211098835.000002B037793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206295453.000002B03D0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2308964621.000002B037794000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2134220410.000002B03CCF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2317942672.000002B03D0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302423376.000002B03CCF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2306084033.000002B03CDB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148639644.000002B03D0BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2306344433.000002B03CCF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154428910.000002B03D0BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000000E.00000003.2211098835.000002B037793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2308964621.000002B037794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/0
Source: firefox.exe, 0000000E.00000003.2301169102.000002B03CDAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2306084033.000002B03CDB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/P
Source: recovery.jsonlz4.tmp.14.dr	String found in binary or memory: https://youtube.com/account?=
Source: firefox.exe, 00000013.00000002.3895269775.000002B20EAF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.co
Source: firefox.exe, 0000000E.00000003.2210277407.000002B03787D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3894749010.00000257D4A9A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897518760.00000257D4D84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3894749010.00000257D4A90000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3894211289.000001EA01E9A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3897863612.000001EA02264000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895269775.000002B20EAF4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3894616855.000002B20E8BA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3894616855.000002B20E8B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000000C.00000002.2091314316.000002C0F5E1A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000D.00000002.2096673509.000001E6A892A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000011.00000002.3894211289.000001EA01E9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdD
Source: firefox.exe, 00000010.00000002.3897518760.00000257D4D84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3894749010.00000257D4A90000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3894211289.000001EA01E90000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3897863612.000001EA02264000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895269775.000002B20EAF4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3894616855.000002B20E8B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000011.00000002.3894211289.000001EA01E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdP
Source: firefox.exe, 0000000E.00000003.2211343802.000002B037770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdz

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49877 version: TLS 1.2

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B1EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B1EAFF

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B1ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B1ED6A

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

0_2_00B1EAFF

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B0AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00B0AA57

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B39576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00B39576

System Summary

Binary is likely a compiled AutoIt script file

Source: 6eftz6UKDm.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 6eftz6UKDm.exe, 00000000.00000000.2032938741.0000000000B62000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_34bc1dd7-4
Source: 6eftz6UKDm.exe, 00000000.00000000.2032938741.0000000000B62000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_9ac26e57-c
Source: 6eftz6UKDm.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_8fc1dafb-f
Source: 6eftz6UKDm.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3a5da30e-9

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_000001EA0225B637 NtQuerySystemInformation,		17_2_000001EA0225B637
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_000001EA026E91B2 NtQuerySystemInformation,		17_2_000001EA026E91B2

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B0D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00B0D5EB

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B01201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00B01201

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B0E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00B0E8F6

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AA8060	0_2_00AA8060
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B12046	0_2_00B12046
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B08298	0_2_00B08298
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00ADE4FF	0_2_00ADE4FF
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AD676B	0_2_00AD676B
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B34873	0_2_00B34873
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00ACCAA0	0_2_00ACCAA0
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AACAF0	0_2_00AACAF0
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00ABCC39	0_2_00ABCC39
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AD6DD9	0_2_00AD6DD9
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00ABD064	0_2_00ABD064
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AA91C0	0_2_00AA91C0
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00ABB119	0_2_00ABB119
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC1394	0_2_00AC1394
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC1706	0_2_00AC1706
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC781B	0_2_00AC781B
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC19B0	0_2_00AC19B0
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AA7920	0_2_00AA7920
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AB997D	0_2_00AB997D
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC7A4A	0_2_00AC7A4A
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC7CA7	0_2_00AC7CA7
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC1C77	0_2_00AC1C77
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AD9EEE	0_2_00AD9EEE
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B2BE44	0_2_00B2BE44
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC1F32	0_2_00AC1F32
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_000001EA0225B637	17_2_000001EA0225B637
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_000001EA026E91B2	17_2_000001EA026E91B2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_000001EA026E91F2	17_2_000001EA026E91F2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 17_2_000001EA026E98DC	17_2_000001EA026E98DC

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: String function: 00AA9CB3 appears 31 times
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: String function: 00AC0A30 appears 46 times
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: String function: 00ABF9F2 appears 40 times

Source: 6eftz6UKDm.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.troj.evad.winEXE@34/41@71/12

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B137B5 GetLastError,FormatMessageW,

0_2_00B137B5

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B010BF AdjustTokenPrivileges,CloseHandle,		0_2_00B010BF
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B016C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00B016C3

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B151CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00B151CD

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B0D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00B0D4DC

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B1648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00B1648E

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AA42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00AA42A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: 6eftz6UKDm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2305691707.000002B03E5A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2254681034.000002B03EEE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312941670.000002B03E5AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2305691707.000002B03E5A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312941670.000002B03E5AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2305691707.000002B03E5A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312941670.000002B03E5AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E5A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312941670.000002B03E5AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E5A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312941670.000002B03E5AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E5A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312941670.000002B03E5AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E5A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312941670.000002B03E5AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;
Source: firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2305691707.000002B03E5A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312941670.000002B03E5AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);
Source: firefox.exe, 0000000E.00000003.2305691707.000002B03E5A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2312941670.000002B03E5AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9

Source: 6eftz6UKDm.exe

Virustotal: Detection: 22%

Source: unknown	Process created: C:\Users\user\Desktop\6eftz6UKDm.exe "C:\Users\user\Desktop\6eftz6UKDm.exe"
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2116 -prefMapHandle 2104 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52efa55a-382f-4f2d-b37e-6cae35593156} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b024f6d510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3576 -parentBuildID 20230927232528 -prefsHandle 3648 -prefMapHandle 3444 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {392bfc75-40ab-4cc2-89ba-5f11b803c655} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b035f1b810 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 3068 -prefMapHandle 5384 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127fbe60-ff2d-4b40-bcf2-afa7809184d6} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b03ee3f510 utility
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2116 -prefMapHandle 2104 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52efa55a-382f-4f2d-b37e-6cae35593156} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b024f6d510 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3576 -parentBuildID 20230927232528 -prefsHandle 3648 -prefMapHandle 3444 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {392bfc75-40ab-4cc2-89ba-5f11b803c655} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b035f1b810 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 3068 -prefMapHandle 5384 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127fbe60-ff2d-4b40-bcf2-afa7809184d6} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b03ee3f510 utility	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 6eftz6UKDm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 6eftz6UKDm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 6eftz6UKDm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 6eftz6UKDm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 6eftz6UKDm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 6eftz6UKDm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 6eftz6UKDm.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: firefox.exe, 0000000E.00000003.2320579255.000002B035CDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rsaenh.pdb source: firefox.exe, 0000000E.00000003.2318788013.000002B0360B5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: kbdus.pdb source: firefox.exe, 0000000E.00000003.2284334248.000002B034FAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wshbth.pdbGCTL source: firefox.exe, 0000000E.00000003.2323604558.000002B034FD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 0000000E.00000003.2323203334.000002B034FD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wshbth.pdb source: firefox.exe, 0000000E.00000003.2323604558.000002B034FD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 0000000E.00000003.2322240119.000002B034FCF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: nssckbi.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptsp.pdb source: firefox.exe, 0000000E.00000003.2318788013.000002B0360B5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: kbdus.pdbGCTL source: firefox.exe, 0000000E.00000003.2284334248.000002B034FAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.14.dr
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 0000000E.00000003.2322240119.000002B034FCF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb`rW source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: firefox.exe, 0000000E.00000003.2318788013.000002B0360B5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 0000000E.00000003.2292430631.000002B040621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msimg32.pdb source: firefox.exe, 0000000E.00000003.2320579255.000002B035CDE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 0000000E.00000003.2323203334.000002B034FD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ncrypt.pdb source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb` source: firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntasn1.pdb source: firefox.exe, 0000000E.00000003.2318788013.000002B0360B5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 0000000E.00000003.2292430631.000002B040621000.00000004.00000020.00020000.00000000.sdmp

Source: 6eftz6UKDm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 6eftz6UKDm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 6eftz6UKDm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 6eftz6UKDm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 6eftz6UKDm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AA42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AA42DE

Source: gmpopenh264.dll.tmp.14.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AC0A76 push ecx; ret

0_2_00AC0A89

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00ABF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00ABF98E
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B31C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00B31C41

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-97581

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 17_2_000001EA0225B637 rdtsc

17_2_000001EA0225B637

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

API coverage: 3.8 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B0DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B0DBBE
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00ADC2A2 FindFirstFileExW,	0_2_00ADC2A2
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B168EE FindFirstFileW,FindClose,	0_2_00B168EE
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B1698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00B1698F
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B0D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B0D076
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B0D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B0D3A9
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B19642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B19642
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B1979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B1979D
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B19B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00B19B2B
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B15C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00B15C97

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AA42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AA42DE

Source: firefox.exe, 00000010.00000002.3898454185.00000257D4F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWYu
Source: firefox.exe, 00000010.00000002.3898454185.00000257D4F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'q
Source: 6eftz6UKDm.exe, 00000000.00000003.2125478909.000000000121A000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2142877601.000000000121C000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000002.2146819204.000000000121D000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2143229219.000000000121D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: 6eftz6UKDm.exe, 00000000.00000003.2143767165.00000000011EE000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000002.2146720132.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2142382687.00000000011E2000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2142288276.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2142156762.00000000011D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;
Source: 6eftz6UKDm.exe, 00000000.00000003.2143229219.0000000001216000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2142382687.00000000011E2000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2142826714.0000000001211000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2142288276.00000000011DC000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2142156762.00000000011D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: firefox.exe, 00000010.00000002.3894749010.00000257D4A9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 6eftz6UKDm.exe, 00000000.00000003.2125478909.000000000121A000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2142877601.000000000121C000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000002.2146819204.000000000121D000.00000004.00000020.00020000.00000000.sdmp, 6eftz6UKDm.exe, 00000000.00000003.2143229219.000000000121D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3894211289.000001EA01E9A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3898321391.000001EA02790000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3894616855.000002B20E8BA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3897992788.000002B20ED00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000010.00000002.3898454185.00000257D4F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh~
Source: firefox.exe, 00000010.00000002.3897816689.00000257D4E1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 00000011.00000002.3898321391.000001EA02790000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: firefox.exe, 00000010.00000002.3898454185.00000257D4F00000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3898321391.000001EA02790000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 17_2_000001EA0225B637 rdtsc

17_2_000001EA0225B637

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B1EAA2 BlockInput,

0_2_00B1EAA2

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AD2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00AD2622

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AA42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AA42DE

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AC4CE8 mov eax, dword ptr fs:[00000030h]

0_2_00AC4CE8

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B00B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00B00B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AD2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AD2622
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AC083F
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC09D5 SetUnhandledExceptionFilter,	0_2_00AC09D5
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00AC0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00AC0C21

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

0_2_00B01201

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AE2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00AE2BA5

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B0B226 SendInput,keybd_event,

0_2_00B0B226

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B222DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00B222DA

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

0_2_00B00B62

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00B01663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00B01663

Source: 6eftz6UKDm.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 6eftz6UKDm.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AC0698 cpuid

0_2_00AC0698

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AFD21C GetLocalTime,

0_2_00AFD21C

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AFD27A GetUserNameW,

0_2_00AFD27A

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00ADB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00ADB952

Source: C:\Users\user\Desktop\6eftz6UKDm.exe

Code function: 0_2_00AA42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AA42DE

Stealing of Sensitive Information

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 6eftz6UKDm.exe PID: 7308, type: MEMORYSTR

Source: 6eftz6UKDm.exe	Binary or memory string: WIN_81
Source: 6eftz6UKDm.exe	Binary or memory string: WIN_XP
Source: 6eftz6UKDm.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 6eftz6UKDm.exe	Binary or memory string: WIN_XPe
Source: 6eftz6UKDm.exe	Binary or memory string: WIN_VISTA
Source: 6eftz6UKDm.exe	Binary or memory string: WIN_7
Source: 6eftz6UKDm.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 6eftz6UKDm.exe PID: 7308, type: MEMORYSTR

Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B21204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00B21204
Source: C:\Users\user\Desktop\6eftz6UKDm.exe	Code function: 0_2_00B21806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00B21806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6eftz6UKDm.exe	22%	Virustotal		Browse
6eftz6UKDm.exe	100%	Avira	TR/ATRAPS.Gen
6eftz6UKDm.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://identity.mozilla.com/cmd/identity.fxaccounts.remote.pairing.uriERRNO_ENDPOINT_NO_LONGER_SUPP	0%	Avira URL Cloud	safe
https://identity.mozilla.com/cmd/identity.fxaccounts.remote.pairing.uriERRNO_ENDPOINT_NO_LONGER_SUPP	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
star-mini.c10r.facebook.com	157.240.195.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.65	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
services.addons.mozilla.org	151.101.193.91	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.110	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
youtube-ui.l.google.com	142.250.181.14	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.129.140	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1678942	firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000013.00000002.3895750768.000002B20ECC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://datastudio.google.com/embed/reporting/	firefox.exe, 0000000E.00000003.2281499571.000002B0378D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2261749519.000002B0378D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2321300389.000002B035C70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2210125907.000002B0378AA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com0	gmpopenh264.dll.tmp.14.dr	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3898130395.000002B20EE03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000010.00000002.3895411322.00000257D4C72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA02186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20EC8F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.leboncoin.fr/	firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.o	firefox.exe, 0000000E.00000003.2237415683.000002B03F4D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262811793.000002B03F4D7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000000E.00000003.2155176487.000002B036438000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com	firefox.exe, 0000000E.00000003.2202883512.000002B03EBA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000000E.00000003.2101745556.000002B03231D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102011151.000002B03233E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102306751.000002B032381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2101481039.000002B032100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102153601.000002B032360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000000E.00000003.2318358499.000002B03642E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320004662.000002B035DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320004662.000002B035DB6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 0000000E.00000003.2305691707.000002B03E592000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 0000000E.00000003.2204644021.000002B03D23A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com	firefox.exe, 0000000E.00000003.2134424934.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2207395587.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307117804.000002B0388B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000000E.00000003.2101745556.000002B03231D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102011151.000002B03233E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2101481039.000002B032100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2102153601.000002B032360000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2(browser	firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 0000000E.00000003.2301169102.000002B03CDAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2318122979.000002B03CCF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2211098835.000002B037793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2206295453.000002B03D0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2308964621.000002B037794000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2134220410.000002B03CCF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2317942672.000002B03D0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2302423376.000002B03CCF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2306084033.000002B03CDB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148639644.000002B03D0BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2306344433.000002B03CCF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154428910.000002B03D0BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2020-12/schema/=	firefox.exe, 0000000E.00000003.2202812087.000002B03EBFD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=809550All	firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/	firefox.exe, 0000000E.00000003.2257919712.000002B03D5F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000000E.00000003.2274896193.000002B030D7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 00000013.00000002.3895750768.000002B20EC0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	firefox.exe, 0000000E.00000003.2189473848.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2190694062.000002B037184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2191077360.000002B03718D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313027525.000002B03E528000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000013.00000002.3895750768.000002B20ECC4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 0000000E.00000003.2320004662.000002B035D73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220	firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2189473848.000002B037175000.00000004.00000800.00020000.00000000.sdmp	false		high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000000E.00000003.2232156505.000002B03ED75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2228849591.000002B03ED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2282757842.000002B03ED7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000000E.00000003.2302763921.000002B039BF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://identity.mozilla.com/cmd/identity.fxaccounts.remote.pairing.uriERRNO_ENDPOINT_NO_LONGER_SUPP	firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2202536637.000002B03EC2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/account?=	recovery.jsonlz4.tmp.14.dr	false		high
https://shavar.services.mozilla.com/	firefox.exe, 0000000E.00000003.2315995552.000002B036417000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	firefox.exe, 0000000E.00000003.2279780719.000002B03E5E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3898130395.000002B20EE03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	firefox.exe, 00000010.00000002.3895411322.00000257D4CCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA021EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3898130395.000002B20EE03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.14.dr	false		high
https://spocs.getpocket.com/	firefox.exe, 0000000E.00000003.2155176487.000002B036438000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2150086467.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2319408039.000002B035FAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.3895035389.000001EA02112000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000013.00000002.3895750768.000002B20EC13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000000E.00000003.2147799338.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2154729808.000002B03D5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2279973103.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2287091800.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5BE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/account?=https://accounts.google.co	firefox.exe, 00000013.00000002.3895269775.000002B20EAF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.	places.sqlite-wal.14.dr	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/	firefox.exe, 0000000E.00000003.2206504779.000002B039B98000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggestabout	firefox.exe, 00000010.00000002.3895411322.00000257D4C72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000000E.00000003.2204644021.000002B03D23A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-pixelresource:///modules/sessionstore/SessionStore.sy	firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	prefs-1.js.14.dr	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1170143	firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=806991https://bugzilla.mozilla.org/show_bug.cgi?id=1678	firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 0000000E.00000003.2236831544.000002B035A9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2237773730.000002B03EDBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2186112018.000002B035ACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D14E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2127063136.000002B03D1C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2236831544.000002B035AEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2109926086.000002B035AF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2272807536.000002B0355DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2228849591.000002B03EDC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2232156505.000002B03ED75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2232156505.000002B03ED51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2239672019.000002B03CE4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307407963.000002B0383A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2205658846.000002B03D20E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2228548310.000002B0355F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2266818951.000002B035AB9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2313300043.000002B03D5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2207395587.000002B03888F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2111779540.000002B0363DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148639644.000002B03D0E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 0000000E.00000003.2134424934.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2207395587.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307117804.000002B0388B0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 0000000E.00000003.2154729808.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2147667747.000002B03D5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2257919712.000002B03D5E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000000E.00000003.2134424934.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2207395587.000002B038897000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2307117804.000002B0388B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://coverage.mozilla.org	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	gmpopenh264.dll.tmp.14.dr	false		high
https://www.zhihu.com/	firefox.exe, 0000000E.00000003.2204644021.000002B03D27D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2309558885.000002B037568000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	firefox.exe, 0000000E.00000003.2253803994.000002B03F784000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204644021.000002B03D281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148067050.000002B03D281000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	firefox.exe, 0000000E.00000003.2253803994.000002B03F784000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2155812908.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2320579255.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2143725820.000002B035CE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2204644021.000002B03D281000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2148067050.000002B03D281000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000000E.00000003.2238608640.000002B03D169000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2227884987.000002B03D169000.00000004.00000800.00020000.00000000.sdmp	false		high
https://blocked.cdn.mozilla.net/	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema	firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2280088084.000002B03D571000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1817617SELECT	firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 0000000E.00000003.2204044907.000002B03D5C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com	firefox.exe, 00000010.00000002.3897430884.00000257D4D20000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000011.00000002.3897458728.000001EA02200000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000013.00000002.3895088308.000002B20EA20000.00000002.10000000.00040000.00000000.sdmp	false		high
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 0000000E.00000003.2225147886.000002B034C65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2251000622.000002B034C77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=793869	firefox.exe, 0000000E.00000003.2267303428.000002B035E95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://identity.mozilla.com/apps/relay	firefox.exe, 0000000E.00000003.2311230265.000002B036F32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2267416841.000002B035E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2282322902.000002B036F32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2212567196.000002B036F32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000000E.00000003.2262316411.000002B036F32000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
142.250.181.110	youtube.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
151.101.193.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575331
Start date and time:	2024-12-15 09:25:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6eftz6UKDm.exe renamed because original name is a hash value
Original Sample Name:	2b1706b1a255a25718d22746c3ae418e.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@34/41@71/12
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 49 Number of non-executed functions: 293
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 54.213.181.160, 35.85.93.176, 44.228.225.150, 172.217.17.46, 88.221.134.155, 88.221.134.209, 142.250.181.106, 142.250.181.138, 23.218.208.109, 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, ciscobinary.openh264.org, slscr.update.microsoft.com, otelrules.azureedge.net, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, a17.rackcdn.com.mdc.edgesuite.net, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, a19.dscg10.akamai.net, ocsp.digicert.com, redirector.gvt1.com, safebrowsing.googleapis.com, location.services.mozilla.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.117.188.166	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
151.101.193.91	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
34.149.100.209	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
twitter.com	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.193
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.244.42.1
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	104.244.42.129
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	104.244.42.65
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	104.244.42.193
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.244.42.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	104.244.42.65
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	104.244.42.193
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	104.244.42.1
star-mini.c10r.facebook.com	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse	157.240.196.35
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	157.240.196.35
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	157.240.196.35
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	157.240.196.35
	https://qr.me-qr.com/nl/sWBHqqwx	Get hash	malicious	Unknown	Browse	157.240.196.35
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	157.240.196.35
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	157.240.196.35
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	157.240.196.35
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	157.240.196.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	34.117.188.166
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	TRC.mpsl.elf	Get hash	malicious	Mirai	Browse	34.66.152.246
	TRC.sh4.elf	Get hash	malicious	Mirai	Browse	34.65.156.142
FASTLYUS	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	rebirth.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	104.156.89.37
	LaRHzSijsq.exe	Get hash	malicious	DCRat	Browse	185.199.109.133
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	151.101.193.91
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.109.133
	c56uoWlDXp.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	PO_0099822111ORDER.js	Get hash	malicious	Remcos	Browse	151.101.193.137
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	151.101.193.91
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2F7T2aAE-SUREDANNYWthbnNoYS5rYW5vZGlhQGx0aW1pbmR0cmVlLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
ATGS-MMD-ASUS	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.160.144.191
	rebirth.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	57.162.2.122
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	48.105.135.114
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	48.183.87.136
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	33.54.211.134
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	48.133.95.30
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	34.160.144.191

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	151.101.193.91 35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	nmy4mJXEaz.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_fe196fc7-e3cf-4702-88c8-75667b87b689.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.180946316495888
Encrypted:	false
SSDEEP:	192:qYKMX1BCcbhbVbTbfbRbObtbyEl7nAraJA6wnSrDtTkd/Sce:qYP2cNhnzFSJgrpjnSrDhkd/q
MD5:	D133DAB8AC9F0ABBA180C0059BAFC23F
SHA1:	9D2B7DF61728388A7FE64BEA990A64F438651D79
SHA-256:	E78E7AAFD2D64843C3249D7AA13662C377F1DE883B17901CB6093126CD37287B
SHA-512:	A4FE12E404A7563A034F4E28A6642368E209454FDABB7C43E6A9EFBAD3794B9829315C0195E7DBCC61C6ECF947DEEACC979A8F6FF364D4FDDD0F12DBB32D03B3
Malicious:	false
Preview:	{"type":"uninstall","id":"fe196fc7-e3cf-4702-88c8-75667b87b689","creationDate":"2024-12-15T10:05:51.677Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_fe196fc7-e3cf-4702-88c8-75667b87b689.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7813
Entropy (8bit):	5.180946316495888
Encrypted:	false
SSDEEP:	192:qYKMX1BCcbhbVbTbfbRbObtbyEl7nAraJA6wnSrDtTkd/Sce:qYP2cNhnzFSJgrpjnSrDhkd/q
MD5:	D133DAB8AC9F0ABBA180C0059BAFC23F
SHA1:	9D2B7DF61728388A7FE64BEA990A64F438651D79
SHA-256:	E78E7AAFD2D64843C3249D7AA13662C377F1DE883B17901CB6093126CD37287B
SHA-512:	A4FE12E404A7563A034F4E28A6642368E209454FDABB7C43E6A9EFBAD3794B9829315C0195E7DBCC61C6ECF947DEEACC979A8F6FF364D4FDDD0F12DBB32D03B3
Malicious:	false
Preview:	{"type":"uninstall","id":"fe196fc7-e3cf-4702-88c8-75667b87b689","creationDate":"2024-12-15T10:05:51.677Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\jumpListCache\pV+3TL7Nu3EP5juvr_gPjg==.ico

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	MS Windows icon resource - 1 icon, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 24 bits/pixel
Category:	modified
Size (bytes):	490
Entropy (8bit):	7.246483341090937
Encrypted:	false
SSDEEP:	12:l8v/7J2T+gwjz+vdzLSMO9mj253UT3BcHXhJo:82CgwS//O91iT3BUXh6
MD5:	BD9751DFFFEFFA2154CC5913489ED58C
SHA1:	1C9230053C45CA44883103A6ACFDF49AC53ABF45
SHA-256:	834C4F18E96CFDAA395246183DE76032F1B77886764CEEBE52F6A146FA4D4C3B
SHA-512:	01072F60F4B2489BB84639A6179A82A3EA90A31C1AD61D30EF27800C3114DB5E45662583E1C0B5382F51635DC14372EFC71DCD069999D6B21A5D256C70697790
Malicious:	false
Preview:	.......................PNG........IHDR................a....IDAT8O...1P......p....d1.....v)......p.nXM.t.H.(.......B$..}_G.{.......:uN...=......s\|.$...`0.....dl6.>>>p.\.v;z.......F.a:.2..D.V.....V..n...g.z.X..C...v.......=.H..d..P...i.."...X,.B...h...xyy.V....I$..J%r....6....Z-:...P..J..........\|>'...P.\&.....l6....N5...Z.x<.....h.z..'@...L&.F..'.Jq<...m6.OOO.....$..r:.......v..V..ze.\.p.R..t.Z.....r...B...3.B..0...TE".p8.D0..`2.D.j...h..n...wF...........#......O....IEND.B`.

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3036944682881555
Encrypted:	false
SSDEEP:	24:6dfe69AETIUx2dWoM15zLN8zm/dfe69AEswM+bpoqdWoM15zLFX1Rgmpdfe69AEZ:6diVUgdw8zodiL6BdwsKdiradwu1
MD5:	E38629A2BB7FDD8142855628F4D316EB
SHA1:	1091BF9215FAA83DC4A559B75524DE2C377CFF43
SHA-256:	8A62ACF1622C003A9039EDD435396D716EFA00FE8E95E9F681C2B5407EDD8740
SHA-512:	B67E81DDB2A165A924C901E409305CE7F1F9511B6F0B534178749C6A9651CEA112DCB8655633708BDF57D2E863B1313281B775830191C0B36EBC13BB3034A889
Malicious:	false
Preview:	...................................FL..................F.@.. ...p...........N..........S...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.YMC....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.YMC............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.YMC..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........O........C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3036944682881555
Encrypted:	false
SSDEEP:	24:6dfe69AETIUx2dWoM15zLN8zm/dfe69AEswM+bpoqdWoM15zLFX1Rgmpdfe69AEZ:6diVUgdw8zodiL6BdwsKdiradwu1
MD5:	E38629A2BB7FDD8142855628F4D316EB
SHA1:	1091BF9215FAA83DC4A559B75524DE2C377CFF43
SHA-256:	8A62ACF1622C003A9039EDD435396D716EFA00FE8E95E9F681C2B5407EDD8740
SHA-512:	B67E81DDB2A165A924C901E409305CE7F1F9511B6F0B534178749C6A9651CEA112DCB8655633708BDF57D2E863B1313281B775830191C0B36EBC13BB3034A889
Malicious:	false
Preview:	...................................FL..................F.@.. ...p...........N..........S...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.YMC....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.YMC............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.YMC..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........O........C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HI9RRLU0LNABEM630DA0.temp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3036944682881555
Encrypted:	false
SSDEEP:	24:6dfe69AETIUx2dWoM15zLN8zm/dfe69AEswM+bpoqdWoM15zLFX1Rgmpdfe69AEZ:6diVUgdw8zodiL6BdwsKdiradwu1
MD5:	E38629A2BB7FDD8142855628F4D316EB
SHA1:	1091BF9215FAA83DC4A559B75524DE2C377CFF43
SHA-256:	8A62ACF1622C003A9039EDD435396D716EFA00FE8E95E9F681C2B5407EDD8740
SHA-512:	B67E81DDB2A165A924C901E409305CE7F1F9511B6F0B534178749C6A9651CEA112DCB8655633708BDF57D2E863B1313281B775830191C0B36EBC13BB3034A889
Malicious:	false
Preview:	...................................FL..................F.@.. ...p...........N..........S...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.YMC....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.YMC............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.YMC..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........O........C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N4R6BRXWQ9IEQYC18WRN.temp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3036944682881555
Encrypted:	false
SSDEEP:	24:6dfe69AETIUx2dWoM15zLN8zm/dfe69AEswM+bpoqdWoM15zLFX1Rgmpdfe69AEZ:6diVUgdw8zodiL6BdwsKdiradwu1
MD5:	E38629A2BB7FDD8142855628F4D316EB
SHA1:	1091BF9215FAA83DC4A559B75524DE2C377CFF43
SHA-256:	8A62ACF1622C003A9039EDD435396D716EFA00FE8E95E9F681C2B5407EDD8740
SHA-512:	B67E81DDB2A165A924C901E409305CE7F1F9511B6F0B534178749C6A9651CEA112DCB8655633708BDF57D2E863B1313281B775830191C0B36EBC13BB3034A889
Malicious:	false
Preview:	...................................FL..................F.@.. ...p...........N..........S...........................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.YMC....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.YMC............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.YMC..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........O........C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.9276410464185245
Encrypted:	false
SSDEEP:	48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakNYI93xeh:8S+OVPUFRbOdwNIOdYpjvY1Q6LfIp8P
MD5:	EC5FAFCAFD863C16A0070C370C874C42
SHA1:	1B8D88BE4C51CBF300976525FCAE30EFE5E1FDBE
SHA-256:	7ADA26A931C4DDC19BF5895DD80826B3F58E8A84DC6EDFAF4C872FA579C6F082
SHA-512:	69F11F3C6DBF91ECFDF56BB2735401A4E57606D99C2A77CD810332686930D7492505BE659414A4CD6903D37DB658C881C6AFF796E498C3F9660C3400881F3E97
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.9276410464185245
Encrypted:	false
SSDEEP:	48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakNYI93xeh:8S+OVPUFRbOdwNIOdYpjvY1Q6LfIp8P
MD5:	EC5FAFCAFD863C16A0070C370C874C42
SHA1:	1B8D88BE4C51CBF300976525FCAE30EFE5E1FDBE
SHA-256:	7ADA26A931C4DDC19BF5895DD80826B3F58E8A84DC6EDFAF4C872FA579C6F082
SHA-512:	69F11F3C6DBF91ECFDF56BB2735401A4E57606D99C2A77CD810332686930D7492505BE659414A4CD6903D37DB658C881C6AFF796E498C3F9660C3400881F3E97
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.1867463390487
Encrypted:	false
SSDEEP:	768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
MD5:	98875950B62B398FFE70C0A8D0998017
SHA1:	CFCFFF938402E53D341FE392E25D2E6C557E548F
SHA-256:	1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
SHA-512:	728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.1867463390487
Encrypted:	false
SSDEEP:	768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
MD5:	98875950B62B398FFE70C0A8D0998017
SHA1:	CFCFFF938402E53D341FE392E25D2E6C557E548F
SHA-256:	1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
SHA-512:	728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: nmy4mJXEaz.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: nmy4mJXEaz.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.0732473039783103
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zki:DLhesh7Owd4+ji
MD5:	BFDDD2F8C9EDAAFE1FDA1B5FC9A9413C
SHA1:	15907E05EE92C47C68BC2B08E9724BCDA77A5162
SHA-256:	E161E87FC9483B600CECA237BB7A8C92FDF2E42CAE9A17061E3858DFED14751C
SHA-512:	9101EC1463CD6E3681F0585BC89D2AFE0B96E7E6F1B4D27BF9748728CAA37D4E12993D7ED53D7577E0D4AF0E5F195FC6EE5CB1140C55EE10E7A7179A173BD714
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.038809065359681434
Encrypted:	false
SSDEEP:	3:GHlhVmAPDhkzcdlhVmAPDhkzhol8a9//Ylll4llqlyllel4lt:G7VmW6chVmW66L9XIwlio
MD5:	45C157A20A5D8794F90B8E870C380493
SHA1:	82F29B9768F91ACE062C105DC8B28E56C06838F4
SHA-256:	774914733B7202CEB1E2C1F67B81CC2A68E49E44196ECB920F50B30A30F3A4C2
SHA-512:	0F4096CC2E87A1379858B0D7EFD24CD2DC9DB0F5D22A4584390DAC78583E0AA72943B38F65A0ADEC1ACD6F5C1960B0362FA708146899CA229B69F2D2BC40F85E
Malicious:	false
Preview:	..-.....................K$+hj..D+...=(.Gv..6......-.....................K$+hj..D+...=(.Gv..6............................................................'...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	163992
Entropy (8bit):	0.1337656173054371
Encrypted:	false
SSDEEP:	24:KVSfkeLxsZ+Gnt2zxsMlCXsMzqCFZ7pCF6C5WUCuSCCQE/HaaKCc7RCGOxsaD2mA:jMCQrnt2VJCXs4qLWeJa1Vylb8Zk
MD5:	CE9AE98E7DEB3C493E91EC44DB4C9CE7
SHA1:	B10E303FBD6309DBB5692A1C20ECF4657637239B
SHA-256:	2D791105F2FFC3B8159F1531746B77CFADB3EA60E0433E64F406196BFBB37BDE
SHA-512:	24CDF17606C45DBC069AD504CFEEDF78742947E5E214384A62AD106EBF9E2F30586D631EE8B8846F4DD79B965386B21AFEF7C1F1371C0107A249790A2DE0E504
Malicious:	false
Preview:	7....-..........+...=(.G..>.. ........+...=(.Gh.;..i.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	13187
Entropy (8bit):	5.477184317197326
Encrypted:	false
SSDEEP:	192:pnPOeRnLYbBp6OJ0aX+q6SEXKmlniNfoE5RHWNBw8dd1Sl:NDe3JUxlOlHEwC10
MD5:	B21CF1535A86875094881A4841922324
SHA1:	094A51E68FC7E254124277DD3C7545A268723D0F
SHA-256:	BD4B62ABD1C921E0E0566D3CEC5EAE0B271FD71FB4C6DB814C6AA5D4538144D5
SHA-512:	9DED63B3FC50A89E6C3E27E221803FF854A4C6CAA03E1376563D507204D9C14A52481E96E5E42131C40F3680496822B3FEDC6FEAFE6F373DE2F566052211D818
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1734257121);..user_pref("app.update.lastUpdateTime.background-update-timer", 1734257121);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1734257121);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173425

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	13187
Entropy (8bit):	5.477184317197326
Encrypted:	false
SSDEEP:	192:pnPOeRnLYbBp6OJ0aX+q6SEXKmlniNfoE5RHWNBw8dd1Sl:NDe3JUxlOlHEwC10
MD5:	B21CF1535A86875094881A4841922324
SHA1:	094A51E68FC7E254124277DD3C7545A268723D0F
SHA-256:	BD4B62ABD1C921E0E0566D3CEC5EAE0B271FD71FB4C6DB814C6AA5D4538144D5
SHA-512:	9DED63B3FC50A89E6C3E27E221803FF854A4C6CAA03E1376563D507204D9C14A52481E96E5E42131C40F3680496822B3FEDC6FEAFE6F373DE2F566052211D818
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1734257121);..user_pref("app.update.lastUpdateTime.background-update-timer", 1734257121);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1734257121);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173425

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\4c978dda-17aa-43a0-be4e-77f3f8193087 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	493
Entropy (8bit):	4.961028554989461
Encrypted:	false
SSDEEP:	12:YZFgoXb52AmJDOSIVHlW8cOlZGV1AQIYzvZcyBuLZGAvxn:YRb52AmhnSlCOlZGV1AQIWZcy6ZXvx
MD5:	A9F963B3557B4C1F48EA7DD8D7BD6F76
SHA1:	F6300A4E43F4C6A9F482B9DFD6AB64E712A7ED2C
SHA-256:	8636034690E81FA6D16C103F17F902E6E66BD43C8298DFBC719B8D5CDC99C079
SHA-512:	132AC2EF33FEE922C21A7FE6FCB5BF97EEBC59D8AEAFF84B56E2ABD84A9A03D8B998085AAA0514BD6E6B32ED922DB70959C7FA4617528DA72F69906C1EF2DE67
Malicious:	false
Preview:	{"type":"health","id":"4c978dda-17aa-43a0-be4e-77f3f8193087","creationDate":"2024-12-15T10:05:52.899Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\4c978dda-17aa-43a0-be4e-77f3f8193087.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	493
Entropy (8bit):	4.961028554989461
Encrypted:	false
SSDEEP:	12:YZFgoXb52AmJDOSIVHlW8cOlZGV1AQIYzvZcyBuLZGAvxn:YRb52AmhnSlCOlZGV1AQIWZcy6ZXvx
MD5:	A9F963B3557B4C1F48EA7DD8D7BD6F76
SHA1:	F6300A4E43F4C6A9F482B9DFD6AB64E712A7ED2C
SHA-256:	8636034690E81FA6D16C103F17F902E6E66BD43C8298DFBC719B8D5CDC99C079
SHA-512:	132AC2EF33FEE922C21A7FE6FCB5BF97EEBC59D8AEAFF84B56E2ABD84A9A03D8B998085AAA0514BD6E6B32ED922DB70959C7FA4617528DA72F69906C1EF2DE67
Malicious:	false
Preview:	{"type":"health","id":"4c978dda-17aa-43a0-be4e-77f3f8193087","creationDate":"2024-12-15T10:05:52.899Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	6.335478724699172
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSVNLXnIr4/pnxQwRluT5sKmgb53eHVpjO+uamhujJwO2c0TiVm0BtT:GUpOx4NtnRlwegF3erjxu4Jwc3zBtT
MD5:	959DB6470682C859774F4697F7B28A6E
SHA1:	0542453AFAC4B6FC344E3A9064A58148328974EF
SHA-256:	B89DF0E09D893736A5B23F01C76BCC7AA790BB25D9488DAC636722CD81F97166
SHA-512:	993361ED06F59C6A01940C8D7F9F8AF3DDDC6A22A0F96D0134F6598CDFEB9CED71E117E99DA5F8B25430F44209DC4B81C6EA57A8D69DB92F071210E39002E777
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":7,"docshellUU...D"{cea7a56e-f189-4c03-a73d-bcaf9fc9ace4}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":8,"persistK..+}],"lastAccessed":1734257128470,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t..Flags":2150633....width":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...98952893-68ff-4a5d-a164-705c709ed3db","zD..1...Wm..l........j..:....1":{..mUpdate...startTim..`090846...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..a"taarI\|.Tecure2..C.Donly..eexpiry....099741,"originA...."fir

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	6.335478724699172
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSVNLXnIr4/pnxQwRluT5sKmgb53eHVpjO+uamhujJwO2c0TiVm0BtT:GUpOx4NtnRlwegF3erjxu4Jwc3zBtT
MD5:	959DB6470682C859774F4697F7B28A6E
SHA1:	0542453AFAC4B6FC344E3A9064A58148328974EF
SHA-256:	B89DF0E09D893736A5B23F01C76BCC7AA790BB25D9488DAC636722CD81F97166
SHA-512:	993361ED06F59C6A01940C8D7F9F8AF3DDDC6A22A0F96D0134F6598CDFEB9CED71E117E99DA5F8B25430F44209DC4B81C6EA57A8D69DB92F071210E39002E777
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":7,"docshellUU...D"{cea7a56e-f189-4c03-a73d-bcaf9fc9ace4}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":8,"persistK..+}],"lastAccessed":1734257128470,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t..Flags":2150633....width":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...98952893-68ff-4a5d-a164-705c709ed3db","zD..1...Wm..l........j..:....1":{..mUpdate...startTim..`090846...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..a"taarI\|.Tecure2..C.Donly..eexpiry....099741,"originA...."fir

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1565
Entropy (8bit):	6.335478724699172
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSVNLXnIr4/pnxQwRluT5sKmgb53eHVpjO+uamhujJwO2c0TiVm0BtT:GUpOx4NtnRlwegF3erjxu4Jwc3zBtT
MD5:	959DB6470682C859774F4697F7B28A6E
SHA1:	0542453AFAC4B6FC344E3A9064A58148328974EF
SHA-256:	B89DF0E09D893736A5B23F01C76BCC7AA790BB25D9488DAC636722CD81F97166
SHA-512:	993361ED06F59C6A01940C8D7F9F8AF3DDDC6A22A0F96D0134F6598CDFEB9CED71E117E99DA5F8B25430F44209DC4B81C6EA57A8D69DB92F071210E39002E777
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":7,"docshellUU...D"{cea7a56e-f189-4c03-a73d-bcaf9fc9ace4}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":8,"persistK..+}],"lastAccessed":1734257128470,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t..Flags":2150633....width":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...98952893-68ff-4a5d-a164-705c709ed3db","zD..1...Wm..l........j..:....1":{..mUpdate...startTim..`090846...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..a"taarI\|.Tecure2..C.Donly..eexpiry....099741,"originA...."fir

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.0287619801161405
Encrypted:	false
SSDEEP:	96:ycLMTEr5/lLmI2Ac1zzcxvbw6Kkgrc2Rn27:yTEr5NX0z3DhRe
MD5:	173F970CBF5C9AA0EC531373AB34893C
SHA1:	574CAF6BFBB9B2A6C67616B5AA7DA59BBAAE5206
SHA-256:	FAB68C882A0B102B78BD7A70C129BA824B31BEBEE52A911B0197EBE11A1C45F1
SHA-512:	715C8132A30AEC991DE515DBC74150FF00FDEF600326C2CB4CB8B4B7C754E502EB36D3A50BD1C1C632956FC39F6AD2EC46191BC049A6AF2119CF9F9659F8385C
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-12-15T10:05:09.211Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.0287619801161405
Encrypted:	false
SSDEEP:	96:ycLMTEr5/lLmI2Ac1zzcxvbw6Kkgrc2Rn27:yTEr5NX0z3DhRe
MD5:	173F970CBF5C9AA0EC531373AB34893C
SHA1:	574CAF6BFBB9B2A6C67616B5AA7DA59BBAAE5206
SHA-256:	FAB68C882A0B102B78BD7A70C129BA824B31BEBEE52A911B0197EBE11A1C45F1
SHA-512:	715C8132A30AEC991DE515DBC74150FF00FDEF600326C2CB4CB8B4B7C754E502EB36D3A50BD1C1C632956FC39F6AD2EC46191BC049A6AF2119CF9F9659F8385C
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-12-15T10:05:09.211Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.692707893692249
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	6eftz6UKDm.exe
File size:	965'632 bytes
MD5:	2b1706b1a255a25718d22746c3ae418e
SHA1:	dedb5907b8746c76ad5bc264e05e06784447dcdd
SHA256:	6c07d9e629e0b333fb62691c0a8c21e63e6c8da54a7e02fb387d6aec8fd031e0
SHA512:	9cc859600e150d2161bd3761b7ccca902c3f2298659c27e7909f13498788e2eadfdb15dc2b4a8985a561740f1a1a0ec5c3834e388abfd08bd9040085b35fb31d
SSDEEP:	12288:BqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaGlS4T:BqDEvCTbMWu7rQYlBQcBiT6rprG8aQR
TLSH:	98259E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675E6F27 [Sun Dec 15 05:54:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F6D54D05C33h
jmp 00007F6D54D0553Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6D54D0571Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6D54D056EAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F6D54D082DDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F6D54D08328h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F6D54D08311h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x15148	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xea000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x15148	0x15200	bf272914b86bda4592c5e3fd23b6e1e8	False	0.6863443047337278	data	7.109687985694455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xea000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4718	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4840	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4968	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c50	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5c20	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd64c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd6a30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8fd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda080	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4e8	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xda538	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xda634	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdabc8	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb254	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb6e4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbce0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc33c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc7a4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc8fc	0xc2ca	data			1.0005213973448843
RT_GROUP_ICON	0xe8bc8	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe8c40	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe8c54	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe8c68	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe8c7c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xe8d58	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 15, 2024 09:26:28.883341074 CET	49710	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:28.883385897 CET	443	49710	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:28.889760017 CET	49710	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:28.934068918 CET	49710	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:28.934092045 CET	443	49710	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:29.826688051 CET	49712	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:29.826729059 CET	443	49712	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:29.826950073 CET	49713	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:29.827003002 CET	443	49713	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:29.840298891 CET	49712	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:29.840478897 CET	49713	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:29.842031002 CET	49712	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:29.842047930 CET	443	49712	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:29.843451023 CET	49713	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:29.843461990 CET	443	49713	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:29.843791962 CET	49714	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:29.964446068 CET	80	49714	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:29.972770929 CET	49714	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:29.980387926 CET	49714	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:30.100153923 CET	80	49714	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:30.156754971 CET	443	49710	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:30.157463074 CET	49710	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:30.203888893 CET	49710	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:30.203915119 CET	443	49710	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:30.203979015 CET	49710	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:30.204530954 CET	443	49710	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:30.204852104 CET	49710	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:30.267879963 CET	49715	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:30.267929077 CET	443	49715	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:30.274256945 CET	49715	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:30.276230097 CET	49715	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:30.276246071 CET	443	49715	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:30.291199923 CET	49716	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:30.291263103 CET	443	49716	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:30.299725056 CET	49716	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:30.299938917 CET	49716	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:30.299957037 CET	443	49716	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:30.318933964 CET	49717	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:30.318983078 CET	443	49717	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:30.319066048 CET	49717	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:30.321038961 CET	49717	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:30.321074963 CET	443	49717	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:30.510571003 CET	49718	443	192.168.2.5	34.160.144.191
Dec 15, 2024 09:26:30.510629892 CET	443	49718	34.160.144.191	192.168.2.5
Dec 15, 2024 09:26:30.512125015 CET	49718	443	192.168.2.5	34.160.144.191
Dec 15, 2024 09:26:30.513092041 CET	49718	443	192.168.2.5	34.160.144.191
Dec 15, 2024 09:26:30.513123989 CET	443	49718	34.160.144.191	192.168.2.5
Dec 15, 2024 09:26:31.058928967 CET	80	49714	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:31.131391048 CET	49714	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:31.499021053 CET	443	49715	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:31.499102116 CET	49715	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:31.517035007 CET	443	49716	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:31.517050982 CET	443	49716	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:31.517088890 CET	49716	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:31.541543007 CET	443	49713	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.541558027 CET	443	49713	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.541830063 CET	49713	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.542294979 CET	443	49713	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.542354107 CET	49713	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.542938948 CET	443	49717	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:31.543006897 CET	49717	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:31.546266079 CET	443	49712	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.546281099 CET	443	49712	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.546324968 CET	49712	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.546986103 CET	443	49712	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.547096014 CET	49712	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.557703972 CET	49716	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:31.637077093 CET	49716	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:31.637164116 CET	443	49716	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:31.638187885 CET	443	49716	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:31.645498037 CET	49712	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.645519018 CET	443	49712	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.646028996 CET	49713	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.646065950 CET	443	49713	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.646090984 CET	49712	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.646097898 CET	443	49712	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.646152973 CET	443	49712	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.646290064 CET	443	49713	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.646424055 CET	49715	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:31.646455050 CET	443	49715	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:31.646519899 CET	49715	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:31.646621943 CET	49716	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:31.646651983 CET	49713	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.646658897 CET	443	49713	142.250.181.110	192.168.2.5
Dec 15, 2024 09:26:31.646761894 CET	49716	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:31.646851063 CET	443	49715	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:31.647162914 CET	443	49716	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:31.647984982 CET	49717	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:31.648005962 CET	443	49717	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:31.648087978 CET	49717	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:31.648185015 CET	443	49717	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:31.648663998 CET	49715	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:31.648675919 CET	49716	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:31.648695946 CET	49713	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.648758888 CET	49717	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:31.648768902 CET	49712	443	192.168.2.5	142.250.181.110
Dec 15, 2024 09:26:31.728128910 CET	443	49718	34.160.144.191	192.168.2.5
Dec 15, 2024 09:26:31.728250980 CET	49718	443	192.168.2.5	34.160.144.191
Dec 15, 2024 09:26:32.239329100 CET	49718	443	192.168.2.5	34.160.144.191
Dec 15, 2024 09:26:32.239352942 CET	443	49718	34.160.144.191	192.168.2.5
Dec 15, 2024 09:26:32.240432024 CET	443	49718	34.160.144.191	192.168.2.5
Dec 15, 2024 09:26:32.242314100 CET	49718	443	192.168.2.5	34.160.144.191
Dec 15, 2024 09:26:32.242400885 CET	49718	443	192.168.2.5	34.160.144.191
Dec 15, 2024 09:26:32.242527008 CET	443	49718	34.160.144.191	192.168.2.5
Dec 15, 2024 09:26:32.242932081 CET	49718	443	192.168.2.5	34.160.144.191
Dec 15, 2024 09:26:32.242932081 CET	49718	443	192.168.2.5	34.160.144.191
Dec 15, 2024 09:26:32.402340889 CET	49714	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:32.474689007 CET	49720	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:32.474729061 CET	443	49720	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:32.477317095 CET	49720	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:32.478950024 CET	49720	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:32.478965998 CET	443	49720	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:32.522428989 CET	80	49714	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:32.522536039 CET	49714	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:32.643183947 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:32.643470049 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:32.762907028 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:32.763171911 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:32.763281107 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:32.763281107 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:32.809828997 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:32.809904099 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:32.929753065 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:32.929779053 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:33.701303005 CET	443	49720	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:33.701561928 CET	49720	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:33.707010984 CET	49720	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:33.707026005 CET	443	49720	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:33.707139969 CET	49720	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:33.707236052 CET	443	49720	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:33.707422018 CET	49720	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:33.707628965 CET	49724	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:33.707673073 CET	443	49724	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:33.707899094 CET	49724	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:33.709045887 CET	49724	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:33.709060907 CET	443	49724	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:33.848905087 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:33.849775076 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:33.902090073 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:33.902111053 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:34.926379919 CET	443	49724	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:34.935332060 CET	443	49724	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:34.936367989 CET	49724	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:34.940673113 CET	49724	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:34.940686941 CET	443	49724	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:34.940861940 CET	49724	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:34.940932989 CET	443	49724	34.117.188.166	192.168.2.5
Dec 15, 2024 09:26:34.945967913 CET	49724	443	192.168.2.5	34.117.188.166
Dec 15, 2024 09:26:35.325465918 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:35.446563959 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:35.642021894 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:35.691781044 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:35.957902908 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:36.077775955 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:36.272989035 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:36.316499949 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:36.363801003 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:36.415219069 CET	49726	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:36.415263891 CET	443	49726	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:36.417840004 CET	49726	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:36.419233084 CET	49726	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:36.419253111 CET	443	49726	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:36.483560085 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:36.489582062 CET	49727	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:36.489631891 CET	443	49727	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:36.493525028 CET	49727	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:36.493640900 CET	49727	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:36.493654966 CET	443	49727	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:36.508816957 CET	49728	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:36.508886099 CET	443	49728	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:36.509442091 CET	49728	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:36.510814905 CET	49728	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:36.510834932 CET	443	49728	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:36.600779057 CET	49729	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:36.600841045 CET	443	49729	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:36.601609945 CET	49729	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:36.603048086 CET	49729	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:36.603082895 CET	443	49729	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:36.678977013 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:36.733248949 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:37.636286020 CET	443	49726	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:37.636368990 CET	49726	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:37.706199884 CET	443	49727	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:37.706470013 CET	49727	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:37.734354019 CET	443	49728	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:37.734473944 CET	49728	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:37.826409101 CET	443	49729	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:37.826504946 CET	49729	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:38.475974083 CET	49727	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:38.475992918 CET	443	49727	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:38.476321936 CET	443	49727	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:38.491067886 CET	49726	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:38.491094112 CET	443	49726	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:38.491327047 CET	443	49726	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:38.491343021 CET	49726	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:38.491352081 CET	443	49726	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:38.491518021 CET	49727	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:38.491529942 CET	49728	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:38.491539955 CET	443	49728	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:38.491642952 CET	49728	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:38.491642952 CET	443	49727	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:38.491748095 CET	443	49728	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:38.491813898 CET	49729	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:38.491842985 CET	443	49729	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:38.491897106 CET	49729	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:38.492078066 CET	443	49729	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:38.492108107 CET	49728	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:38.492130041 CET	49727	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:38.492130041 CET	49727	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:38.492141008 CET	443	49727	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:38.492248058 CET	49729	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:38.703329086 CET	443	49726	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:38.703411102 CET	49726	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:43.633955956 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:43.665365934 CET	49746	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:43.665400028 CET	443	49746	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:43.665529966 CET	49746	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:43.667036057 CET	49746	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:43.667052031 CET	443	49746	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:43.753832102 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:43.944818974 CET	49747	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:43.944859028 CET	443	49747	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:43.944967031 CET	49748	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:43.945022106 CET	443	49748	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:43.945190907 CET	49749	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:43.945216894 CET	443	49749	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:43.945270061 CET	49747	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:43.945400953 CET	49747	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:43.945404053 CET	49748	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:43.945416927 CET	443	49747	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:43.945498943 CET	49748	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:43.945509911 CET	443	49748	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:43.945614100 CET	49749	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:43.946969032 CET	49749	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:43.946980953 CET	443	49749	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:43.949196100 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:43.996489048 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:44.882951975 CET	443	49746	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:44.883058071 CET	49746	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:44.887185097 CET	49746	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:44.887198925 CET	443	49746	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:44.887286901 CET	49746	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:44.887342930 CET	443	49746	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:44.887415886 CET	49746	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:45.158401966 CET	443	49747	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.158478022 CET	49747	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.159701109 CET	443	49749	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.159775019 CET	49749	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.160459995 CET	443	49748	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.160531998 CET	49748	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.426309109 CET	49747	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.426347971 CET	443	49747	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.427356958 CET	443	49747	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.429841042 CET	49748	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.429869890 CET	443	49748	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.430926085 CET	443	49748	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.438461065 CET	49747	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.438550949 CET	49747	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.438674927 CET	443	49747	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.439240932 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:45.439738989 CET	49749	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.439759970 CET	443	49749	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.439821959 CET	49749	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.439992905 CET	443	49749	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.440208912 CET	49748	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.440258980 CET	49748	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.440470934 CET	443	49748	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.446816921 CET	49747	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.446832895 CET	49748	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.446845055 CET	49749	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.448858023 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:45.449901104 CET	49750	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.449932098 CET	443	49750	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.450176954 CET	49750	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.450269938 CET	49750	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.450277090 CET	443	49750	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.528707981 CET	49751	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.528755903 CET	443	49751	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.528908014 CET	49751	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.530656099 CET	49751	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.530672073 CET	443	49751	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.559544086 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:45.568543911 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:45.669255018 CET	49757	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.669291973 CET	443	49757	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.669512987 CET	49757	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.669645071 CET	49757	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:45.669662952 CET	443	49757	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:45.760102987 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:45.764149904 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:45.801824093 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:45.817358971 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:45.829794884 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:45.949687004 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:46.144684076 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:46.187470913 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:46.668843031 CET	443	49750	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:46.669574976 CET	49750	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:46.702308893 CET	49750	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:46.702338934 CET	443	49750	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:46.702701092 CET	443	49750	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:46.742840052 CET	443	49751	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:46.743077993 CET	49751	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:46.751533985 CET	49750	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:46.883599043 CET	443	49757	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:46.883687019 CET	49757	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:47.523844957 CET	49750	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:47.523958921 CET	49750	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:47.524375916 CET	443	49750	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:47.525115967 CET	49750	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:48.791996956 CET	49757	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:48.792033911 CET	443	49757	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:48.792424917 CET	443	49757	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:48.797545910 CET	49751	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:48.797570944 CET	443	49751	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:48.797646999 CET	49751	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:48.797813892 CET	443	49751	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:48.799221992 CET	49751	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:48.842052937 CET	49757	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:49.309336901 CET	49757	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:49.309760094 CET	443	49757	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:49.309895039 CET	49757	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:49.309907913 CET	443	49757	34.120.208.123	192.168.2.5
Dec 15, 2024 09:26:49.310116053 CET	49757	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:26:49.316024065 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:49.435842037 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:49.464122057 CET	49763	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:49.464175940 CET	443	49763	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:49.464323997 CET	49763	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:49.465919018 CET	49763	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:49.465928078 CET	443	49763	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:49.631162882 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:49.638062954 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:49.675884008 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:49.758230925 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:49.953670979 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:49.998970985 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:50.685178995 CET	443	49763	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:50.685281992 CET	49763	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:50.689043045 CET	49763	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:50.689059019 CET	443	49763	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:50.689136028 CET	49763	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:50.689651012 CET	443	49763	34.107.243.93	192.168.2.5
Dec 15, 2024 09:26:50.689892054 CET	49763	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:26:50.692389011 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:50.812819004 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:51.011382103 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:51.018783092 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:51.064336061 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:51.138952017 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:51.333911896 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:51.380827904 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:57.331655979 CET	49784	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:57.331728935 CET	443	49784	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:57.331993103 CET	49784	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:57.332237959 CET	49784	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:57.332252979 CET	443	49784	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:57.371711016 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:57.371768951 CET	443	49785	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:57.372169018 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:57.372288942 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:57.372299910 CET	443	49785	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:57.408731937 CET	49786	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:57.408792019 CET	443	49786	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:57.410495996 CET	49786	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:57.412502050 CET	49786	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:57.412530899 CET	443	49786	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:57.506517887 CET	49787	443	192.168.2.5	151.101.193.91
Dec 15, 2024 09:26:57.506557941 CET	443	49787	151.101.193.91	192.168.2.5
Dec 15, 2024 09:26:57.507407904 CET	49787	443	192.168.2.5	151.101.193.91
Dec 15, 2024 09:26:57.507581949 CET	49787	443	192.168.2.5	151.101.193.91
Dec 15, 2024 09:26:57.507602930 CET	443	49787	151.101.193.91	192.168.2.5
Dec 15, 2024 09:26:57.548089981 CET	49788	443	192.168.2.5	35.201.103.21
Dec 15, 2024 09:26:57.548125029 CET	443	49788	35.201.103.21	192.168.2.5
Dec 15, 2024 09:26:57.548660040 CET	49788	443	192.168.2.5	35.201.103.21
Dec 15, 2024 09:26:57.550226927 CET	49788	443	192.168.2.5	35.201.103.21
Dec 15, 2024 09:26:57.550256014 CET	443	49788	35.201.103.21	192.168.2.5
Dec 15, 2024 09:26:58.548916101 CET	443	49784	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.549036026 CET	49784	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.552659035 CET	49784	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.552670956 CET	443	49784	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.553076982 CET	443	49784	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.555860043 CET	49784	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.555979967 CET	49784	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.556046009 CET	443	49784	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.561398029 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:58.570349932 CET	49784	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.583197117 CET	443	49785	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:58.583280087 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.587352037 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.587371111 CET	443	49785	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:58.587631941 CET	443	49785	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:58.589730978 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.589831114 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.589906931 CET	443	49785	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:58.595331907 CET	443	49785	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:58.602529049 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.602529049 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.602551937 CET	49785	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.623967886 CET	443	49786	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:58.624042988 CET	49786	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:58.630218029 CET	49786	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:58.630225897 CET	443	49786	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:58.630350113 CET	49786	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:58.630472898 CET	443	49786	35.190.72.216	192.168.2.5
Dec 15, 2024 09:26:58.631037951 CET	49786	443	192.168.2.5	35.190.72.216
Dec 15, 2024 09:26:58.681190014 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:58.720761061 CET	443	49787	151.101.193.91	192.168.2.5
Dec 15, 2024 09:26:58.720858097 CET	49787	443	192.168.2.5	151.101.193.91
Dec 15, 2024 09:26:58.723908901 CET	49787	443	192.168.2.5	151.101.193.91
Dec 15, 2024 09:26:58.723927021 CET	443	49787	151.101.193.91	192.168.2.5
Dec 15, 2024 09:26:58.724174023 CET	443	49787	151.101.193.91	192.168.2.5
Dec 15, 2024 09:26:58.726517916 CET	49787	443	192.168.2.5	151.101.193.91
Dec 15, 2024 09:26:58.726627111 CET	49787	443	192.168.2.5	151.101.193.91
Dec 15, 2024 09:26:58.726667881 CET	443	49787	151.101.193.91	192.168.2.5
Dec 15, 2024 09:26:58.726986885 CET	49787	443	192.168.2.5	151.101.193.91
Dec 15, 2024 09:26:58.736287117 CET	49792	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.736330032 CET	443	49792	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.736645937 CET	49792	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.736803055 CET	49792	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.736813068 CET	443	49792	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.738873959 CET	49793	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.738945961 CET	443	49793	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.739284992 CET	49793	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.739423037 CET	49793	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.739456892 CET	443	49793	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.741508961 CET	49794	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.741518974 CET	443	49794	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.741936922 CET	49794	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.742062092 CET	49794	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:58.742073059 CET	443	49794	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:58.776556969 CET	443	49788	35.201.103.21	192.168.2.5
Dec 15, 2024 09:26:58.776671886 CET	49788	443	192.168.2.5	35.201.103.21
Dec 15, 2024 09:26:58.782017946 CET	49788	443	192.168.2.5	35.201.103.21
Dec 15, 2024 09:26:58.782023907 CET	443	49788	35.201.103.21	192.168.2.5
Dec 15, 2024 09:26:58.782135963 CET	49788	443	192.168.2.5	35.201.103.21
Dec 15, 2024 09:26:58.782270908 CET	443	49788	35.201.103.21	192.168.2.5
Dec 15, 2024 09:26:58.782466888 CET	49788	443	192.168.2.5	35.201.103.21
Dec 15, 2024 09:26:58.797389984 CET	49797	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.797414064 CET	443	49797	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:58.797882080 CET	49797	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.798100948 CET	49797	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:26:58.798113108 CET	443	49797	34.149.100.209	192.168.2.5
Dec 15, 2024 09:26:58.876472950 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:58.880096912 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:58.925544024 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:58.999999046 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:59.195396900 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:26:59.242068052 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:26:59.948795080 CET	443	49792	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.950443029 CET	443	49793	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.951050997 CET	49792	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.951056004 CET	49793	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.952466011 CET	443	49794	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.952548981 CET	49794	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.955774069 CET	49792	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.955791950 CET	443	49792	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.956125021 CET	443	49792	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.959111929 CET	49794	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.959117889 CET	443	49794	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.959431887 CET	443	49794	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.961570978 CET	49793	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.961596966 CET	443	49793	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.961879969 CET	443	49793	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.965492010 CET	49792	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.965584040 CET	49792	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.965678930 CET	443	49792	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.965872049 CET	49794	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.965913057 CET	49794	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.966058969 CET	443	49794	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.966236115 CET	49793	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.966274977 CET	49793	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.966411114 CET	443	49793	35.244.181.201	192.168.2.5
Dec 15, 2024 09:26:59.966495037 CET	49792	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.966512918 CET	49794	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.966629028 CET	49793	443	192.168.2.5	35.244.181.201
Dec 15, 2024 09:26:59.971606016 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:00.014159918 CET	443	49797	34.149.100.209	192.168.2.5
Dec 15, 2024 09:27:00.014234066 CET	49797	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:27:00.017535925 CET	49797	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:27:00.017550945 CET	443	49797	34.149.100.209	192.168.2.5
Dec 15, 2024 09:27:00.017796040 CET	443	49797	34.149.100.209	192.168.2.5
Dec 15, 2024 09:27:00.020656109 CET	49797	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:27:00.020766973 CET	49797	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:27:00.020802975 CET	443	49797	34.149.100.209	192.168.2.5
Dec 15, 2024 09:27:00.021636009 CET	49797	443	192.168.2.5	34.149.100.209
Dec 15, 2024 09:27:00.091398001 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:00.287307024 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:00.293282986 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:00.344825029 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:00.413109064 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:00.609940052 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:00.661326885 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:00.983103991 CET	49804	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:00.983161926 CET	443	49804	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:00.983474016 CET	49804	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:00.984911919 CET	49804	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:00.984929085 CET	443	49804	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:02.198455095 CET	443	49804	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:02.198538065 CET	49804	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:02.202816010 CET	49804	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:02.202838898 CET	443	49804	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:02.202914953 CET	49804	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:02.203058004 CET	443	49804	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:02.203140020 CET	49804	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:02.205616951 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:02.327167988 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:02.527507067 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:02.531253099 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:02.582508087 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:02.651118994 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:02.846399069 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:02.899009943 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:12.542099953 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:12.662205935 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:12.865169048 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:12.985126972 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:22.299299002 CET	49851	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:22.299375057 CET	443	49851	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:22.299460888 CET	49851	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:22.300858974 CET	49851	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:22.300878048 CET	443	49851	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:22.672440052 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:22.792408943 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:22.995651960 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:23.115474939 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:23.513307095 CET	443	49851	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:23.513441086 CET	49851	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:23.518491030 CET	49851	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:23.518527985 CET	443	49851	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:23.518570900 CET	49851	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:23.518738031 CET	443	49851	34.107.243.93	192.168.2.5
Dec 15, 2024 09:27:23.519516945 CET	49851	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:27:23.521392107 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:23.642110109 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:23.837165117 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:23.840527058 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:23.897548914 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:23.960849047 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:24.200575113 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:24.244856119 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:27.848674059 CET	49867	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:27.848723888 CET	443	49867	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:27.849293947 CET	49867	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:27.849426031 CET	49867	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:27.849435091 CET	443	49867	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:27.862869978 CET	49868	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:27.862931967 CET	443	49868	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:27.869954109 CET	49868	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:27.870110989 CET	49868	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:27.870135069 CET	443	49868	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.063584089 CET	443	49867	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.063710928 CET	49867	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.067019939 CET	49867	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.067042112 CET	443	49867	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.067393064 CET	443	49867	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.070067883 CET	49867	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.070164919 CET	49867	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.070255041 CET	443	49867	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.070605993 CET	49867	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.087115049 CET	443	49868	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.087161064 CET	443	49868	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.087264061 CET	49868	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.091280937 CET	49868	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.091294050 CET	443	49868	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.091614962 CET	443	49868	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.094351053 CET	49868	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.094449997 CET	49868	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.094518900 CET	443	49868	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.094599962 CET	49868	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.343918085 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:29.345901012 CET	49873	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.345957994 CET	443	49873	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.346996069 CET	49873	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.347148895 CET	49873	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.347167015 CET	443	49873	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.385935068 CET	49874	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.385982037 CET	443	49874	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.386667013 CET	49874	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.386801004 CET	49874	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.386810064 CET	443	49874	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.463815928 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:29.492661953 CET	49877	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.492697001 CET	443	49877	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.493778944 CET	49877	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.494008064 CET	49877	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:29.494023085 CET	443	49877	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:29.659619093 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:29.712069988 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:29.794990063 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:29.914865017 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:30.109909058 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:30.166703939 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:30.283211946 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:30.405213118 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:30.564990044 CET	443	49873	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.565078974 CET	49873	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.568377972 CET	49873	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.568393946 CET	443	49873	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.568655968 CET	443	49873	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.571223021 CET	49873	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.571335077 CET	49873	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.571388960 CET	443	49873	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.571470976 CET	49873	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.597815990 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:30.605891943 CET	443	49874	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.605995893 CET	49874	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.609783888 CET	49874	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.609793901 CET	443	49874	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.610277891 CET	443	49874	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.612898111 CET	49874	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.612983942 CET	49874	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.613172054 CET	443	49874	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.613228083 CET	49874	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.631752968 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:30.645745993 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:30.654370070 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:30.709496975 CET	443	49877	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.709662914 CET	49877	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.712568045 CET	49877	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.712583065 CET	443	49877	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.713432074 CET	443	49877	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.715497971 CET	49877	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.715594053 CET	49877	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.715693951 CET	443	49877	34.120.208.123	192.168.2.5
Dec 15, 2024 09:27:30.717962027 CET	49877	443	192.168.2.5	34.120.208.123
Dec 15, 2024 09:27:30.751560926 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:30.775170088 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:30.946290016 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:30.968772888 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:31.000258923 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:31.006164074 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:31.015889883 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:31.125799894 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:31.321208954 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:31.370172977 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:40.975374937 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:41.096152067 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:41.329715967 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:41.450623989 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:51.105460882 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:51.225250006 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:27:51.459841013 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:27:51.580365896 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:01.234987020 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:01.354742050 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:01.589325905 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:01.709274054 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:04.118617058 CET	49956	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:28:04.118652105 CET	443	49956	34.107.243.93	192.168.2.5
Dec 15, 2024 09:28:04.121934891 CET	49956	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:28:04.121934891 CET	49956	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:28:04.121973991 CET	443	49956	34.107.243.93	192.168.2.5
Dec 15, 2024 09:28:05.334022999 CET	443	49956	34.107.243.93	192.168.2.5
Dec 15, 2024 09:28:05.334131002 CET	49956	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:28:05.338964939 CET	49956	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:28:05.338988066 CET	443	49956	34.107.243.93	192.168.2.5
Dec 15, 2024 09:28:05.339092016 CET	49956	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:28:05.339189053 CET	443	49956	34.107.243.93	192.168.2.5
Dec 15, 2024 09:28:05.340555906 CET	49956	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:28:05.341803074 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:05.463536978 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:05.656825066 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:05.661393881 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:05.701628923 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:05.887141943 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:05.976022005 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:06.019663095 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:15.659797907 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:15.779525042 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:15.976383924 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:16.096107006 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:25.789726019 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:25.909638882 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:26.106247902 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:26.226154089 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:35.919400930 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:36.039863110 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:36.235897064 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:36.355895042 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:46.047722101 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:46.167742014 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:46.364172935 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:46.484088898 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:56.177011967 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:56.296951056 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:28:56.493458986 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:28:56.613307953 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:06.303687096 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:06.423765898 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:06.620148897 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:06.740072966 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:16.433024883 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:16.552704096 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:16.749165058 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:16.869394064 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:25.885719061 CET	50029	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:29:25.885761023 CET	443	50029	34.107.243.93	192.168.2.5
Dec 15, 2024 09:29:25.888143063 CET	50029	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:29:25.890624046 CET	50029	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:29:25.890645981 CET	443	50029	34.107.243.93	192.168.2.5
Dec 15, 2024 09:29:26.562992096 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:26.682842970 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:26.886023045 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:27.005765915 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:27.106358051 CET	443	50029	34.107.243.93	192.168.2.5
Dec 15, 2024 09:29:27.107760906 CET	50029	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:29:27.110415936 CET	50029	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:29:27.110425949 CET	443	50029	34.107.243.93	192.168.2.5
Dec 15, 2024 09:29:27.110553026 CET	50029	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:29:27.110661983 CET	443	50029	34.107.243.93	192.168.2.5
Dec 15, 2024 09:29:27.111848116 CET	50029	443	192.168.2.5	34.107.243.93
Dec 15, 2024 09:29:27.113485098 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:27.233926058 CET	80	49722	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:27.234071970 CET	49722	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:27.258107901 CET	50030	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:27.377866983 CET	80	50030	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:27.379796028 CET	50030	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:27.379998922 CET	50030	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:27.499830008 CET	80	50030	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:28.464831114 CET	80	50030	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:28.468293905 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:28.468750000 CET	50031	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:28.517452955 CET	50030	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:28.588511944 CET	80	49721	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:28.588529110 CET	80	50031	34.107.221.82	192.168.2.5
Dec 15, 2024 09:29:28.588574886 CET	49721	80	192.168.2.5	34.107.221.82
Dec 15, 2024 09:29:28.588654995 CET	50031	80	192.168.2.5	34.107.221.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 15, 2024 09:26:28.883251905 CET	63421	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:29.021596909 CET	53	63421	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:29.022839069 CET	54258	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:29.161839962 CET	53	54258	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:29.674932003 CET	51973	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:29.691554070 CET	65116	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:29.816329002 CET	53	51973	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:29.827764988 CET	53312	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:29.843528986 CET	59867	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:29.965509892 CET	53	53312	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:29.989938021 CET	53	59867	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.001638889 CET	51809	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.002886057 CET	62655	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.128854036 CET	63142	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.139903069 CET	53	51809	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.140518904 CET	53	62655	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.179307938 CET	53530	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.266474009 CET	53	63142	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.268779993 CET	54590	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.301690102 CET	64370	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.317873001 CET	53	53530	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.318933010 CET	56705	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.359319925 CET	52621	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.407083988 CET	53	54590	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.407887936 CET	49464	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.439260006 CET	53	64370	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.444468021 CET	50209	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.456844091 CET	53	56705	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.460464954 CET	64079	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.497915030 CET	53	52621	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.546746969 CET	53	49464	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.550893068 CET	54749	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.582130909 CET	53	50209	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.598493099 CET	53	64079	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.688085079 CET	53	54749	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:30.689152002 CET	52043	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:30.830372095 CET	53	52043	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:32.399830103 CET	55381	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:32.400914907 CET	52004	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:32.406505108 CET	53854	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:32.427673101 CET	60972	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:32.537194014 CET	53	55381	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:32.539351940 CET	53	52004	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:33.017283916 CET	53	63534	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:35.737272978 CET	51944	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:35.875329018 CET	53	51944	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:35.894634008 CET	61352	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:35.994673014 CET	55470	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.032862902 CET	53	61352	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.036410093 CET	58642	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.132030964 CET	53	55470	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.133214951 CET	61696	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.175435066 CET	53	58642	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.271794081 CET	53	61696	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.272614956 CET	52507	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.351286888 CET	62199	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.411838055 CET	53	52507	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.449636936 CET	51576	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.488311052 CET	53	62199	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.509378910 CET	58419	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.587127924 CET	53	51576	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.601135015 CET	53710	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.646928072 CET	53	58419	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.657418013 CET	49821	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.738795042 CET	53	53710	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.795453072 CET	53	49821	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:36.827691078 CET	56367	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:36.965401888 CET	53	56367	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:43.946024895 CET	51192	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:44.083389044 CET	53	51192	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:44.984999895 CET	61404	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:44.985276937 CET	57124	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:44.985559940 CET	63639	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:45.122596025 CET	53	63639	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.122632980 CET	53	61404	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.122840881 CET	53	57124	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.426477909 CET	56354	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:45.427550077 CET	63805	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:45.427850008 CET	63439	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:45.564023972 CET	53	56354	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.564712048 CET	62155	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:45.565382004 CET	53	63805	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.565932035 CET	53316	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:45.568011045 CET	53	63439	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.572024107 CET	52114	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:45.702891111 CET	53	62155	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.703418016 CET	53	53316	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.706974983 CET	58574	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:45.752880096 CET	56757	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:45.770689964 CET	53	52114	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.845784903 CET	53	58574	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:45.890539885 CET	53	56757	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:46.381906033 CET	63481	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:46.382560968 CET	58073	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:46.519646883 CET	53	58073	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:46.521188021 CET	53	63481	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:46.601214886 CET	60931	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:46.601824999 CET	59048	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:46.738576889 CET	53	60931	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:46.816479921 CET	53	59048	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:49.324266911 CET	60706	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:49.462629080 CET	53	60706	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:49.467751980 CET	49598	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:49.605684042 CET	53	49598	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:57.331789970 CET	57389	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:57.366501093 CET	50140	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:57.409545898 CET	52281	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:57.504739046 CET	53	50140	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:57.507339954 CET	55956	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:57.546662092 CET	53	52281	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:57.546844006 CET	53	57389	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:57.547796011 CET	58412	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:57.548599005 CET	62959	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:57.648808956 CET	53	55956	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:57.649823904 CET	52999	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:57.684978008 CET	53	58412	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:57.685436964 CET	53	62959	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:57.686252117 CET	58596	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:26:57.823467016 CET	53	58596	1.1.1.1	192.168.2.5
Dec 15, 2024 09:26:57.871351004 CET	53	52999	1.1.1.1	192.168.2.5
Dec 15, 2024 09:27:00.983432055 CET	60862	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:27:01.120429039 CET	53	60862	1.1.1.1	192.168.2.5
Dec 15, 2024 09:27:22.299721003 CET	64399	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:27:22.437419891 CET	53	64399	1.1.1.1	192.168.2.5
Dec 15, 2024 09:27:23.521653891 CET	57292	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:27:27.849183083 CET	50626	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:27:27.986666918 CET	53	50626	1.1.1.1	192.168.2.5
Dec 15, 2024 09:28:03.975717068 CET	50882	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:28:04.117409945 CET	53	50882	1.1.1.1	192.168.2.5
Dec 15, 2024 09:28:04.119831085 CET	54804	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:28:04.261221886 CET	53	54804	1.1.1.1	192.168.2.5
Dec 15, 2024 09:29:25.603758097 CET	52647	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:29:25.743918896 CET	53	52647	1.1.1.1	192.168.2.5
Dec 15, 2024 09:29:25.745333910 CET	61558	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:29:25.883491993 CET	53	61558	1.1.1.1	192.168.2.5
Dec 15, 2024 09:29:25.884427071 CET	64706	53	192.168.2.5	1.1.1.1
Dec 15, 2024 09:29:26.021763086 CET	53	64706	1.1.1.1	192.168.2.5
Dec 15, 2024 09:29:27.113614082 CET	60193	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 15, 2024 09:26:28.883251905 CET	192.168.2.5	1.1.1.1	0xeee8	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:29.022839069 CET	192.168.2.5	1.1.1.1	0xcc5f	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:29.674932003 CET	192.168.2.5	1.1.1.1	0x2055	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:29.691554070 CET	192.168.2.5	1.1.1.1	0x2977	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:29.827764988 CET	192.168.2.5	1.1.1.1	0xb34a	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:29.843528986 CET	192.168.2.5	1.1.1.1	0x6cec	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.001638889 CET	192.168.2.5	1.1.1.1	0x5c19	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 15, 2024 09:26:30.002886057 CET	192.168.2.5	1.1.1.1	0xcbae	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:30.128854036 CET	192.168.2.5	1.1.1.1	0x75d9	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.179307938 CET	192.168.2.5	1.1.1.1	0x687f	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.268779993 CET	192.168.2.5	1.1.1.1	0x2b16	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.301690102 CET	192.168.2.5	1.1.1.1	0xf7cf	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.318933010 CET	192.168.2.5	1.1.1.1	0x72a7	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.359319925 CET	192.168.2.5	1.1.1.1	0x6082	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.407887936 CET	192.168.2.5	1.1.1.1	0x2826	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:26:30.444468021 CET	192.168.2.5	1.1.1.1	0x8dc3	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:30.460464954 CET	192.168.2.5	1.1.1.1	0xc0a2	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:30.550893068 CET	192.168.2.5	1.1.1.1	0xd0c6	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.689152002 CET	192.168.2.5	1.1.1.1	0xc55e	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:32.399830103 CET	192.168.2.5	1.1.1.1	0xdd4f	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:32.400914907 CET	192.168.2.5	1.1.1.1	0x950a	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:32.406505108 CET	192.168.2.5	1.1.1.1	0xe4b3	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:32.427673101 CET	192.168.2.5	1.1.1.1	0x7a9a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:35.737272978 CET	192.168.2.5	1.1.1.1	0xf3b	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:35.894634008 CET	192.168.2.5	1.1.1.1	0xcb48	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:35.994673014 CET	192.168.2.5	1.1.1.1	0x3356	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.036410093 CET	192.168.2.5	1.1.1.1	0x6608	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:36.133214951 CET	192.168.2.5	1.1.1.1	0x2e7d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.272614956 CET	192.168.2.5	1.1.1.1	0xa94f	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:26:36.351286888 CET	192.168.2.5	1.1.1.1	0xf60	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:36.449636936 CET	192.168.2.5	1.1.1.1	0x1553	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.509378910 CET	192.168.2.5	1.1.1.1	0x68cf	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.601135015 CET	192.168.2.5	1.1.1.1	0x7fbe	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.657418013 CET	192.168.2.5	1.1.1.1	0xe3fc	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:26:36.827691078 CET	192.168.2.5	1.1.1.1	0xa472	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:43.946024895 CET	192.168.2.5	1.1.1.1	0x22d8	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:26:44.984999895 CET	192.168.2.5	1.1.1.1	0x2d55	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:44.985276937 CET	192.168.2.5	1.1.1.1	0x5035	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:44.985559940 CET	192.168.2.5	1.1.1.1	0x7f46	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.426477909 CET	192.168.2.5	1.1.1.1	0xc880	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.427550077 CET	192.168.2.5	1.1.1.1	0xb1d3	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.427850008 CET	192.168.2.5	1.1.1.1	0x75fd	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.564712048 CET	192.168.2.5	1.1.1.1	0xa2dc	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Dec 15, 2024 09:26:45.565932035 CET	192.168.2.5	1.1.1.1	0xe80b	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Dec 15, 2024 09:26:45.572024107 CET	192.168.2.5	1.1.1.1	0x1000	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Dec 15, 2024 09:26:45.706974983 CET	192.168.2.5	1.1.1.1	0xb6d6	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.752880096 CET	192.168.2.5	1.1.1.1	0x9ace	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:46.381906033 CET	192.168.2.5	1.1.1.1	0xef87	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:46.382560968 CET	192.168.2.5	1.1.1.1	0x53b9	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:46.601214886 CET	192.168.2.5	1.1.1.1	0x86ab	Standard query (0)	twitter.com	28	IN (0x0001)	false
Dec 15, 2024 09:26:46.601824999 CET	192.168.2.5	1.1.1.1	0x6107	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:49.324266911 CET	192.168.2.5	1.1.1.1	0x1084	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:49.467751980 CET	192.168.2.5	1.1.1.1	0x3c53	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:26:57.331789970 CET	192.168.2.5	1.1.1.1	0x6fd5	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.366501093 CET	192.168.2.5	1.1.1.1	0xee6d	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.409545898 CET	192.168.2.5	1.1.1.1	0xf3a6	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.507339954 CET	192.168.2.5	1.1.1.1	0xa756	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.547796011 CET	192.168.2.5	1.1.1.1	0x839d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 15, 2024 09:26:57.548599005 CET	192.168.2.5	1.1.1.1	0x65d9	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.649823904 CET	192.168.2.5	1.1.1.1	0xe7a1	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Dec 15, 2024 09:26:57.686252117 CET	192.168.2.5	1.1.1.1	0x7582	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:27:00.983432055 CET	192.168.2.5	1.1.1.1	0xcb9e	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:27:22.299721003 CET	192.168.2.5	1.1.1.1	0x32da	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:27:23.521653891 CET	192.168.2.5	1.1.1.1	0x3069	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:27:27.849183083 CET	192.168.2.5	1.1.1.1	0xbb6c	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:28:03.975717068 CET	192.168.2.5	1.1.1.1	0xd82	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:28:04.119831085 CET	192.168.2.5	1.1.1.1	0x8704	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:29:25.603758097 CET	192.168.2.5	1.1.1.1	0xd723	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:29:25.745333910 CET	192.168.2.5	1.1.1.1	0xaefa	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:29:25.884427071 CET	192.168.2.5	1.1.1.1	0x4e04	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 15, 2024 09:29:27.113614082 CET	192.168.2.5	1.1.1.1	0x9a8d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 15, 2024 09:26:28.878163099 CET	1.1.1.1	192.168.2.5	0xa433	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:29.021596909 CET	1.1.1.1	192.168.2.5	0xeee8	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:29.816329002 CET	1.1.1.1	192.168.2.5	0x2055	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:29.828985929 CET	1.1.1.1	192.168.2.5	0x2977	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:29.828985929 CET	1.1.1.1	192.168.2.5	0x2977	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:29.965509892 CET	1.1.1.1	192.168.2.5	0xb34a	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:29.989938021 CET	1.1.1.1	192.168.2.5	0x6cec	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.139903069 CET	1.1.1.1	192.168.2.5	0x5c19	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 15, 2024 09:26:30.140518904 CET	1.1.1.1	192.168.2.5	0xcbae	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 15, 2024 09:26:30.266474009 CET	1.1.1.1	192.168.2.5	0x75d9	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.283143997 CET	1.1.1.1	192.168.2.5	0xa21d	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:30.283143997 CET	1.1.1.1	192.168.2.5	0xa21d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.317873001 CET	1.1.1.1	192.168.2.5	0x687f	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:30.317873001 CET	1.1.1.1	192.168.2.5	0x687f	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.407083988 CET	1.1.1.1	192.168.2.5	0x2b16	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.439260006 CET	1.1.1.1	192.168.2.5	0xf7cf	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.456844091 CET	1.1.1.1	192.168.2.5	0x72a7	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.497915030 CET	1.1.1.1	192.168.2.5	0x6082	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:30.497915030 CET	1.1.1.1	192.168.2.5	0x6082	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:30.497915030 CET	1.1.1.1	192.168.2.5	0x6082	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.688085079 CET	1.1.1.1	192.168.2.5	0xd0c6	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:30.830372095 CET	1.1.1.1	192.168.2.5	0xc55e	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 15, 2024 09:26:32.537194014 CET	1.1.1.1	192.168.2.5	0xdd4f	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:32.539351940 CET	1.1.1.1	192.168.2.5	0x950a	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:32.539351940 CET	1.1.1.1	192.168.2.5	0x950a	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:32.565376997 CET	1.1.1.1	192.168.2.5	0x7a9a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:32.565376997 CET	1.1.1.1	192.168.2.5	0x7a9a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:32.632041931 CET	1.1.1.1	192.168.2.5	0xe4b3	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:35.875329018 CET	1.1.1.1	192.168.2.5	0xf3b	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:35.875329018 CET	1.1.1.1	192.168.2.5	0xf3b	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:35.875329018 CET	1.1.1.1	192.168.2.5	0xf3b	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.032862902 CET	1.1.1.1	192.168.2.5	0xcb48	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.132030964 CET	1.1.1.1	192.168.2.5	0x3356	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.271794081 CET	1.1.1.1	192.168.2.5	0x2e7d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.487540007 CET	1.1.1.1	192.168.2.5	0x4861	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:36.487540007 CET	1.1.1.1	192.168.2.5	0x4861	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.497881889 CET	1.1.1.1	192.168.2.5	0x3f69	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.587127924 CET	1.1.1.1	192.168.2.5	0x1553	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:36.587127924 CET	1.1.1.1	192.168.2.5	0x1553	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.646928072 CET	1.1.1.1	192.168.2.5	0x68cf	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:36.738795042 CET	1.1.1.1	192.168.2.5	0x7fbe	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:43.943000078 CET	1.1.1.1	192.168.2.5	0x6e60	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122596025 CET	1.1.1.1	192.168.2.5	0x7f46	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122596025 CET	1.1.1.1	192.168.2.5	0x7f46	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122632980 CET	1.1.1.1	192.168.2.5	0x2d55	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122840881 CET	1.1.1.1	192.168.2.5	0x5035	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:45.122840881 CET	1.1.1.1	192.168.2.5	0x5035	No error (0)	star-mini.c10r.facebook.com		157.240.195.35	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.564023972 CET	1.1.1.1	192.168.2.5	0xc880	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.565382004 CET	1.1.1.1	192.168.2.5	0xb1d3	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.568011045 CET	1.1.1.1	192.168.2.5	0x75fd	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.702891111 CET	1.1.1.1	192.168.2.5	0xa2dc	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Dec 15, 2024 09:26:45.703418016 CET	1.1.1.1	192.168.2.5	0xe80b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 15, 2024 09:26:45.703418016 CET	1.1.1.1	192.168.2.5	0xe80b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 15, 2024 09:26:45.703418016 CET	1.1.1.1	192.168.2.5	0xe80b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 15, 2024 09:26:45.703418016 CET	1.1.1.1	192.168.2.5	0xe80b	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 15, 2024 09:26:45.770689964 CET	1.1.1.1	192.168.2.5	0x1000	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Dec 15, 2024 09:26:45.845784903 CET	1.1.1.1	192.168.2.5	0xb6d6	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:45.845784903 CET	1.1.1.1	192.168.2.5	0xb6d6	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.845784903 CET	1.1.1.1	192.168.2.5	0xb6d6	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.845784903 CET	1.1.1.1	192.168.2.5	0xb6d6	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.845784903 CET	1.1.1.1	192.168.2.5	0xb6d6	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:45.890539885 CET	1.1.1.1	192.168.2.5	0x9ace	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:46.519646883 CET	1.1.1.1	192.168.2.5	0x53b9	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:46.521188021 CET	1.1.1.1	192.168.2.5	0xef87	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:46.521188021 CET	1.1.1.1	192.168.2.5	0xef87	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:46.521188021 CET	1.1.1.1	192.168.2.5	0xef87	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:46.521188021 CET	1.1.1.1	192.168.2.5	0xef87	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:49.462629080 CET	1.1.1.1	192.168.2.5	0x1084	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.504739046 CET	1.1.1.1	192.168.2.5	0xee6d	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.504739046 CET	1.1.1.1	192.168.2.5	0xee6d	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.504739046 CET	1.1.1.1	192.168.2.5	0xee6d	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.504739046 CET	1.1.1.1	192.168.2.5	0xee6d	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.546662092 CET	1.1.1.1	192.168.2.5	0xf3a6	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:26:57.546662092 CET	1.1.1.1	192.168.2.5	0xf3a6	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.546844006 CET	1.1.1.1	192.168.2.5	0x6fd5	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.648808956 CET	1.1.1.1	192.168.2.5	0xa756	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.648808956 CET	1.1.1.1	192.168.2.5	0xa756	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.648808956 CET	1.1.1.1	192.168.2.5	0xa756	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.648808956 CET	1.1.1.1	192.168.2.5	0xa756	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.685436964 CET	1.1.1.1	192.168.2.5	0x65d9	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:26:57.871351004 CET	1.1.1.1	192.168.2.5	0xe7a1	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 15, 2024 09:26:57.871351004 CET	1.1.1.1	192.168.2.5	0xe7a1	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 15, 2024 09:26:57.871351004 CET	1.1.1.1	192.168.2.5	0xe7a1	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 15, 2024 09:26:57.871351004 CET	1.1.1.1	192.168.2.5	0xe7a1	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 15, 2024 09:27:00.212047100 CET	1.1.1.1	192.168.2.5	0xba1	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:27:00.212047100 CET	1.1.1.1	192.168.2.5	0xba1	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:27:23.660957098 CET	1.1.1.1	192.168.2.5	0x3069	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:27:23.660957098 CET	1.1.1.1	192.168.2.5	0x3069	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:28:04.117409945 CET	1.1.1.1	192.168.2.5	0xd82	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:29:25.743918896 CET	1.1.1.1	192.168.2.5	0xd723	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:29:25.883491993 CET	1.1.1.1	192.168.2.5	0xaefa	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 15, 2024 09:29:27.251003981 CET	1.1.1.1	192.168.2.5	0x9a8d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 09:29:27.251003981 CET	1.1.1.1	192.168.2.5	0x9a8d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	34.107.221.82	80	7772	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 15, 2024 09:26:29.980387926 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:26:31.058928967 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 14 Dec 2024 10:09:25 GMT Age: 80225 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49721	34.107.221.82	80	7772	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 15, 2024 09:26:32.809828997 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:26:33.848905087 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82300 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:26:35.325465918 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:26:35.642021894 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82302 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:26:36.363801003 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:26:36.678977013 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82303 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:26:45.439240932 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:26:45.760102987 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82312 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:26:45.829794884 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:26:46.144684076 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82312 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:26:49.638062954 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:26:49.953670979 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82316 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:26:51.018783092 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:26:51.333911896 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82318 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:26:58.880096912 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:26:59.195396900 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82326 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:27:00.293282986 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:27:00.609940052 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82327 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:27:02.531253099 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:27:02.846399069 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82329 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:27:12.865169048 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:27:22.995651960 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:27:23.840527058 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:27:24.200575113 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82351 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:27:29.794990063 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:27:30.109909058 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82356 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:27:30.631752968 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:27:30.946290016 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82357 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:27:31.006164074 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:27:31.321208954 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82358 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:27:41.329715967 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:27:51.459841013 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:01.589325905 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:05.661393881 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 15, 2024 09:28:05.976022005 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 14 Dec 2024 09:34:53 GMT Age: 82392 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 15, 2024 09:28:15.976383924 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:26.106247902 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:36.235897064 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:46.364172935 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:56.493458986 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49722	34.107.221.82	80	7772	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 15, 2024 09:26:32.809904099 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:26:33.849775076 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16704 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:26:35.957902908 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:26:36.272989035 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16707 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:26:43.633955956 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:26:43.949196100 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16714 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:26:45.448858023 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:26:45.764149904 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16716 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:26:49.316024065 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:26:49.631162882 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16720 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:26:50.692389011 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:26:51.011382103 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16721 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:26:58.561398029 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:26:58.876472950 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16729 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:26:59.971606016 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:27:00.287307024 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16731 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:27:02.205616951 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:27:02.527507067 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16733 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:27:12.542099953 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:27:22.672440052 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:27:23.521392107 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:27:23.837165117 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16754 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:27:29.343918085 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:27:29.659619093 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16760 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:27:30.283211946 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:27:30.597815990 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16761 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:27:30.654370070 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:27:30.968772888 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16761 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:27:40.975374937 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:27:51.105460882 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:01.234987020 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:05.341803074 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:28:05.656825066 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 15 Dec 2024 03:48:09 GMT Age: 16796 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 15, 2024 09:28:15.659797907 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:25.789726019 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:35.919400930 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:46.047722101 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 15, 2024 09:28:56.177011967 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	50030	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 15, 2024 09:29:27.379998922 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 15, 2024 09:29:28.464831114 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 14 Dec 2024 10:09:25 GMT Age: 80403 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Target ID:	0
Start time:	03:26:19
Start date:	15/12/2024
Path:	C:\Users\user\Desktop\6eftz6UKDm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6eftz6UKDm.exe"
Imagebase:	0xaa0000
File size:	965'632 bytes
MD5 hash:	2B1706B1A255A25718D22746C3AE418E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:26:20
Start date:	15/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:26:20
Start date:	15/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:26:23
Start date:	15/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:26:23
Start date:	15/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:26:23
Start date:	15/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:26:23
Start date:	15/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:26:23
Start date:	15/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:26:24
Start date:	15/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:26:24
Start date:	15/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x2d0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:26:24
Start date:	15/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:26:24
Start date:	15/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:26:25
Start date:	15/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:26:25
Start date:	15/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:26:25
Start date:	15/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20230927232528 -prefsHandle 2116 -prefMapHandle 2104 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52efa55a-382f-4f2d-b37e-6cae35593156} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b024f6d510 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	03:26:27
Start date:	15/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3576 -parentBuildID 20230927232528 -prefsHandle 3648 -prefMapHandle 3444 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {392bfc75-40ab-4cc2-89ba-5f11b803c655} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b035f1b810 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	03:26:35
Start date:	15/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 3068 -prefMapHandle 5384 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {127fbe60-ff2d-4b40-bcf2-afa7809184d6} 7772 "\\.\pipe\gecko-crash-server-pipe.7772" 2b03ee3f510 utility
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	1736
Total number of Limit Nodes:	56

Executed Functions

Function 00AA42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00AA430D

Part of subcall function 00AA6B57: _wcslen.LIBCMT ref: 00AA6B6A

GetCurrentProcess.KERNEL32(?,00B3CB64,00000000,?,?), ref: 00AA4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00AA4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00AA4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00AA4466
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00AA4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00AA447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00AA44A0

Strings

|O, xrefs: 00AE36F8
kernel32.dll, xrefs: 00AA444F
GetNativeSystemInfo, xrefs: 00AA4460

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: c87386940259280d32d87b1a354880ac706b92295ed3d48529ad40afb2c977bc
Instruction ID: 9d279624437f9a59dd468a3096eb8b8f671cc8e033a3463b36224515468e012d
Opcode Fuzzy Hash: c87386940259280d32d87b1a354880ac706b92295ed3d48529ad40afb2c977bc
Instruction Fuzzy Hash: 44A1D67290A2C0FFCB11CB7D7C451997FF46B6A300B168C99E08DA7AE2DB604584DB39

Function 00AA42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00AA50AA,?,?,00000000,00000000), ref: 00AA42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00AA50AA,?,?,00000000,00000000), ref: 00AA42C9
LoadResource.KERNEL32(?,00000000,?,?,00AA50AA,?,?,00000000,00000000,?,?,?,?,?,?,00AA4F20), ref: 00AE35BE
SizeofResource.KERNEL32(?,00000000,?,?,00AA50AA,?,?,00000000,00000000,?,?,?,?,?,?,00AA4F20), ref: 00AE35D3
LockResource.KERNEL32(00AA50AA,?,?,00AA50AA,?,?,00000000,00000000,?,?,?,?,?,?,00AA4F20,?), ref: 00AE35E6

Strings

SCRIPT, xrefs: 00AA42BF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 99dd4a00ea63c583c0887f9465fb2f115afa3a45432539d44e7bde91a1a6d6b2
Instruction ID: 8bf6c444e22d256abdaa87ce9ed5e7d40808dd2e5fdb70adfda83064cb1c797d
Opcode Fuzzy Hash: 99dd4a00ea63c583c0887f9465fb2f115afa3a45432539d44e7bde91a1a6d6b2
Instruction Fuzzy Hash: 43113075240701BFD7218BA5DC49F677BB9EBC9B51F244169B50297290DBB1D8048760

Function 00AE2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00AA2B6B

Part of subcall function 00AA3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B71418,?,00AA2E7F,?,?,?,00000000), ref: 00AA3A78

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00B62224), ref: 00AE2C10
ShellExecuteW.SHELL32(00000000,?,?,00B62224), ref: 00AE2C17

Strings

runas, xrefs: 00AE2C0B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: e914b51af4e200a01faa21b9c8339f57a7b94c6d869af04161459fe8b2ba578a
Instruction ID: 4621013bce0ad0effa53d24fa8b2c74bb7742026fa94b046e506e339cc27fc7f
Opcode Fuzzy Hash: e914b51af4e200a01faa21b9c8339f57a7b94c6d869af04161459fe8b2ba578a
Instruction Fuzzy Hash: 361106321083415BCB14FF68D952ABEBBA8AB97340F04486CF086571E2CF24895A9722

Function 00B0D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B0D501
Process32FirstW.KERNEL32(00000000,?), ref: 00B0D50F
Process32NextW.KERNEL32(00000000,?), ref: 00B0D52F
CloseHandle.KERNEL32(00000000), ref: 00B0D5DC

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 1f67264482b09483e39a6e9507f2a7468efbb1507ba556ee79e696b632b4e980
Instruction ID: 636d744b02d5cb695c617621f13ac8f3dabcfc57b40f3bf62d4227d4338576fa
Opcode Fuzzy Hash: 1f67264482b09483e39a6e9507f2a7468efbb1507ba556ee79e696b632b4e980
Instruction Fuzzy Hash: A6317E711082009FD300EF94CC85AAFBFE8EF9A354F14092DF585971E1EB719949CB92

Function 00B0DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00AE5222), ref: 00B0DBCE
GetFileAttributesW.KERNEL32(?), ref: 00B0DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00B0DBEE
FindClose.KERNEL32(00000000), ref: 00B0DBFA

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 692ace9a3b184ea804505116e350d4cf1ff434ef2275eba92aa63e5506e90063
Instruction ID: d6237e7300428a8a87ecdc320c210c98e7fd97aedb3c303d7608a06a98cbc18e
Opcode Fuzzy Hash: 692ace9a3b184ea804505116e350d4cf1ff434ef2275eba92aa63e5506e90063
Instruction Fuzzy Hash: FAF0A03181092057D2306FF8AC0D8AF3FACDE01334B204B42F836D20E0EFB099548A95

Function 00AFD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00AFD220

Strings

%.3d, xrefs: 00AFD22B
X64, xrefs: 00AFD2A8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 65d8f9301ba33947f4edcbaab52448f72d99a2611ee295119ab9b5d9e2254b56
Instruction ID: e4ec695414edee3bb04aff097f87698860de312dff6f47488b9d79a1bd98bb21
Opcode Fuzzy Hash: 65d8f9301ba33947f4edcbaab52448f72d99a2611ee295119ab9b5d9e2254b56
Instruction Fuzzy Hash: 1BD012B180810CE9CB5197D0CC458FAB7BDFB08341F608452FA06A2041E634C50867A1

Function 00AC4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00AD28E9,?,00AC4CBE,00AD28E9,00B688B8,0000000C,00AC4E15,00AD28E9,00000002,00000000,?,00AD28E9), ref: 00AC4D09
TerminateProcess.KERNEL32(00000000,?,00AC4CBE,00AD28E9,00B688B8,0000000C,00AC4E15,00AD28E9,00000002,00000000,?,00AD28E9), ref: 00AC4D10
ExitProcess.KERNEL32 ref: 00AC4D22

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1642c343c5e8f1c386ce92e5d0afebaa863319d028bd379b00f53d273f543884
Instruction ID: e9850dca7bf09943b4543370d02be70df7c3c45f1fe902fd89bcf49c075c4bc7
Opcode Fuzzy Hash: 1642c343c5e8f1c386ce92e5d0afebaa863319d028bd379b00f53d273f543884
Instruction Fuzzy Hash: 2AE0B631000548AFCF12BFA4DE1AF993F69EB45791B214418FC06AB222CB35DD52DB88

Function 00AFD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00AFD28C

Strings

X64, xrefs: 00AFD2A8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: f7e6d15a7ca0b64520f722759b43a7fcdd4027e2f2f76f2de29dabd7675f71c9
Instruction ID: f70148f062015951dd541a957f27c0c569963e3cb3a471bf0a3736578b515e6b
Opcode Fuzzy Hash: f7e6d15a7ca0b64520f722759b43a7fcdd4027e2f2f76f2de29dabd7675f71c9
Instruction Fuzzy Hash: F2D0C9B480111DEACB94DB90DC88DDDB77CBB04305F200151F106A2000DB3096488F10

Function 00ABD064 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069b75081580a029e01e52a1093fef1e5db790ae29a509ae826efbd33abe78f4
Instruction ID: 58dda31bb26b502c68ece42344c185203fe9ac2880312ee1c2ab50902b7521c4
Opcode Fuzzy Hash: 069b75081580a029e01e52a1093fef1e5db790ae29a509ae826efbd33abe78f4
Instruction Fuzzy Hash: 4A51289194FBD69FE7039774887A188FF30EC5B51436886CFC8805A88BD791502ADB9A

Function 00B2AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00B2B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B2B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B2B1D4
_wcslen.LIBCMT ref: 00B2B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B2B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B2B236
_wcslen.LIBCMT ref: 00B2B332

Part of subcall function 00B105A7: GetStdHandle.KERNEL32(000000F6), ref: 00B105C6

_wcslen.LIBCMT ref: 00B2B34B
_wcslen.LIBCMT ref: 00B2B366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B2B3B6
GetLastError.KERNEL32(00000000), ref: 00B2B407
CloseHandle.KERNEL32(?), ref: 00B2B439
CloseHandle.KERNEL32(00000000), ref: 00B2B44A
CloseHandle.KERNEL32(00000000), ref: 00B2B45C
CloseHandle.KERNEL32(00000000), ref: 00B2B46E
CloseHandle.KERNEL32(?), ref: 00B2B4E3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: c1a0bdf208f305bd8552fcfbfb20847c4b7bad948c0e50d25e27ce9fde8709fa
Instruction ID: 7bb0d90baac72f899d86f1c56d07e021cd3dc3e932dbd2bc492e1bceb44c5645
Opcode Fuzzy Hash: c1a0bdf208f305bd8552fcfbfb20847c4b7bad948c0e50d25e27ce9fde8709fa
Instruction Fuzzy Hash: 46F169315043109FCB15EF24D991B6EBBE5EF85314F18899DF8999B2A2DB31EC40CB52

Function 00AAD730 Relevance: 21.6, APIs: 14, Instructions: 619windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00AAD807
timeGetTime.WINMM ref: 00AADA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AADB28
TranslateMessage.USER32(?), ref: 00AADB7B
DispatchMessageW.USER32(?), ref: 00AADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AADB9F
Sleep.KERNEL32(0000000A), ref: 00AADBB1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 5189f3e4b4f18042b6c3385e0c36c170081e6b6800a6ac907205f5d838714dfe
Instruction ID: e41857696c4a8d12f39457467beacc43cfe63deed272693dab9764df1be60d84
Opcode Fuzzy Hash: 5189f3e4b4f18042b6c3385e0c36c170081e6b6800a6ac907205f5d838714dfe
Instruction Fuzzy Hash: 4842BE30608245EFD729CF24C885BBABBF4BF46314F148959F596876E1DB70E884CB92

Function 00AA2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AA2D07
RegisterClassExW.USER32(00000030), ref: 00AA2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AA2D42
InitCommonControlsEx.COMCTL32(?), ref: 00AA2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AA2D6F
LoadIconW.USER32(000000A9), ref: 00AA2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AA2D94

Strings

TaskbarCreated, xrefs: 00AA2D37
+, xrefs: 00AA2CF0
AutoIt v3 GUI, xrefs: 00AA2D23
0, xrefs: 00AA2CE9

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 880cba9c3566544b71ddf38cbb190c971747734949722be1a0ee45117423bf23
Instruction ID: 8b4fff4dd75948aea1102ee7016bf98d3c3265bf0f0b96051fdf0ce6f642aa37
Opcode Fuzzy Hash: 880cba9c3566544b71ddf38cbb190c971747734949722be1a0ee45117423bf23
Instruction Fuzzy Hash: 9021D3B5911208EFDB009FE8EC49A9DBFB8FB08700F10451AEA15B72A0DBB145858FA4

Function 00AE065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AE039A: CreateFileW.KERNEL32(00000000,00000000,?,00AE0704,?,?,00000000,?,00AE0704,00000000,0000000C), ref: 00AE03B7

GetLastError.KERNEL32 ref: 00AE076F
__dosmaperr.LIBCMT ref: 00AE0776
GetFileType.KERNEL32(00000000), ref: 00AE0782
GetLastError.KERNEL32 ref: 00AE078C
__dosmaperr.LIBCMT ref: 00AE0795
CloseHandle.KERNEL32(00000000), ref: 00AE07B5
CloseHandle.KERNEL32(?), ref: 00AE08FF
GetLastError.KERNEL32 ref: 00AE0931
__dosmaperr.LIBCMT ref: 00AE0938

Strings

H, xrefs: 00AE08BD

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 94a2eb65954d62c599beb030bd0a2c2fda83b64a33485b594a89d3e59652cab8
Instruction ID: 75c17dfb9691f72a288282ecdf673f51a4f6c8d0f6d75bdfb99d225c41814dd3
Opcode Fuzzy Hash: 94a2eb65954d62c599beb030bd0a2c2fda83b64a33485b594a89d3e59652cab8
Instruction Fuzzy Hash: F2A12632A141848FDF19AF68D851FAE3BB1AB06320F24015EF815EF391DB719D92CB91

Function 00AA344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AA3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B71418,?,00AA2E7F,?,?,?,00000000), ref: 00AA3A78

Part of subcall function 00AA3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00AA3379

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00AA356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00AE318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00AE31CE
RegCloseKey.ADVAPI32(?), ref: 00AE3210
_wcslen.LIBCMT ref: 00AE3277
_wcslen.LIBCMT ref: 00AE3286

Strings

\, xrefs: 00AE328C
Software\AutoIt v3\AutoIt, xrefs: 00AA3560
\Include\, xrefs: 00AA3527
Include, xrefs: 00AE3184, 00AE31C5

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 1ac8e8f97a4dbb8aa73ba1b6d3371ab7efd4c5a6900ff6d61f4dd3a89649a4f3
Instruction ID: 9c4f4735ee4e83ee9c41021705b752b34710a44ec541037a890d6e9d19a92306
Opcode Fuzzy Hash: 1ac8e8f97a4dbb8aa73ba1b6d3371ab7efd4c5a6900ff6d61f4dd3a89649a4f3
Instruction Fuzzy Hash: F671E6724043019ED704EF65DD869ABBBF8FF99340F41082EF589971A0EF348A88CB56

Function 00AA2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AA2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00AA2B9D
LoadIconW.USER32(00000063), ref: 00AA2BB3
LoadIconW.USER32(000000A4), ref: 00AA2BC5
LoadIconW.USER32(000000A2), ref: 00AA2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AA2BEF
RegisterClassExW.USER32(?), ref: 00AA2C40

Part of subcall function 00AA2CD4: GetSysColorBrush.USER32(0000000F), ref: 00AA2D07
Part of subcall function 00AA2CD4: RegisterClassExW.USER32(00000030), ref: 00AA2D31
Part of subcall function 00AA2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AA2D42
Part of subcall function 00AA2CD4: InitCommonControlsEx.COMCTL32(?), ref: 00AA2D5F
Part of subcall function 00AA2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AA2D6F
Part of subcall function 00AA2CD4: LoadIconW.USER32(000000A9), ref: 00AA2D85
Part of subcall function 00AA2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AA2D94

Strings

#, xrefs: 00AA2C16
AutoIt v3, xrefs: 00AA2C2F
0, xrefs: 00AA2C0F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: e56af5c8030352f32693b1880cccc3c6b779fef1ff45fa63a220676d95a907b9
Instruction ID: 6745bcdea0cf355941a444524a92b67919b1e7ccf4d92175fec13c42ea5f620f
Opcode Fuzzy Hash: e56af5c8030352f32693b1880cccc3c6b779fef1ff45fa63a220676d95a907b9
Instruction Fuzzy Hash: 65212571A00318AFDB10DFADEC45AAD7FB4FB08B50F11041AE508A76A0DBB109848FA8

Function 00AA3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00AA316A,?,?), ref: 00AA31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00AA316A,?,?), ref: 00AA3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AA3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00AA316A,?,?), ref: 00AA3232
CreatePopupMenu.USER32 ref: 00AA3246
PostQuitMessage.USER32(00000000), ref: 00AA3267

Strings

TaskbarCreated, xrefs: 00AA322D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 23a948601fad0326a95b5501865b8cdf9b17bcfcae1fe0f79a4c1026ce536759
Instruction ID: ba846bb20cef8c81fe2198b1a0e060ae6452bb98a14d481ff58d05f993ca311c
Opcode Fuzzy Hash: 23a948601fad0326a95b5501865b8cdf9b17bcfcae1fe0f79a4c1026ce536759
Instruction Fuzzy Hash: 24412133240204AADF141F7C9D4ABBD3AA9EB57340F144626FA1A972E1CF618E8587B1

Function 00AA1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00AA1459
CoUninitialize.COMBASE ref: 00AA14F8
UnregisterHotKey.USER32(?), ref: 00AA16DD
DestroyWindow.USER32(?), ref: 00AE24B9
FreeLibrary.KERNEL32(?), ref: 00AE251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00AE254B

Strings

close all, xrefs: 00AA1454

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: ff80ab9cbbf0c3c3fa269ccbbe0766555225aa93a39e4eb36c46c19e80fbccd2
Instruction ID: 5eaeedd0336d3ca2c26e45156f75d4377fb5a087b4768604f0b43b38e8bb9ac2
Opcode Fuzzy Hash: ff80ab9cbbf0c3c3fa269ccbbe0766555225aa93a39e4eb36c46c19e80fbccd2
Instruction Fuzzy Hash: 65D1A031701212DFDB19EF55CA95B69F7A8BF06700F2542ADE44AAB292DB30ED12CF50

Function 00B0DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00B0DE42
gethostname.WS2_32(?,00000100), ref: 00B0DE5C
gethostbyname.WS2_32(?), ref: 00B0DE69
inet_ntoa.WSOCK32(?), ref: 00B0DEAB
_strcat.LIBCMT ref: 00B0DEB9
WSACleanup.WSOCK32 ref: 00B0DEDE

Strings

0.0.0.0, xrefs: 00B0DE87

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: f6a78e940336f914e0f07a2bdc18b8845fd3b51e3ae22e12a8a30a8d9f3bfd08
Instruction ID: 9fe2b0fe62a9dbc2a030e47055eeeb0521d6132960703514ba57ce8a7d89568f
Opcode Fuzzy Hash: f6a78e940336f914e0f07a2bdc18b8845fd3b51e3ae22e12a8a30a8d9f3bfd08
Instruction Fuzzy Hash: 8611D372904118AFCF20ABA4DD4AEEE7BECDF15711F1101A9F545AB0D1EF75CA818B60

Function 00AA2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AA2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AA2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00AA1CAD,?), ref: 00AA2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00AA1CAD,?), ref: 00AA2CCF

Strings

AutoIt v3, xrefs: 00AA2C89, 00AA2C8E, 00AA2C8F
edit, xrefs: 00AA2CAC

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: b4b1c560c882b7b68b3a7352c3e6b1e6ea4278e55b7f215f01d276a58eb430f6
Instruction ID: 654517136cac7bb3c8bf9c9ae99dfcf831e5f0ca6f49d396c91d233ab11100d2
Opcode Fuzzy Hash: b4b1c560c882b7b68b3a7352c3e6b1e6ea4278e55b7f215f01d276a58eb430f6
Instruction Fuzzy Hash: 80F0DA765503907AEB311B6FAC09E773EBDD7C6F50F12445AF908B35A0CA611890DAB8

Function 00AFD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00AFD3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00AFD3BF
FreeLibrary.KERNEL32(00000000), ref: 00AFD3E5

Strings

X64, xrefs: 00AFD2A8
GetSystemWow64DirectoryW, xrefs: 00AFD3B9

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 80f2cf16ab37110ea8fae3983ef71a483148d84ced53a09634525a8506982667
Instruction ID: 43869acb66e2e55797f1b97375e92dffb65f5e853d1181b1a4536a306daf7a4f
Opcode Fuzzy Hash: 80f2cf16ab37110ea8fae3983ef71a483148d84ced53a09634525a8506982667
Instruction Fuzzy Hash: 8BF02032406A289BE72217908C08ABD3A66AF11B01B648284F706FA115DB30CD40A7D2

Function 00AA3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00AA3B0F,SwapMouseButtons,00000004,?), ref: 00AA3B40
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00AA3B0F,SwapMouseButtons,00000004,?), ref: 00AA3B61
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00AA3B0F,SwapMouseButtons,00000004,?), ref: 00AA3B83

Strings

Control Panel\Mouse, xrefs: 00AA3B3E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 369f0fe24d2bac802ef00e719e7d5b9bdacdb6263c8dc3b08a069fa9e64e9ed2
Instruction ID: 1c6c3f77131a88db3264d5a5e5ac40caa71353114347710129561b951e150dc0
Opcode Fuzzy Hash: 369f0fe24d2bac802ef00e719e7d5b9bdacdb6263c8dc3b08a069fa9e64e9ed2
Instruction Fuzzy Hash: EB112AB6511208FFDF218FA5DC85AAEBBB9EF05744B104459B806E7150D7719E409760

Function 00AADFD0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00AF32B7

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: dfb55e885be01ecb3f6ce46d54f6ac41c21e3d58ec35dd2660b3503330259796
Instruction ID: 62852d6c09eb4c2ca203595fdd0ca022650f651a3cdb9b8621f08b72396b1f4d
Opcode Fuzzy Hash: dfb55e885be01ecb3f6ce46d54f6ac41c21e3d58ec35dd2660b3503330259796
Instruction Fuzzy Hash: 8CC26771A00215CFCF24CF98C881AADB7F1FF5A310F248569E916AB291D775ED81CBA1

Function 00AAEC40 Relevance: 5.7, APIs: 3, Instructions: 1195COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AAFE66

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: d89a167fddb9af0e12243bb73bee1ed2fd608881ad35a9ab6244060db269a6a1
Instruction ID: 6b6bb12bea8775fc60dd5c8cff66762827b69d37eb06894ae63e7adb823fe618
Opcode Fuzzy Hash: d89a167fddb9af0e12243bb73bee1ed2fd608881ad35a9ab6244060db269a6a1
Instruction Fuzzy Hash: FFB27A74A08340CFCB28CF58C480A2AB7F1BB9A314F24496DF9999B391D771EC45CB92

Function 00AA3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00AE33A2

Part of subcall function 00AA6B57: _wcslen.LIBCMT ref: 00AA6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AA3A04

Strings

Line: , xrefs: 00AE33EB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: d4d79dd022a1d09a827af1fbb1679cc200f27aad8b95b8906bf7b3e9ffe58dee
Instruction ID: 6ee7929052be2a5ba4590b35e3a00901c2ffea790ecf7f53a9c0d04f53d65f76
Opcode Fuzzy Hash: d4d79dd022a1d09a827af1fbb1679cc200f27aad8b95b8906bf7b3e9ffe58dee
Instruction Fuzzy Hash: CD31C472408300AACB21EB28DC46FEFB7E8AB45710F10491EF59A971D1DF749A48C7E6

Function 00ABFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00AC0668

Part of subcall function 00AC32A4: RaiseException.KERNEL32(?,?,?,00AC068A,?,00B71444,?,?,?,?,?,?,00AC068A,00AA1129,00B68738,00AA1129), ref: 00AC3304

__CxxThrowException@8.LIBVCRUNTIME ref: 00AC0685

Strings

Unknown exception, xrefs: 00AC0692

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 8f3c92902f53200c96c6ca10815cf112f046b7dea9957746caf6232d865c0dd8
Instruction ID: 2379d29aa15c45dc296b77c399c313ca54fe0eda36105070e9f236722beee241
Opcode Fuzzy Hash: 8f3c92902f53200c96c6ca10815cf112f046b7dea9957746caf6232d865c0dd8
Instruction Fuzzy Hash: B9F0C23490020DBB8F00BB64DD4AEDE7BAC5E00354F618579B814D65A2EFB1DA25C680

Function 00AA10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AA1BF4
Part of subcall function 00AA1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00AA1BFC
Part of subcall function 00AA1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AA1C07
Part of subcall function 00AA1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AA1C12
Part of subcall function 00AA1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00AA1C1A
Part of subcall function 00AA1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00AA1C22

Part of subcall function 00AA1B4A: RegisterWindowMessageW.USER32(00000004,?,00AA12C4), ref: 00AA1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00AA136A
OleInitialize.OLE32 ref: 00AA1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00AE24AB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 8fdb96c2f4a8b17a54e117d23c0f2e2a5fd2901f36cae05a01a238d812c02146
Instruction ID: 898d4cabcbd235c0f3dea2378916646e41f1220672ac38de7aa56b50b913bb9d
Opcode Fuzzy Hash: 8fdb96c2f4a8b17a54e117d23c0f2e2a5fd2901f36cae05a01a238d812c02146
Instruction Fuzzy Hash: 2A71ACB59212008FC388EFBDAD466553BE5FBA9344B558A6AD41ED73A1EF308480CF71

Function 00B0C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AA3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B0C259
KillTimer.USER32(?,00000001,?,?), ref: 00B0C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B0C270

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 2492865125ab960ec294e186b5a6fd0bf3c0fe49880cf3f479d0056083f7818b
Instruction ID: b24c3d488a910d5185646ffd86d41bd41f7cfc608ba4ad45bbfe2c63ead61dfa
Opcode Fuzzy Hash: 2492865125ab960ec294e186b5a6fd0bf3c0fe49880cf3f479d0056083f7818b
Instruction Fuzzy Hash: 8E319371904344AFEB229FA48895BEBBFECAF06304F1044DEE5DAA7281C7745A84CB51

Function 00AD86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,00AD85CC,?,00B68CC8,0000000C), ref: 00AD8704
GetLastError.KERNEL32(?,00AD85CC,?,00B68CC8,0000000C), ref: 00AD870E
__dosmaperr.LIBCMT ref: 00AD8739

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: a6ca98934e021c38785ca306c36c529d36a2cc6d3eb1aeaca82b3e6789af3521
Instruction ID: 7f29f3d6a3f8b9f90d643b5500d71dd3fb4e38d7051e2bb148b320ade98312f8
Opcode Fuzzy Hash: a6ca98934e021c38785ca306c36c529d36a2cc6d3eb1aeaca82b3e6789af3521
Instruction Fuzzy Hash: 82016D33E056602AD6247734A945B7E7B598B92B74F39011FF81B9F3D2DEB8CC819290

Function 00AADB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00AADB7B
DispatchMessageW.USER32(?), ref: 00AADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AADB9F
Sleep.KERNEL32(0000000A), ref: 00AADBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00AF1CC9

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: b8fed73eb1fc5f2bd50375ecd4bea0f54423873f4a27aa23bd886fdc347adeca
Instruction ID: 3ca273baf60c87397e1d7c14a48edceecf402defb06e31c982dd8582897a097d
Opcode Fuzzy Hash: b8fed73eb1fc5f2bd50375ecd4bea0f54423873f4a27aa23bd886fdc347adeca
Instruction Fuzzy Hash: 47F05E31644344DBE730CBA4CC49FEA77BCEB49310F104918F65A930C0DB30A8888B26

Function 00AB1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AB17F6

Strings

CALL, xrefs: 00AB17C6

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: e3c7c8bf7d4d31628bfa4804060fced06c24a895c21c22d72855c79aa126aec0
Instruction ID: 560ebead766195665d5c8d34b91e5575aa9704b2068fc076f93ef5a2fe500a1e
Opcode Fuzzy Hash: e3c7c8bf7d4d31628bfa4804060fced06c24a895c21c22d72855c79aa126aec0
Instruction Fuzzy Hash: 51229D70608301DFC714DF14C5A0AAABBF9BF85314F688A5DF5968B3A2D731E845CB92

Function 00AB01E0 Relevance: 3.6, APIs: 2, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c38ed3860a7e5d2733bbb37e12a7549291012658886fa987800d38264a82fa0
Instruction ID: 029c0104fe3a1eb9ec925f8cd307fce156d21c470b911b9a9a7620efcac8c9e6
Opcode Fuzzy Hash: 3c38ed3860a7e5d2733bbb37e12a7549291012658886fa987800d38264a82fa0
Instruction Fuzzy Hash: 26328030A006099FCB24DFA4C895FFEB7B9AF05311F148569FA15AB2A2D731ED44CB51

Function 00AA2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00AE2C8C

Part of subcall function 00AA3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AA3A97,?,?,00AA2E7F,?,?,?,00000000), ref: 00AA3AC2

Part of subcall function 00AA2DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00AA2DC4

Strings

X, xrefs: 00AE2C5A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 0803ef4439ec8bea52cd00fc473689ddececb4cc96e866101faaf8bec706c269
Instruction ID: a393f0f79a8c1b2ca6d93ac26e5edd9070953d08ba24f09558c748cab1af95dd
Opcode Fuzzy Hash: 0803ef4439ec8bea52cd00fc473689ddececb4cc96e866101faaf8bec706c269
Instruction Fuzzy Hash: A921A871A002989FDF01DF98C945BDE7BFC9F49304F104059E405B7281DFB859898FA1

Function 00AFD363 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 00AFD375

Strings

X64, xrefs: 00AFD2A8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ComputerName
String ID: X64
API String ID: 3545744682-893830106
Opcode ID: b87f63d82a7bef7bd8961455ab1d99fe03f3786c7b197d3a1f00c2ab5b98282f
Instruction ID: 52b3be6259544e084508f15fbc4111714fc007c179f7e4b91c6ca6899313a7f1
Opcode Fuzzy Hash: b87f63d82a7bef7bd8961455ab1d99fe03f3786c7b197d3a1f00c2ab5b98282f
Instruction Fuzzy Hash: 67D0C9B580512CEACB91DB80DC88DEDB77DBB04301F604151F103A2000DB3096489B51

Function 00AA3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AA3908

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: af61079d0a89008cf4aac54b97d98887acf5f81344ba228a2faa05bd36d10a92
Instruction ID: 5a57c159e7f44b8cc7016b5b309a4fd1d3c40c103adbb477350b5b9abc809609
Opcode Fuzzy Hash: af61079d0a89008cf4aac54b97d98887acf5f81344ba228a2faa05bd36d10a92
Instruction Fuzzy Hash: 2B319371504301DFD720DF68D88579BBBE8FB49708F10092EF59A97280EB75AA48CB52

Function 00ABF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00ABF661

Part of subcall function 00AAD730: GetInputState.USER32 ref: 00AAD807

Sleep.KERNEL32(00000000), ref: 00AFF2DE

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 05ec391f1835aa3f32721258c8eebd94e11db35029862637bac0d213a01c749c
Instruction ID: 3823a20f71d6318af0cc77413d34cbf53efc375c4f34966ac45a04eae66507d9
Opcode Fuzzy Hash: 05ec391f1835aa3f32721258c8eebd94e11db35029862637bac0d213a01c749c
Instruction Fuzzy Hash: CDF082316406059FD314EF69D955B6AFBE9EF46760F104029E85AD72A2DB70A800CB90

Function 00AAB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AABB4E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 0019040321c9ec9cb2c495447124761538bd954fc7ad5d8d34039c2aec215c5a
Instruction ID: 16804dc06ba495fb6ef365ea7c165b431160bbad3329cebfdd8797b0bd1c79df
Opcode Fuzzy Hash: 0019040321c9ec9cb2c495447124761538bd954fc7ad5d8d34039c2aec215c5a
Instruction Fuzzy Hash: 1D32AF35A00209DFDB20CF94C994EBEB7F9EF46310F158059EA15AB292D774ED81CBA1

Function 00AA4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AA4EDD,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4E9C
Part of subcall function 00AA4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AA4EAE
Part of subcall function 00AA4E90: FreeLibrary.KERNEL32(00000000,?,?,00AA4EDD,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4EFD

Part of subcall function 00AA4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AE3CDE,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4E62
Part of subcall function 00AA4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AA4E74
Part of subcall function 00AA4E59: FreeLibrary.KERNEL32(00000000,?,?,00AE3CDE,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4E87

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 94b0eaceabd58fd7b765f490cea36121b82be684d898861dda16f6cfcdd479eb
Instruction ID: a011fd08c387246729e229da90b94917d1b68460519b128888edc472467c7642
Opcode Fuzzy Hash: 94b0eaceabd58fd7b765f490cea36121b82be684d898861dda16f6cfcdd479eb
Instruction Fuzzy Hash: 5D11C432610205AECF24EB60DE06FAD77A59F89B10F20442DF552A71D1EFB0AA459750

Function 00AD8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00AD8440

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 2904d9ab450cf35374a0b7ce9bbee8bb7bfcb6f6ad0fd2bfc8c2394e5235def5
Instruction ID: 512ed111cadafb47f1db1dd8d4e36807a919b9cb760d1b07d081b143d4dc10b7
Opcode Fuzzy Hash: 2904d9ab450cf35374a0b7ce9bbee8bb7bfcb6f6ad0fd2bfc8c2394e5235def5
Instruction Fuzzy Hash: 7C1118B590410AAFCB05DF58E941A9B7BF5FF48314F10405AF809AB312DB31EA11CBA5

Function 00ACE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 1f7b490ba3b0063032b5f82e03b915a5691d48fff2b89119b367ca7ff1b3f61a
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 8CF02836521A109BDB317B798E05F5A339D9F62330F12072EF422933D2DB74E801C6A5

Function 00AA9CB3 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AA9CBD

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: b66f2ccc6a42f866386a2c3f527481c72d49d8aa6e16cad6a22e3b4c4ac6860b
Instruction ID: bb71680d246d8434da9dafc67be3a51c0648fff5006199361321523ced9701c0
Opcode Fuzzy Hash: b66f2ccc6a42f866386a2c3f527481c72d49d8aa6e16cad6a22e3b4c4ac6860b
Instruction Fuzzy Hash: EFF0C8B36016006ED7149F28DC06FA7BB98EB44760F14852EF619CB1D1DB31E51087A4

Function 00AD3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00B71444,?,00ABFDF5,?,?,00AAA976,00000010,00B71440,00AA13FC,?,00AA13C6,?,00AA1129), ref: 00AD3852

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 02a59980d54daa772649952d26e59eb9939b4fd1aaa02a15ec1b535c4ddf1b9f
Instruction ID: d95c1bf2f30061fdba0e9581b43327a6ab11306040d0b2b272a16afe34cf05cd
Opcode Fuzzy Hash: 02a59980d54daa772649952d26e59eb9939b4fd1aaa02a15ec1b535c4ddf1b9f
Instruction Fuzzy Hash: A2E0E53310232466DE212B779D00F9E3A5AAB427B0F1A0026BC16A7680CB50DD01A2E6

Function 00AA4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4F6D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: c021e18761a1e63256a9180a43b53f06a025771dfc651935f7303e8b5b9b33fe
Instruction ID: 0af576f77ab49cb0ca65c8fad3febba864abec81fe9a77e4b9dab050167ed0b0
Opcode Fuzzy Hash: c021e18761a1e63256a9180a43b53f06a025771dfc651935f7303e8b5b9b33fe
Instruction Fuzzy Hash: 58F0A971105742CFDB348F60D49082ABBF0AF4A729320997EF1EA83660CBB19844EF00

Function 00B32A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B32A66

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 7bb0497597e59d2bdb38fd053cda1c868ec6a2b24422c1041476e73194060177
Instruction ID: a396531f0fc64a35647e50937d381d095cef3a80dd52655aee79ef0af7af3cb3
Opcode Fuzzy Hash: 7bb0497597e59d2bdb38fd053cda1c868ec6a2b24422c1041476e73194060177
Instruction Fuzzy Hash: 11E04F76350116ABC714EB70EC918FE7BDCEF50795B2045B6ED16D2140DB30999586A0

Function 00AA30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00AA314E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 45026fa5cb6866c3136793de9a633d1f2b5a56a08143daf6c3717dd0ceb8c717
Instruction ID: 7f98c2d159bf7b6563593f2dfe96090f22370e76aac1bb733de7c647a3b22090
Opcode Fuzzy Hash: 45026fa5cb6866c3136793de9a633d1f2b5a56a08143daf6c3717dd0ceb8c717
Instruction Fuzzy Hash: 2BF0A770910304AFEB529B28DC4A7D97BBCA701708F0000E9A14DA7282DF7447C8CF55

Function 00AA2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00AA2DC4

Part of subcall function 00AA6B57: _wcslen.LIBCMT ref: 00AA6B6A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 0304fb3f1243d61acbcbbb5ef5c30d29157a5944f4d36d6b90d5663dd75f4aa7
Instruction ID: 0f12487396f2dd49e446c5e2068aa6609beacb7d7ccfa67f12f92c9c3834ed18
Opcode Fuzzy Hash: 0304fb3f1243d61acbcbbb5ef5c30d29157a5944f4d36d6b90d5663dd75f4aa7
Instruction Fuzzy Hash: ACE0CD726001345BC711A6989D05FDE77DDDFC8790F040075FD09E7248DA70AD808690

Function 00AA2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00AA3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AA3908

Part of subcall function 00AAD730: GetInputState.USER32 ref: 00AAD807

SetCurrentDirectoryW.KERNEL32(?), ref: 00AA2B6B

Part of subcall function 00AA30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00AA314E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 72e5905807d4b5c6c6e6d2c0842bcaf694774fc4f179cfe387c4cf1e794d116c
Instruction ID: 09f06f76b701bfd95d8532b54dfd5957c4a7cd491054203a4d25a23fde954852
Opcode Fuzzy Hash: 72e5905807d4b5c6c6e6d2c0842bcaf694774fc4f179cfe387c4cf1e794d116c
Instruction Fuzzy Hash: 9DE0262330020407CA08BB78A91257DA7498BD7351F00087EF147432E2CF2445454322

Function 00B0DF27 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00B0DF40

Part of subcall function 00AA6B57: _wcslen.LIBCMT ref: 00AA6B6A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FolderPath_wcslen
String ID:
API String ID: 2987691875-0
Opcode ID: c64ed6e453bbb3d4af5f32cde2284f27c8638ec173fb3adc5337f055a41bf2fc
Instruction ID: 15a402a26ef9edfacd5e97642964cc159ce5a45495fd92de841a20873b5e0c4c
Opcode Fuzzy Hash: c64ed6e453bbb3d4af5f32cde2284f27c8638ec173fb3adc5337f055a41bf2fc
Instruction Fuzzy Hash: C9D05EA2A002283BDF60A6749D0DDFB3AACCB40210F0006A0786ED3192EA20DD448AB0

Function 00AE039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00AE0704,?,?,00000000,?,00AE0704,00000000,0000000C), ref: 00AE03B7

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 908829b0fb1578d54401bbf33ee1720c5b4b01424c425976315b94ec59f1af7c
Instruction ID: f845c86e8c1934b12e96035688e35e3916f09f8a69d03b5201df9c8c3128ef4b
Opcode Fuzzy Hash: 908829b0fb1578d54401bbf33ee1720c5b4b01424c425976315b94ec59f1af7c
Instruction Fuzzy Hash: 07D06C3204010DBBDF028F84DD06EDA3FAAFB48714F114000BE1866020C732E821AB90

Function 00AA1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00AA1CBC

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 01e04103b0430eb3caf0b9a53bff138f0434bec4598adbbc6bf810ef060ad66e
Instruction ID: 8720f885e7cd71d50e61e5c20b9157f88388f31130a3ee6091befd761ad90927
Opcode Fuzzy Hash: 01e04103b0430eb3caf0b9a53bff138f0434bec4598adbbc6bf810ef060ad66e
Instruction Fuzzy Hash: A4C09B36280304EFF31447D4BC4BF147754A358B00F154401F64D675E3CBA11450D764

Non-executed Functions

Function 00B39576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AB9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00B3961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B3965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00B3969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B396C9
SendMessageW.USER32 ref: 00B396F2
GetKeyState.USER32(00000011), ref: 00B3978B
GetKeyState.USER32(00000009), ref: 00B39798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B397AE
GetKeyState.USER32(00000010), ref: 00B397B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B397E9
SendMessageW.USER32 ref: 00B39810
SendMessageW.USER32(?,00001030,?,00B37E95), ref: 00B39918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00B3992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00B39941
SetCapture.USER32(?), ref: 00B3994A
ClientToScreen.USER32(?,?), ref: 00B399AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00B399BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B399D6
ReleaseCapture.USER32 ref: 00B399E1
GetCursorPos.USER32(?), ref: 00B39A19
ScreenToClient.USER32(?,?), ref: 00B39A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B39A80
SendMessageW.USER32 ref: 00B39AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B39AEB
SendMessageW.USER32 ref: 00B39B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B39B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00B39B4A
GetCursorPos.USER32(?), ref: 00B39B68
ScreenToClient.USER32(?,?), ref: 00B39B75
GetParent.USER32(?), ref: 00B39B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B39BFA
SendMessageW.USER32 ref: 00B39C2B
ClientToScreen.USER32(?,?), ref: 00B39C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B39CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B39CDE
SendMessageW.USER32 ref: 00B39D01
ClientToScreen.USER32(?,?), ref: 00B39D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00B39D82

Part of subcall function 00AB9944: GetWindowLongW.USER32(?,000000EB), ref: 00AB9952

GetWindowLongW.USER32(?,000000F0), ref: 00B39E05

Strings

F, xrefs: 00B39D07
@GUI_DRAGID, xrefs: 00B3997D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 5d7275f1eb517fe9907143e7bdf5a6108a3287ecb390b01ae396b1f5af6b6e8e
Instruction ID: dbb477afe34253343f62d149f19634092739e28b03276c2ccfd383f34802b72d
Opcode Fuzzy Hash: 5d7275f1eb517fe9907143e7bdf5a6108a3287ecb390b01ae396b1f5af6b6e8e
Instruction Fuzzy Hash: DE42BF35205200AFD724CF68CC85EAABBE5FF49310F204A99F699972A1DBB1EC51CF51

Function 00B34873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00B348F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00B34908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00B34927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00B3494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00B3495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00B3497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00B349AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00B349D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00B34A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00B34A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00B34A7E
IsMenu.USER32(?), ref: 00B34A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B34AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B34B20
GetWindowLongW.USER32(?,000000F0), ref: 00B34B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00B34BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00B34C82
wsprintfW.USER32 ref: 00B34CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B34CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00B34CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00B34D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B34D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00B34D5A

Strings

%d/%02d/%02d, xrefs: 00B34CA8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: a72e681dc2d2c7dd3d3cc465af1b4e40dea17bb4faf129ad97564e28b7444930
Instruction ID: b5613af745f495406dfbcc245f6b6b8cd2850b58f0ff1dca3ee4133fbdaf599e
Opcode Fuzzy Hash: a72e681dc2d2c7dd3d3cc465af1b4e40dea17bb4faf129ad97564e28b7444930
Instruction Fuzzy Hash: F912D271500214AFEB258F68CC4AFAE7BF8EF45710F2441A9F519EB2E1DB74A941CB50

Function 00ABF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00ABF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00AFF474
IsIconic.USER32(00000000), ref: 00AFF47D
ShowWindow.USER32(00000000,00000009), ref: 00AFF48A
SetForegroundWindow.USER32(00000000), ref: 00AFF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00AFF4AA
GetCurrentThreadId.KERNEL32 ref: 00AFF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00AFF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00AFF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00AFF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00AFF4DE
SetForegroundWindow.USER32(00000000), ref: 00AFF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AFF4F6
keybd_event.USER32(00000012,00000000), ref: 00AFF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AFF50B
keybd_event.USER32(00000012,00000000), ref: 00AFF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AFF519
keybd_event.USER32(00000012,00000000), ref: 00AFF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AFF528
keybd_event.USER32(00000012,00000000), ref: 00AFF52D
SetForegroundWindow.USER32(00000000), ref: 00AFF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00AFF557

Strings

Shell_TrayWnd, xrefs: 00AFF46F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: c0270f82290bf691b284aa707ab20f76f54cbdea3540c201349bb9ca128c17a9
Instruction ID: 1f49d933e0855748c16b2053f64349c035ccdba996537f1d856b694d5e4f887f
Opcode Fuzzy Hash: c0270f82290bf691b284aa707ab20f76f54cbdea3540c201349bb9ca128c17a9
Instruction Fuzzy Hash: 09310E71A80218BEEB216BF55C4AFBF7E6CEB44B50F210065FA01F7191CBB19D00AB60

Function 00B01201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00B016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B0170D
Part of subcall function 00B016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B0173A
Part of subcall function 00B016C3: GetLastError.KERNEL32 ref: 00B0174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00B01286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00B012A8
CloseHandle.KERNEL32(?), ref: 00B012B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B012D1
GetProcessWindowStation.USER32 ref: 00B012EA
SetProcessWindowStation.USER32(00000000), ref: 00B012F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B01310

Part of subcall function 00B010BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B011FC), ref: 00B010D4
Part of subcall function 00B010BF: CloseHandle.KERNEL32(?,?,00B011FC), ref: 00B010E9

Strings

winsta0, xrefs: 00B012CC
, xrefs: 00B0125A
default, xrefs: 00B0130B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: dd661d42a2d0ed9fccbbd9e1c332f3b47de29eacad4cc485fed98e63adfa567f
Instruction ID: 4ff99b4ba39a1565f44688b0a8d81fdc6e7f27989c8a3761d65021250e61f383
Opcode Fuzzy Hash: dd661d42a2d0ed9fccbbd9e1c332f3b47de29eacad4cc485fed98e63adfa567f
Instruction Fuzzy Hash: 0F817871900209AFDF259FA8DC49BEE7FB9EF04704F2445A9F910B62A0DB758954CF20

Function 00B00B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B01114
Part of subcall function 00B010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B00B9B,?,?,?), ref: 00B01120
Part of subcall function 00B010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B00B9B,?,?,?), ref: 00B0112F
Part of subcall function 00B010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B00B9B,?,?,?), ref: 00B01136
Part of subcall function 00B010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B0114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B00BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B00C00
GetLengthSid.ADVAPI32(?), ref: 00B00C17
GetAce.ADVAPI32(?,00000000,?), ref: 00B00C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B00C6D
GetLengthSid.ADVAPI32(?), ref: 00B00C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B00C8C
HeapAlloc.KERNEL32(00000000), ref: 00B00C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B00CB4
CopySid.ADVAPI32(00000000), ref: 00B00CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B00CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B00D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B00D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B00D45
HeapFree.KERNEL32(00000000), ref: 00B00D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B00D55
HeapFree.KERNEL32(00000000), ref: 00B00D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B00D65
HeapFree.KERNEL32(00000000), ref: 00B00D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B00D78
HeapFree.KERNEL32(00000000), ref: 00B00D7F

Part of subcall function 00B01193: GetProcessHeap.KERNEL32(00000008,00B00BB1,?,00000000,?,00B00BB1,?), ref: 00B011A1
Part of subcall function 00B01193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B00BB1,?), ref: 00B011A8
Part of subcall function 00B01193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B00BB1,?), ref: 00B011B7

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 6c086fd436f401391da3b03e2f24f3a93e8bc76d8cf2fb0146c78bb73aeb7e9e
Instruction ID: 4d50d429bfe5d848da772d6910756e32481216c547c2c76bedaa8a53be175eac
Opcode Fuzzy Hash: 6c086fd436f401391da3b03e2f24f3a93e8bc76d8cf2fb0146c78bb73aeb7e9e
Instruction Fuzzy Hash: 3071397690020AABDF10AFE4DC44BAEBFB9FF04310F2446A5E915B7191DB75AA05CB70

Function 00B1EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00B3CC08), ref: 00B1EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00B1EB37
GetClipboardData.USER32(0000000D), ref: 00B1EB43
CloseClipboard.USER32 ref: 00B1EB4F
GlobalLock.KERNEL32(00000000), ref: 00B1EB87
CloseClipboard.USER32 ref: 00B1EB91
GlobalUnlock.KERNEL32(00000000), ref: 00B1EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00B1EBC9
GetClipboardData.USER32(00000001), ref: 00B1EBD1
GlobalLock.KERNEL32(00000000), ref: 00B1EBE2
GlobalUnlock.KERNEL32(00000000), ref: 00B1EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00B1EC38
GetClipboardData.USER32(0000000F), ref: 00B1EC44
GlobalLock.KERNEL32(00000000), ref: 00B1EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00B1EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B1EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B1ECD2
GlobalUnlock.KERNEL32(00000000), ref: 00B1ECF3
CountClipboardFormats.USER32 ref: 00B1ED14
CloseClipboard.USER32 ref: 00B1ED59

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 30540a1e97000d26b9cf4d8399301fdb681187a870e9d92c0f134023c57689cc
Instruction ID: aef3357d39cd8f425e6bee8d968c6ef45379f779a1ad51d8b5c1c0a631f8285f
Opcode Fuzzy Hash: 30540a1e97000d26b9cf4d8399301fdb681187a870e9d92c0f134023c57689cc
Instruction Fuzzy Hash: F561D1352042019FD300EF64D889FAABBE4EF85714F58459DF866972A1CF31DD89CB62

Function 00B1698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B169BE
FindClose.KERNEL32(00000000), ref: 00B16A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B16A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B16A75

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00B16AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B16ADF

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00B16B6A
%4d, xrefs: 00B16BB1
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00B16B32
%02d, xrefs: 00B16C00, 00B16C0A, 00B16C5A, 00B16CAA, 00B16CFA, 00B16D4A
%03d, xrefs: 00B16DA2

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 874cef6d44bdb228ae323d7893eaf2cc89cedefaa0bc34479be438d85b403295
Instruction ID: 6f37de1d9cea6084673464be9431da94fbdbb62cb53a7e6ab5c1ebcc03f0c958
Opcode Fuzzy Hash: 874cef6d44bdb228ae323d7893eaf2cc89cedefaa0bc34479be438d85b403295
Instruction Fuzzy Hash: 19D14D72508300AEC714EBA4CD82EAFB7ECAF89704F44495DF589D7191EB74DA44CB62

Function 00B19642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00B19663
GetFileAttributesW.KERNEL32(?), ref: 00B196A1
SetFileAttributesW.KERNEL32(?,?), ref: 00B196BB
FindNextFileW.KERNEL32(00000000,?), ref: 00B196D3
FindClose.KERNEL32(00000000), ref: 00B196DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00B196FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00B1974A
SetCurrentDirectoryW.KERNEL32(00B66B7C), ref: 00B19768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B19772
FindClose.KERNEL32(00000000), ref: 00B1977F
FindClose.KERNEL32(00000000), ref: 00B1978F

Strings

*.*, xrefs: 00B196F5

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: f5a22021658a313e73e0bb0bfc2b78090c85982b245665379fed58100a5e134a
Instruction ID: 135f7a577104f8ffb9f046c5d5a9a671983129dfddc80e4c17a180d43697f195
Opcode Fuzzy Hash: f5a22021658a313e73e0bb0bfc2b78090c85982b245665379fed58100a5e134a
Instruction Fuzzy Hash: D331A032540259AADB14AFF4DC59ADE7BECEF09320F644195F815E30E0DB34DE848B64

Function 00B1979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00B197BE
FindNextFileW.KERNEL32(00000000,?), ref: 00B19819
FindClose.KERNEL32(00000000), ref: 00B19824
FindFirstFileW.KERNEL32(*.*,?), ref: 00B19840
SetCurrentDirectoryW.KERNEL32(?), ref: 00B19890
SetCurrentDirectoryW.KERNEL32(00B66B7C), ref: 00B198AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B198B8
FindClose.KERNEL32(00000000), ref: 00B198C5
FindClose.KERNEL32(00000000), ref: 00B198D5

Part of subcall function 00B0DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B0DB00

Strings

*.*, xrefs: 00B1983B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 5efaf9fdcfbe3d99f43a28fc1910b36ef830c9818cfdf9b49662896fe2b0d8d3
Instruction ID: 6aacb86cff4e30b42c572f21aac517bd0d4ac6255e11674fe6e76f47f62a1053
Opcode Fuzzy Hash: 5efaf9fdcfbe3d99f43a28fc1910b36ef830c9818cfdf9b49662896fe2b0d8d3
Instruction Fuzzy Hash: 0A31B232540659AADB14AFB4DC59ADE7BECEF06360F6441A5F814A30E0DB30D9858B64

Function 00B0D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AA3A97,?,?,00AA2E7F,?,?,?,00000000), ref: 00AA3AC2

Part of subcall function 00B0E199: GetFileAttributesW.KERNEL32(?,00B0CF95), ref: 00B0E19A

FindFirstFileW.KERNEL32(?,?), ref: 00B0D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00B0D1DD
MoveFileW.KERNEL32(?,?), ref: 00B0D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B0D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B0D237

Part of subcall function 00B0D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00B0D21C,?,?), ref: 00B0D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00B0D253
FindClose.KERNEL32(00000000), ref: 00B0D264

Strings

\*.*, xrefs: 00B0D0CD, 00B0D0D6, 00B0D0EB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 7273caf7cc27e793aaabd7293d9b4ab938c0cf923f367e0d56352cab54808594
Instruction ID: 69fb2ef38cf13303d775503ceca7154d498df672a156bcd580c5911a42113a5a
Opcode Fuzzy Hash: 7273caf7cc27e793aaabd7293d9b4ab938c0cf923f367e0d56352cab54808594
Instruction Fuzzy Hash: 97615C3180111DAECF05EBE0DA929EEBBB5AF55340F2481A9E406771D1EF35AF09CB61

Function 00B1ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B1ED91
EmptyClipboard.USER32 ref: 00B1ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00B1EDAC
CloseClipboard.USER32 ref: 00B1EEA3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 6990be5bf4f3f99e583d1407a4aa186fd49b62f81c91f0cd3d757dc8621bb4be
Instruction ID: 1fd8fddc1864ee0a993a603d90cdaf1eaf3c8d7c01e13091c1d4a12c7fcc8a44
Opcode Fuzzy Hash: 6990be5bf4f3f99e583d1407a4aa186fd49b62f81c91f0cd3d757dc8621bb4be
Instruction Fuzzy Hash: C241B435204611AFE310DF59D889F59BBE1FF44318F54C099E8259B6A2CB35EC81CB90

Function 00B0E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00B016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B0170D
Part of subcall function 00B016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B0173A
Part of subcall function 00B016C3: GetLastError.KERNEL32 ref: 00B0174A

ExitWindowsEx.USER32(?,00000000), ref: 00B0E932

Strings

SeShutdownPrivilege, xrefs: 00B0E902
, xrefs: 00B0E920
@, xrefs: 00B0E925
, xrefs: 00B0E95C

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: ae01a36c056c9ea6d34ac3138fa4a1d4f54265c39b3792bd3d0e51a4a471bb3e
Instruction ID: 9a3b8cbe9c187b871ddb6861d80ea139ca88f490fd0d25d1458113d302f2c974
Opcode Fuzzy Hash: ae01a36c056c9ea6d34ac3138fa4a1d4f54265c39b3792bd3d0e51a4a471bb3e
Instruction Fuzzy Hash: 8D01D673610211AFEB5426B89C8ABBF7ADCE714750F154DA2FD22F31D1DAB19C408294

Function 00B21204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00B21276
WSAGetLastError.WSOCK32 ref: 00B21283
bind.WSOCK32(00000000,?,00000010), ref: 00B212BA
WSAGetLastError.WSOCK32 ref: 00B212C5
closesocket.WSOCK32(00000000), ref: 00B212F4
listen.WSOCK32(00000000,00000005), ref: 00B21303
WSAGetLastError.WSOCK32 ref: 00B2130D
closesocket.WSOCK32(00000000), ref: 00B2133C

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: e6fdd29c97bc410a1a51731ea862c47453cb42bb1d7d6f308dd3dfe090cd55ff
Instruction ID: 21f833be267dc91376bd467332b494f493f5dad6ed0095f8e1046d87b4cd52aa
Opcode Fuzzy Hash: e6fdd29c97bc410a1a51731ea862c47453cb42bb1d7d6f308dd3dfe090cd55ff
Instruction Fuzzy Hash: 4C416031A00110EFD710DF68D584B2ABBE6EF56314F288598E85A9F2D6C771ED81CBA1

Function 00ADB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00ADB9D4
_free.LIBCMT ref: 00ADB9F8
_free.LIBCMT ref: 00ADBB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00B43700), ref: 00ADBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00B7121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00ADBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00B71270,000000FF,?,0000003F,00000000,?), ref: 00ADBC36
_free.LIBCMT ref: 00ADBD4B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 04d166db65b876dd97c26b896d3eaa0a3e8ab61bc3311e6fd999a61e6f5797c2
Instruction ID: c2f24332e21b104e3b06f448de9771a9a9c6fbc4106cadc752754683b79e1050
Opcode Fuzzy Hash: 04d166db65b876dd97c26b896d3eaa0a3e8ab61bc3311e6fd999a61e6f5797c2
Instruction Fuzzy Hash: 83C12471920244EFCB20DF688951BAA7BB8EF45350F16459BE496DB362EB308E41D770

Function 00B0D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AA3A97,?,?,00AA2E7F,?,?,?,00000000), ref: 00AA3AC2

Part of subcall function 00B0E199: GetFileAttributesW.KERNEL32(?,00B0CF95), ref: 00B0E19A

FindFirstFileW.KERNEL32(?,?), ref: 00B0D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B0D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B0D481
FindClose.KERNEL32(00000000), ref: 00B0D498
FindClose.KERNEL32(00000000), ref: 00B0D4A1

Strings

\*.*, xrefs: 00B0D3F2

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 1c54e2369a3b65236e74e1044076eb6699350c456bf689c2613148d7b1bc39a9
Instruction ID: 53ecac252129edfabf86fa6edd83254b394f4351e530006b4c74593a9745ccd3
Opcode Fuzzy Hash: 1c54e2369a3b65236e74e1044076eb6699350c456bf689c2613148d7b1bc39a9
Instruction Fuzzy Hash: 48317E310083419BC701EFA4D9919AFBBE8BE96300F444A5DF4D5932D1EB34AA09CB63

Function 00ADE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00ADE645

Strings

1#QNAN, xrefs: 00ADF84B
1#IND, xrefs: 00ADF83D
1#SNAN, xrefs: 00ADF844
1#INF, xrefs: 00ADF852

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3c0ef62c40229cec6cda2a6e83fd7cc4ee237f9d88dc3c264c1f8cbcff205d82
Instruction ID: b534a735dd88f59411d6240c58beb37ee81322cbe11e42393960f5987c94e018
Opcode Fuzzy Hash: 3c0ef62c40229cec6cda2a6e83fd7cc4ee237f9d88dc3c264c1f8cbcff205d82
Instruction Fuzzy Hash: 4DC22771E086288FDB25DF289D407EAB7B5EB49305F1541EBD84EEB240E775AE818F40

Function 00B1648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B164DC
CoInitialize.OLE32(00000000), ref: 00B16639
CoCreateInstance.OLE32(00B3FCF8,00000000,00000001,00B3FB68,?), ref: 00B16650
CoUninitialize.OLE32 ref: 00B168D4

Strings

.lnk, xrefs: 00B164BA, 00B16524, 00B165E0

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 47302549f6ad42d253b028f056942106077d4a9fdf8590fa88f8208a222a8ae7
Instruction ID: 3e8e5443ccd9edc074f6b01ba30964a65be97cff8a39c544244379a615fe1771
Opcode Fuzzy Hash: 47302549f6ad42d253b028f056942106077d4a9fdf8590fa88f8208a222a8ae7
Instruction Fuzzy Hash: D1D15871508301AFC304EF24C981AABB7E9FF99704F54896DF5958B2A1EB30ED45CB92

Function 00B222DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00B222E8

Part of subcall function 00B1E4EC: GetWindowRect.USER32(?,?), ref: 00B1E504

GetDesktopWindow.USER32 ref: 00B22312
GetWindowRect.USER32(00000000), ref: 00B22319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00B22355
GetCursorPos.USER32(?), ref: 00B22381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00B223DF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 108257b0b4d56ae64f5c13afb2fafecefb8aed1ac786c6b93678fc190dbcd170
Instruction ID: 33e90903394f0d318b6f22e5f53192137567a4c4b400ae2db0a29eed6bbe0535
Opcode Fuzzy Hash: 108257b0b4d56ae64f5c13afb2fafecefb8aed1ac786c6b93678fc190dbcd170
Instruction Fuzzy Hash: 9E31FE72504315AFCB20DF54D849B9BBBE9FF88310F100A59F998E7181DB34EA08CB96

Function 00B19B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00B19B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00B19C8B

Part of subcall function 00B13874: GetInputState.USER32 ref: 00B138CB
Part of subcall function 00B13874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B13966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00B19BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00B19C75

Strings

*.*, xrefs: 00B19B5D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 9686429ef50be925a18aacf741d668bf843d10588ddc37f2ce40efdda85ced17
Instruction ID: 041b9fca0189571445e2e61af249377ede8bf373f61f04d3da2f8f1a804c0ba8
Opcode Fuzzy Hash: 9686429ef50be925a18aacf741d668bf843d10588ddc37f2ce40efdda85ced17
Instruction Fuzzy Hash: C341817190424AAFCF55DFA4C995AEEBBF8EF05310F644095F845A3291EB309E84CFA0

Function 00AB997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00AB9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AB9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00AB9A4E
GetSysColor.USER32(0000000F), ref: 00AB9B23
SetBkColor.GDI32(?,00000000), ref: 00AB9B36

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 65b76b4a7695bee474751d19e07343786ed35720c412dc14a00f7e9862a42864
Instruction ID: b7245334d9f91cbc874a39879475187470abb355df4f274b72c88254a1e6188b
Opcode Fuzzy Hash: 65b76b4a7695bee474751d19e07343786ed35720c412dc14a00f7e9862a42864
Instruction Fuzzy Hash: E0A10770118548AEE728AB7C8C99EFF3AADDF42380F25410DF712D6693CE259D42D272

Function 00B21806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2304E: inet_addr.WSOCK32(?), ref: 00B2307A
Part of subcall function 00B2304E: _wcslen.LIBCMT ref: 00B2309B

socket.WSOCK32(00000002,00000002,00000011), ref: 00B2185D
WSAGetLastError.WSOCK32 ref: 00B21884
bind.WSOCK32(00000000,?,00000010), ref: 00B218DB
WSAGetLastError.WSOCK32 ref: 00B218E6
closesocket.WSOCK32(00000000), ref: 00B21915

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: dec17524cdf23630132ecf874c8b4828046c50325dd870d273860041ac80fab0
Instruction ID: 4230128f1b48b1f44997ff55e7442b36e42af7a47653bfba389ba881e0f2ce9e
Opcode Fuzzy Hash: dec17524cdf23630132ecf874c8b4828046c50325dd870d273860041ac80fab0
Instruction Fuzzy Hash: 8651B471A00210AFEB10AF24D9C6F6A77E5EB45718F188498F90A6F3D3D771ED418BA1

Function 00B31C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00B31CC0
IsWindowEnabled.USER32 ref: 00B31CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00B31CDB
IsIconic.USER32 ref: 00B31CE9
IsZoomed.USER32 ref: 00B31CF7

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 123819a48b4dda26e6b050a5e1f86e7b90c4e2f4ea039ce3ee5d30d8669cf029
Instruction ID: a0a26260ebd0e644f76573c787c316efaf8392e114f7788c5bd23f7a4622a5c2
Opcode Fuzzy Hash: 123819a48b4dda26e6b050a5e1f86e7b90c4e2f4ea039ce3ee5d30d8669cf029
Instruction Fuzzy Hash: AF21A3317402105FD7208F2ED894B6A7BE9EF95325F7994A8E8469F351CB71EC42CB90

Function 00AA8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00AA813C
VUUU, xrefs: 00AA843C
VUUU, xrefs: 00AA83E8
VUUU, xrefs: 00AA83FA
VUUU, xrefs: 00AE5DF0

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: da6ab05918eb5edcc9ab89880b525e1dc93b90efbc01f1663b0c7e1e2cdf489d
Instruction ID: 5e5bcb3476b5e652d875b478a33f857004c48d4df0097972f13f0a8553ae801c
Opcode Fuzzy Hash: da6ab05918eb5edcc9ab89880b525e1dc93b90efbc01f1663b0c7e1e2cdf489d
Instruction Fuzzy Hash: C1A2A070E0065ACBDF24CF59C9807EEB7B1BF55314F2485AAE815AB285EB349D81CF90

Function 00B0AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00B0AAAC
SetKeyboardState.USER32(00000080), ref: 00B0AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00B0AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00B0AB88

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 09ffb8080a511815850543bc3c08538fd7115645043d84c36b2c886d854179cf
Instruction ID: 7e6cc47a851bda0a7eed12a27dee2d2ae4f69bc022c5306c75770af0c5275e0e
Opcode Fuzzy Hash: 09ffb8080a511815850543bc3c08538fd7115645043d84c36b2c886d854179cf
Instruction Fuzzy Hash: 2C311431A40308AEFB359B68CC45BFA7FE6EB44310F144A9AF581A61E1D774C985C762

Function 00B1CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00B1CE89
GetLastError.KERNEL32(?,00000000), ref: 00B1CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00B1CEFE

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 76cc01a808c216fc34c424e022d1c73c9b320401ad1f60e7197ceec03636736c
Instruction ID: cfff0e00f2ef54ebbfc1b09d1eb39fae21866be3dfd4b0df094cde30bc0d6dd6
Opcode Fuzzy Hash: 76cc01a808c216fc34c424e022d1c73c9b320401ad1f60e7197ceec03636736c
Instruction Fuzzy Hash: 8A21C172540305DBD730CFA5C988BABBBFCEB00314F60446EE546E2151EB74ED898B54

Function 00B08298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00B082AA

Strings

(, xrefs: 00B082F0
|, xrefs: 00B082DA

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 64eb93e6e1579859f813b42302593dbe2800b180f530e25014721f36848197ba
Instruction ID: 105ee55e0de752400932f6f22df6ee6f13aac752844acd5d05f1f56ad03253dc
Opcode Fuzzy Hash: 64eb93e6e1579859f813b42302593dbe2800b180f530e25014721f36848197ba
Instruction Fuzzy Hash: 08323775A007059FC728CF59C481A6ABBF1FF48710B15C5AEE49ADB3A1EB70EA41CB44

Function 00B15C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B15CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00B15D17
FindClose.KERNEL32(?), ref: 00B15D5F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 68d0153623c88448c3bf3cc72f846713ec5ccbca7a21ef20fd91ddd308b3c146
Instruction ID: 13e6c1796433518b073a9bc834e626e499c7a9e9436bca8fb1b42576154eb187
Opcode Fuzzy Hash: 68d0153623c88448c3bf3cc72f846713ec5ccbca7a21ef20fd91ddd308b3c146
Instruction Fuzzy Hash: 37517A74604601DFC724DF28D494E9ABBE4FF4A324F5485ADE95A8B3A1CB30ED84CB91

Function 00AD2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00AD271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AD2724
UnhandledExceptionFilter.KERNEL32(?), ref: 00AD2731

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 96a24f996bc7f5468e8ae30a63e771211c22b323391fd67f8ba817c91b44da45
Instruction ID: 4894874997a0fdd0a11726a14ca612397caa6a68e3b83767bf1f5c21255744d4
Opcode Fuzzy Hash: 96a24f996bc7f5468e8ae30a63e771211c22b323391fd67f8ba817c91b44da45
Instruction Fuzzy Hash: CF31D67590121CABCB21DF64DD88BDDBBB8AF18310F5041EAE81CA7260EB349F818F44

Function 00B151CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B151DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B15238
SetErrorMode.KERNEL32(00000000), ref: 00B152A1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 2fe8545d820e712b39501263115ef9524de6010a4867824a9cc0f6c0487571a9
Instruction ID: 8e40239f9f605685a6cf532627f538aaddedec97fba263a988bcf6a65f0b83da
Opcode Fuzzy Hash: 2fe8545d820e712b39501263115ef9524de6010a4867824a9cc0f6c0487571a9
Instruction Fuzzy Hash: 0F315E75A00618DFDB00DF94D884EAEBBF4FF49314F548099E805AB3A2DB31E855CB90

Function 00B016C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00ABFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00AC0668
Part of subcall function 00ABFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00AC0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B0170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B0173A
GetLastError.KERNEL32 ref: 00B0174A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 0a6187b496efc309781bf40be7b3177678b002ea422986e67188a9993044a2b4
Instruction ID: 530f086f7edc64d87d0b71c22aef63f31e40f14405a6cd79c5b2f4a12ebc183e
Opcode Fuzzy Hash: 0a6187b496efc309781bf40be7b3177678b002ea422986e67188a9993044a2b4
Instruction Fuzzy Hash: 07119EB2504304AFD718AF58DDC6DAABBFDEB44714B24856EE05657281EB70FC418B24

Function 00B0D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B0D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00B0D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B0D650

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: b81a306616d80905d28b9de3971580c0745d76dedb1c49eff5e0c034c1823eab
Instruction ID: 2be3cf4d533abf26f3d1ceffd202dd0c8270e3822ea231d0506079c3c56fabb8
Opcode Fuzzy Hash: b81a306616d80905d28b9de3971580c0745d76dedb1c49eff5e0c034c1823eab
Instruction Fuzzy Hash: 64113C75E05228BFDB108F959C45FAFBFBCEB45B50F108155F904F7290D6704A058BA1

Function 00B01663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00B0168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00B016A1
FreeSid.ADVAPI32(?), ref: 00B016B1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: d6584c164b1cbed5792b9aabc556469955ff9567b3809941f901b7667cd82db1
Instruction ID: 1cf6db109a0d0aea3987522bbaa298f0969b03f98ba20ced62f9295ee7eda7a4
Opcode Fuzzy Hash: d6584c164b1cbed5792b9aabc556469955ff9567b3809941f901b7667cd82db1
Instruction Fuzzy Hash: 6EF0F47195030DFBDB00DFE49D89AAEBBBCEB08704F5049A5E501E2181E774AA448B50

Function 00ADC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00ADC36C

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: b55a30edfd9692cf097ecdb2da326052140660ef66f4bbf4d9c631b101e25298
Instruction ID: 24cb22d9d516a7e509840e93b267567fd68bd9b4fe753b57903714ff06eaf152
Opcode Fuzzy Hash: b55a30edfd9692cf097ecdb2da326052140660ef66f4bbf4d9c631b101e25298
Instruction Fuzzy Hash: 76413B7650021A6FCB24AFB9CC4DEFBB778EB84724F50426AF916DB280E6709D41CB50

Function 00ACCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 97fbe2640c45908b6c2dcf7f344587accccfcbd519f866ca847d1e2fba3bab17
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 4C020C71E002199BDF14CFA9C980BADBBF1EF48324F25816ED919E7384D731AE418B94

Function 00B168EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B16918
FindClose.KERNEL32(00000000), ref: 00B16961

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6d68a6c8d03c2ec97a15aeeaa2b0b54ef3b482a80791057d90b6fd75db832077
Instruction ID: f2c2579ec45dfaff0bc35ec3f531afc25947cb3f1970c0b0e302182c418a5723
Opcode Fuzzy Hash: 6d68a6c8d03c2ec97a15aeeaa2b0b54ef3b482a80791057d90b6fd75db832077
Instruction Fuzzy Hash: 841193316042119FD710DF69D884A1ABBE5FF89328F54C699E4698F2A2CB30EC45CB91

Function 00B137B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00B24891,?,?,00000035,?), ref: 00B137E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00B24891,?,?,00000035,?), ref: 00B137F4

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: ea7e97aec910798956f9b0fbe7797519f892f46179c9882be5481b3f7254cfb2
Instruction ID: d689ae150393fbea821ae4ac040ab034115c86138ecdf7a565bb2a31b84be960
Opcode Fuzzy Hash: ea7e97aec910798956f9b0fbe7797519f892f46179c9882be5481b3f7254cfb2
Instruction Fuzzy Hash: 04F0A0B16042282AE72027A68D49FEB3AAEEF85B61F000175B509E32C1DA609D4487B1

Function 00B0B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00B0B25D
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00B0B270

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: e896179e57b67fd87225983cc2632e5b28ded55df5ed3c5db04bcc94c1885c29
Instruction ID: fcb10bcb7c60e240f6ab8c3e2d108fe24756976ca04397e1a57447000f59bf53
Opcode Fuzzy Hash: e896179e57b67fd87225983cc2632e5b28ded55df5ed3c5db04bcc94c1885c29
Instruction Fuzzy Hash: 03F0177180428EABDB059FA0C806BAE7FB4FF08309F10804AF965A61A2C77986119F94

Function 00B010BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B011FC), ref: 00B010D4
CloseHandle.KERNEL32(?,?,00B011FC), ref: 00B010E9

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: a33c1d6df27325a92b953f42f41450df2abfe6f4b34f448b23e272c092bd802e
Instruction ID: 3b90e3b907561630e951299e25bda765a834127c15f53cc79ab7a473dc7b46e1
Opcode Fuzzy Hash: a33c1d6df27325a92b953f42f41450df2abfe6f4b34f448b23e272c092bd802e
Instruction Fuzzy Hash: 42E0BF72014610AEE7252B55FD05EB77BEDEB04310B24882DF5A6914B1DB62ACA0DB54

Function 00AACAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00AF0C40

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: e7fa316b42c68290c46846572144cd3fc00d7ec56ace96ab03f2021c7425b957
Instruction ID: f38e47a72dbde2f2bf285030c87c474d4a73c0b1765a355ae8785c4dc8e50769
Opcode Fuzzy Hash: e7fa316b42c68290c46846572144cd3fc00d7ec56ace96ab03f2021c7425b957
Instruction Fuzzy Hash: EE327A70900218DFEF14DF94C985EFDB7B5BF06324F148069E906AB292DB75AE46CB60

Function 00AD676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00AD6766,?,?,00000008,?,?,00ADFEFE,00000000), ref: 00AD6998

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b0bd1e54d2e403f2a6a8669942e1ac91b47d9fa12aead09639baf1b389947677
Instruction ID: 0aed528b5213d842346f212ceba7c245a8b4df843c77308b55a39fa384f21c82
Opcode Fuzzy Hash: b0bd1e54d2e403f2a6a8669942e1ac91b47d9fa12aead09639baf1b389947677
Instruction Fuzzy Hash: 17B129316106099FD715CF28C48AB697BB0FF45364F29865AE8DACF3A2C735E991CB40

Function 00ABB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00AF851F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c3bf79ff41f3b4ca8ef7ec5f09283dfc4a10a0523a3a396755799034ac8a855f
Instruction ID: d8e2d599b95d74817103b0048616e3944647852b8aadf08cbf42194dd773e1a4
Opcode Fuzzy Hash: c3bf79ff41f3b4ca8ef7ec5f09283dfc4a10a0523a3a396755799034ac8a855f
Instruction Fuzzy Hash: 561251759102299FCB14CF98C8806FEB7F5FF48710F14819AE949EB256DB749E81CBA0

Function 00B1EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00B1EABD

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 2ae5324069f7a68d6bfc54776e0a58100bd9d05cec60c12a809bf2c7d570e214
Instruction ID: c9f304aecbc53b01249350fb6f01c32488d1837486d07ea01fbe0cd6926616d9
Opcode Fuzzy Hash: 2ae5324069f7a68d6bfc54776e0a58100bd9d05cec60c12a809bf2c7d570e214
Instruction Fuzzy Hash: 0EE04F322102049FD710EF69D945E9AFBE9EF99770F008456FC4AD7391DB70E8808BA1

Function 00AC09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00AC03EE), ref: 00AC09DA

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7f47eed4f86214b17010b2722a270a8484b0cf114c6054f91d77442311777efd
Instruction ID: 2467ba74e956f7be3c5dcd0eecef91dac22e5fe32f01aebf6ebefd277a7adab4
Opcode Fuzzy Hash: 7f47eed4f86214b17010b2722a270a8484b0cf114c6054f91d77442311777efd
Instruction Fuzzy Hash:

Function 00AC781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00AC798B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 8972f152be45c61aa52b66aec86a96c8f5cc4be620c2144e38b20412ab91f621
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 4851AD7160C7059BDF788778895DFBE27E99B12340F1B050DEA82DB282CA25DE81DF52

Function 00AD6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42233e93606714ed3d318d226849d52b8a472c666fec1bfa63c9b8c13a8a5917
Instruction ID: 33803a092f87fb275f982d9b2c6be3054c9d6cc0bc272f0dde0b179dc00133d3
Opcode Fuzzy Hash: 42233e93606714ed3d318d226849d52b8a472c666fec1bfa63c9b8c13a8a5917
Instruction Fuzzy Hash: EA324326D69F014DD7279634DC22339A249AFB73C5F15C737F81AB6AA6EF28C5835100

Function 00ABCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2754ffaa6b69e99852e27258e570bdd1e47c43b67c5df65915052cec8014b42c
Instruction ID: a075e16cd9c5d5f8c0887f96197236b13674c342f6063d979a9a0ac2312e6767
Opcode Fuzzy Hash: 2754ffaa6b69e99852e27258e570bdd1e47c43b67c5df65915052cec8014b42c
Instruction Fuzzy Hash: E4323C31A0411D8BDF28CFAAC690ABD7BB1EB45370F288566F649CB292D734DD81DB40

Function 00AA7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26d78b6af99641f557cf114866fb7c279a86cc3f8a91124116568f101069432
Instruction ID: f71003375893c1b7caee409d654076982377c69079cfbdaad3b4f76a588edea6
Opcode Fuzzy Hash: c26d78b6af99641f557cf114866fb7c279a86cc3f8a91124116568f101069432
Instruction Fuzzy Hash: E022A0B0E0060ADFDF14CF65D981AAEB3F6FF45304F244529E816AB291EB369D11CB60

Function 00AA91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15bc8818bfa96aa8b4cf39dbcfc9958d25463dedf734bc5336409412e326b110
Instruction ID: a4e40991ca22b1698ba36d7b5840ccd8dbbce601f56755db6cbe037bebaa7c66
Opcode Fuzzy Hash: 15bc8818bfa96aa8b4cf39dbcfc9958d25463dedf734bc5336409412e326b110
Instruction Fuzzy Hash: BD02C5B0A00205EFDF04DF65D981AAEB7B5FF44340F218169E8169B2D1EB35EE24CB95

Function 00AC1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: a6ee8a578cef33e0e171f062d61b2d360b6259f9153023e57764519a2527bd21
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: AE9156723080A349DB2A473E8574A7DFFE15A533A131B079DE4F3CA1C6FE248965D620

Function 00AC19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: acc6abfc207bba404495ad88bd05dbcc101a928b0300994719212c7bb04a61d9
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 4D9123723090A34ADB2D477A8574A3DFFF15A933A131B079DD4F2CA1C2FE24C9659A20

Function 00AC7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c76b0c41f9858548ff1379a24deb75b9e541dd062f70bac1e49622876fcd3e
Instruction ID: 38fd5fdfc0727e576347a373eb51c71f935bb2b9e7c85250f440d9e2b2a1b24f
Opcode Fuzzy Hash: e2c76b0c41f9858548ff1379a24deb75b9e541dd062f70bac1e49622876fcd3e
Instruction Fuzzy Hash: 6061487160C709A7DB349B288E95FBE23A4EF41750F17091EE843DF281DA159E42CF55

Function 00AC7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412da774ac2da30e1e18f56cd13e2eac06d4f4277e315c30b244d648a58f8744
Instruction ID: 326aee709f6f0a7f1dfd990c7bc05ca912b552c4d91c0266b77f34a212d8cd88
Opcode Fuzzy Hash: 412da774ac2da30e1e18f56cd13e2eac06d4f4277e315c30b244d648a58f8744
Instruction Fuzzy Hash: 71617A72608709A7DE3A9B284952FBF23A4EF42744F12095EF843DF281DA16AD42CE55

Function 00AC1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 2aea3f8aaddc38ab449ebd68789bac682f960b4ed6272318b38b3f98604d19bf
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 7E81417270D0A349EB69473A8574A3EFFE15A933A131B079DD4F2CA1C2EE24D554E620

Function 00B12046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 766161dc7ba3aa9d6a16737f125325f29b0774b06bd3213b3f953fee747d769b
Instruction ID: 5eecfad6af02ad2e64e8458c01559a4f10156034847f619558fa206cf40d75e1
Opcode Fuzzy Hash: 766161dc7ba3aa9d6a16737f125325f29b0774b06bd3213b3f953fee747d769b
Instruction Fuzzy Hash: D321D5326206118BD728CF79C8226BA73E5E754310F15866EE4A7C73D1DE39A944CB80

Function 00B22ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B22B30
DeleteObject.GDI32(00000000), ref: 00B22B43
DestroyWindow.USER32 ref: 00B22B52
GetDesktopWindow.USER32 ref: 00B22B6D
GetWindowRect.USER32(00000000), ref: 00B22B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00B22CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00B22CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B22CF8
GetClientRect.USER32(00000000,?), ref: 00B22D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00B22D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B22D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B22D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B22D80
GlobalLock.KERNEL32(00000000), ref: 00B22D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B22D98
GlobalUnlock.KERNEL32(00000000), ref: 00B22DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B22DA8
GlobalFree.KERNEL32(00000000), ref: 00B22DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B22DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00B3FC38,00000000), ref: 00B22DDB
GlobalFree.KERNEL32(00000000), ref: 00B22DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00B22E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00B22E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B22E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B2303F

Strings

static, xrefs: 00B22D3A, 00B22E91
DISPLAY, xrefs: 00B22EA2
AutoIt v3, xrefs: 00B22CF2
, xrefs: 00B22FC5

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 7d9d11aa1b4b6dac6341fa3162d52ce41b77b4e758b53b31924574a6d04eb653
Instruction ID: 0ae80172484f0ad3ed209ef34e0fb624a59c13c2f068804a543efac464793644
Opcode Fuzzy Hash: 7d9d11aa1b4b6dac6341fa3162d52ce41b77b4e758b53b31924574a6d04eb653
Instruction Fuzzy Hash: 9D028B71900215EFDB14DFA8DD89EAE7BB9EF49310F148558F919AB2A1CB34ED00CB60

Function 00B370D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00B3712F
GetSysColorBrush.USER32(0000000F), ref: 00B37160
GetSysColor.USER32(0000000F), ref: 00B3716C
SetBkColor.GDI32(?,000000FF), ref: 00B37186
SelectObject.GDI32(?,?), ref: 00B37195
InflateRect.USER32(?,000000FF,000000FF), ref: 00B371C0
GetSysColor.USER32(00000010), ref: 00B371C8
CreateSolidBrush.GDI32(00000000), ref: 00B371CF
FrameRect.USER32(?,?,00000000), ref: 00B371DE
DeleteObject.GDI32(00000000), ref: 00B371E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00B37230
FillRect.USER32(?,?,?), ref: 00B37262
GetWindowLongW.USER32(?,000000F0), ref: 00B37284

Part of subcall function 00B373E8: GetSysColor.USER32(00000012), ref: 00B37421
Part of subcall function 00B373E8: SetTextColor.GDI32(?,?), ref: 00B37425
Part of subcall function 00B373E8: GetSysColorBrush.USER32(0000000F), ref: 00B3743B
Part of subcall function 00B373E8: GetSysColor.USER32(0000000F), ref: 00B37446
Part of subcall function 00B373E8: GetSysColor.USER32(00000011), ref: 00B37463
Part of subcall function 00B373E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B37471
Part of subcall function 00B373E8: SelectObject.GDI32(?,00000000), ref: 00B37482
Part of subcall function 00B373E8: SetBkColor.GDI32(?,00000000), ref: 00B3748B
Part of subcall function 00B373E8: SelectObject.GDI32(?,?), ref: 00B37498
Part of subcall function 00B373E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00B374B7
Part of subcall function 00B373E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B374CE
Part of subcall function 00B373E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00B374DB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: c2555a56d22225f21f1827c9d507c982c9bc1f95fcd8e9210048b7deb706c144
Instruction ID: 923482a1147b561f03bb75052d2fc595c9dcf2202cdb4f22c2aecb084f486acc
Opcode Fuzzy Hash: c2555a56d22225f21f1827c9d507c982c9bc1f95fcd8e9210048b7deb706c144
Instruction Fuzzy Hash: F1A19F72008701AFDB109FA4DC49E6FBBE9FB49321F200A19F962A71E1DB71E944DB51

Function 00AB8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00AB8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00AF6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00AF6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00AF6F43

Part of subcall function 00AB8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AB8BE8,?,00000000,?,?,?,?,00AB8BBA,00000000,?), ref: 00AB8FC5

SendMessageW.USER32(?,00001053), ref: 00AF6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00AF6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00AF6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00AF6FB7

Strings

0, xrefs: 00AF6DCF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: e7a4176402a4094714cf3aa47c97cdd910ced729ca2fc6d6805b40b92182b678
Instruction ID: 3db7a3611a2818cc1b0039826f74919013555ab0231e98a53c9140aab5e879e9
Opcode Fuzzy Hash: e7a4176402a4094714cf3aa47c97cdd910ced729ca2fc6d6805b40b92182b678
Instruction Fuzzy Hash: 40129E31200205EFD725DF68C944BB9BBF9FB44300F148469F6999B262CB35EC92DB91

Function 00B22711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00B2273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B2286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00B228A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00B228B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00B22900
GetClientRect.USER32(00000000,?), ref: 00B2290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00B22955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00B22964
GetStockObject.GDI32(00000011), ref: 00B22974
SelectObject.GDI32(00000000,00000000), ref: 00B22978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00B22988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B22991
DeleteDC.GDI32(00000000), ref: 00B2299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00B229C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00B229DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00B22A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00B22A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00B22A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00B22A77
GetStockObject.GDI32(00000011), ref: 00B22A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00B22A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00B22A97

Strings

static, xrefs: 00B2294F, 00B22A71
DISPLAY, xrefs: 00B2295A
AutoIt v3, xrefs: 00B228F8
msctls_progress32, xrefs: 00B22A13

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: cde8d1ed20af1e50b3bbbb4b9dbc2a2da497b6437412d6667c166bd855f65495
Instruction ID: 2da448dcdabc46b93cb06d07a6c08f88f151445bb0d052f39d928260d156357e
Opcode Fuzzy Hash: cde8d1ed20af1e50b3bbbb4b9dbc2a2da497b6437412d6667c166bd855f65495
Instruction Fuzzy Hash: 0AB17E71A00215BFEB14DFA8DC86EAE7BB9EB08710F104554F919EB2A1DB70ED40CB64

Function 00B14ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B14AED
GetDriveTypeW.KERNEL32(?,00B3CB68,?,\\.\,00B3CC08), ref: 00B14BCA
SetErrorMode.KERNEL32(00000000,00B3CB68,?,\\.\,00B3CC08), ref: 00B14D36

Strings

MMC, xrefs: 00B14CDE
SAS, xrefs: 00B14CC9
PhysicalDrive, xrefs: 00B14B76
ATAPI, xrefs: 00B14C91
RAMDisk, xrefs: 00B14BF4
Fibre, xrefs: 00B14CAD
ATA, xrefs: 00B14C98
SATA, xrefs: 00B14CD0
Removable, xrefs: 00B14C10, 00B14C15
Network, xrefs: 00B14C02
USB, xrefs: 00B14CB4
Virtual, xrefs: 00B14CE5
1394, xrefs: 00B14C9F
SSD, xrefs: 00B14C4A
RAID, xrefs: 00B14CBB
SSA, xrefs: 00B14CA6
iSCSI, xrefs: 00B14CC2
\\.\, xrefs: 00B14B3F
CDROM, xrefs: 00B14BFB
FileBackedVirtual, xrefs: 00B14CEC
SCSI, xrefs: 00B14C8A
Fixed, xrefs: 00B14C09
Unknown, xrefs: 00B14BED, 00B14C83

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: bf2003088989466343cc4c8683c902efd891c954d6e206f0062c7423cbf562f3
Instruction ID: aa5e35480434087a806baf32da070a510cc5be5324fdf25e885a76947ab3c825
Opcode Fuzzy Hash: bf2003088989466343cc4c8683c902efd891c954d6e206f0062c7423cbf562f3
Instruction Fuzzy Hash: 8461B030605106EBCB04DF24CAC1DEDB7E0EB46740BA484E5F806AB2A1DB39ED81DB81

Function 00B373E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00B37421
SetTextColor.GDI32(?,?), ref: 00B37425
GetSysColorBrush.USER32(0000000F), ref: 00B3743B
GetSysColor.USER32(0000000F), ref: 00B37446
CreateSolidBrush.GDI32(?), ref: 00B3744B
GetSysColor.USER32(00000011), ref: 00B37463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B37471
SelectObject.GDI32(?,00000000), ref: 00B37482
SetBkColor.GDI32(?,00000000), ref: 00B3748B
SelectObject.GDI32(?,?), ref: 00B37498
InflateRect.USER32(?,000000FF,000000FF), ref: 00B374B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B374CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00B374DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B3752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00B37554
InflateRect.USER32(?,000000FD,000000FD), ref: 00B37572
DrawFocusRect.USER32(?,?), ref: 00B3757D
GetSysColor.USER32(00000011), ref: 00B3758E
SetTextColor.GDI32(?,00000000), ref: 00B37596
DrawTextW.USER32(?,00B370F5,000000FF,?,00000000), ref: 00B375A8
SelectObject.GDI32(?,?), ref: 00B375BF
DeleteObject.GDI32(?), ref: 00B375CA
SelectObject.GDI32(?,?), ref: 00B375D0
DeleteObject.GDI32(?), ref: 00B375D5
SetTextColor.GDI32(?,?), ref: 00B375DB
SetBkColor.GDI32(?,?), ref: 00B375E5

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: b1475ddd7ac61a5495227a716da6cbf7d178da563d135b45fdb3dea0d48a0334
Instruction ID: aa7383f9480a977e2757e91727bb9c47e23097a32de8f9fbfed9978cac7c4882
Opcode Fuzzy Hash: b1475ddd7ac61a5495227a716da6cbf7d178da563d135b45fdb3dea0d48a0334
Instruction Fuzzy Hash: 80616A72900218AFDF119FA4DC49EEEBFB9EB08320F214155F915BB2A1DB75A940DB90

Function 00B30FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B31128
GetDesktopWindow.USER32 ref: 00B3113D
GetWindowRect.USER32(00000000), ref: 00B31144
GetWindowLongW.USER32(?,000000F0), ref: 00B31199
DestroyWindow.USER32(?), ref: 00B311B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B311ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B3120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B3121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00B31232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00B31245
IsWindowVisible.USER32(00000000), ref: 00B312A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00B312BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00B312D0
GetWindowRect.USER32(00000000,?), ref: 00B312E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00B3130E
GetMonitorInfoW.USER32(00000000,?), ref: 00B31328
CopyRect.USER32(?,?), ref: 00B3133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00B313AA

Strings

0, xrefs: 00B310D3
(, xrefs: 00B3131B
tooltips_class32, xrefs: 00B311E6

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 0ebf12fafd7e2e639366b1959a5e5b2137d13b965ebd020526d899df6447211a
Instruction ID: f1491cb685e7be85f2bef20a734a28651aa3c35138805a40feca7f3089243570
Opcode Fuzzy Hash: 0ebf12fafd7e2e639366b1959a5e5b2137d13b965ebd020526d899df6447211a
Instruction Fuzzy Hash: EBB17C71604341AFD704DF68C985B6FBBE8FF85350F108958F999AB2A1CB31E844CBA1

Function 00B30241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B302E5
_wcslen.LIBCMT ref: 00B3031F
_wcslen.LIBCMT ref: 00B30389
_wcslen.LIBCMT ref: 00B303F1
_wcslen.LIBCMT ref: 00B30475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00B304C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B30504

Part of subcall function 00ABF9F2: _wcslen.LIBCMT ref: 00ABF9FD

Part of subcall function 00B0223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B02258
Part of subcall function 00B0223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B0228A

Strings

GETITEMCOUNT, xrefs: 00B30316, 00B30337
GETSELECTEDCOUNT, xrefs: 00B30470, 00B3048B
GETTEXT, xrefs: 00B303EC, 00B30407
FINDITEM, xrefs: 00B30627
SELECT, xrefs: 00B30548
ISSELECTED, xrefs: 00B304DD
GETSUBITEMCOUNT, xrefs: 00B30384, 00B3039F
GETSELECTED, xrefs: 00B305E1
DESELECT, xrefs: 00B3059C
SELECTINVERT, xrefs: 00B3057E
SELECTALL, xrefs: 00B30515
VIEWCHANGE, xrefs: 00B30675
SELECTCLEAR, xrefs: 00B3052D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: b3c4995ba6b6d22b5ed693ec34f8b3f0a2ed47d456dcd311ca4a4410508ccff9
Instruction ID: 40b451e876e3b6ee317c33f50f5d7247cca0913c06761995e67cbef4a579ce1a
Opcode Fuzzy Hash: b3c4995ba6b6d22b5ed693ec34f8b3f0a2ed47d456dcd311ca4a4410508ccff9
Instruction Fuzzy Hash: 92E1A0312282018FC714EF24C9A196EB7E6FF98714F24499CF8969B3A6DB30ED45CB51

Function 00AB8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AB8968
GetSystemMetrics.USER32(00000007), ref: 00AB8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AB899B
GetSystemMetrics.USER32(00000008), ref: 00AB89A3
GetSystemMetrics.USER32(00000004), ref: 00AB89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00AB89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00AB89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00AB8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00AB8A3C
GetClientRect.USER32(00000000,000000FF), ref: 00AB8A5A
GetStockObject.GDI32(00000011), ref: 00AB8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AB8A81

Part of subcall function 00AB912D: GetCursorPos.USER32(?), ref: 00AB9141
Part of subcall function 00AB912D: ScreenToClient.USER32(00000000,?), ref: 00AB915E
Part of subcall function 00AB912D: GetAsyncKeyState.USER32(00000001), ref: 00AB9183
Part of subcall function 00AB912D: GetAsyncKeyState.USER32(00000002), ref: 00AB919D

SetTimer.USER32(00000000,00000000,00000028,00AB90FC), ref: 00AB8AA8

Strings

AutoIt v3 GUI, xrefs: 00AB8A20

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 73cd68d4cc20fedbcdd3051b590a793424f2f5e12337a0b8096157950b2776e8
Instruction ID: 7c2d173481e8de47f4fc9db8ef6e4b8cf86487ee16beed05953a8721c30ee8ab
Opcode Fuzzy Hash: 73cd68d4cc20fedbcdd3051b590a793424f2f5e12337a0b8096157950b2776e8
Instruction Fuzzy Hash: D3B16B71A00209AFDF14DFACCD46BEE7BB9FB48314F114229FA15A7291DB34A841CB61

Function 00B00D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B01114
Part of subcall function 00B010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B00B9B,?,?,?), ref: 00B01120
Part of subcall function 00B010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B00B9B,?,?,?), ref: 00B0112F
Part of subcall function 00B010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B00B9B,?,?,?), ref: 00B01136
Part of subcall function 00B010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B0114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B00DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B00E29
GetLengthSid.ADVAPI32(?), ref: 00B00E40
GetAce.ADVAPI32(?,00000000,?), ref: 00B00E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B00E96
GetLengthSid.ADVAPI32(?), ref: 00B00EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B00EB5
HeapAlloc.KERNEL32(00000000), ref: 00B00EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B00EDD
CopySid.ADVAPI32(00000000), ref: 00B00EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B00F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B00F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B00F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B00F6E
HeapFree.KERNEL32(00000000), ref: 00B00F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B00F7E
HeapFree.KERNEL32(00000000), ref: 00B00F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B00F8E
HeapFree.KERNEL32(00000000), ref: 00B00F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00B00FA1
HeapFree.KERNEL32(00000000), ref: 00B00FA8

Part of subcall function 00B01193: GetProcessHeap.KERNEL32(00000008,00B00BB1,?,00000000,?,00B00BB1,?), ref: 00B011A1
Part of subcall function 00B01193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B00BB1,?), ref: 00B011A8
Part of subcall function 00B01193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B00BB1,?), ref: 00B011B7

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 5eac7e96c5f6f5a758d2c1ee860c5dee6a93a85fc0a079908af8ea7dc2290ff8
Instruction ID: 3b82d2801aca08d53d167a615eec04e00b986dcc13c59de380610a65774f45a2
Opcode Fuzzy Hash: 5eac7e96c5f6f5a758d2c1ee860c5dee6a93a85fc0a079908af8ea7dc2290ff8
Instruction Fuzzy Hash: E6715B7290020AEBDB20AFA4DC48FAEBFB8FF05301F244195FA59B7191DB719905DB60

Function 00B2C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B2C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00B3CC08,00000000,?,00000000,?,?), ref: 00B2C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00B2C5A4
_wcslen.LIBCMT ref: 00B2C5F4
_wcslen.LIBCMT ref: 00B2C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00B2C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00B2C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00B2C84D
RegCloseKey.ADVAPI32(?), ref: 00B2C881
RegCloseKey.ADVAPI32(00000000), ref: 00B2C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00B2C960

Strings

REG_QWORD, xrefs: 00B2C8C3
REG_MULTI_SZ, xrefs: 00B2C6F5
REG_EXPAND_SZ, xrefs: 00B2C5CD
REG_BINARY, xrefs: 00B2C913
REG_DWORD, xrefs: 00B2C804
REG_SZ, xrefs: 00B2C644

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 42ab06c80dd17095be55f246e32f854624ba4ee65e9345ccc782bbf6820bb44f
Instruction ID: 1a4dbdb51c90855f2069d9a0fd21cc94dfd9595b7bafd2d53065c8e3765e5fb2
Opcode Fuzzy Hash: 42ab06c80dd17095be55f246e32f854624ba4ee65e9345ccc782bbf6820bb44f
Instruction Fuzzy Hash: C41278356042119FDB14EF14D991E2EBBE5EF89714F14889CF88A9B3A2DB31ED41CB81

Function 00B3091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B309C6
_wcslen.LIBCMT ref: 00B30A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B30A54
_wcslen.LIBCMT ref: 00B30A8A
_wcslen.LIBCMT ref: 00B30B06
_wcslen.LIBCMT ref: 00B30B81

Part of subcall function 00ABF9F2: _wcslen.LIBCMT ref: 00ABF9FD

Part of subcall function 00B02BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B02BFA

Strings

GETSELECTED, xrefs: 00B30C4E
ISCHECKED, xrefs: 00B30CE1
COLLAPSE, xrefs: 00B30B01, 00B30B1C
GETITEMCOUNT, xrefs: 00B30C1E
GETTEXT, xrefs: 00B30C97
GETTOTALCOUNT, xrefs: 00B309F2, 00B30A17
EXPAND, xrefs: 00B30BF8
UNCHECK, xrefs: 00B30D3E
SELECT, xrefs: 00B30D11
CHECK, xrefs: 00B30A85, 00B30AA0
EXISTS, xrefs: 00B30B7C, 00B30B97

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 517c781cf118395427ac96ab8dffb7335f5ea317bb7e007d751fa46cfa4d73c6
Instruction ID: 223c2041871d91c53dbc0e987ddcfc94b269ecd9ff45a1bf41b3d5ee708cabf2
Opcode Fuzzy Hash: 517c781cf118395427ac96ab8dffb7335f5ea317bb7e007d751fa46cfa4d73c6
Instruction Fuzzy Hash: CFE19E352183019FC714EF24C5A096AB7E1FF99714F2489ACF8969B3A2DB31ED45CB81

Function 00B2C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2B6AE,?,?), ref: 00B2C9B5
_wcslen.LIBCMT ref: 00B2C9F1
_wcslen.LIBCMT ref: 00B2CA68
_wcslen.LIBCMT ref: 00B2CA9E
_wcslen.LIBCMT ref: 00B2CAF9
_wcslen.LIBCMT ref: 00B2CB2F
_wcslen.LIBCMT ref: 00B2CB7F

Strings

HKCR, xrefs: 00B2CB29, 00B2CB2E
HKLM, xrefs: 00B2CA98, 00B2CA9D
HKCU, xrefs: 00B2CBCE
HKEY_CURRENT_USER, xrefs: 00B2CBBD
HKCC, xrefs: 00B2CBAC
HKEY_LOCAL_MACHINE, xrefs: 00B2CA62, 00B2CA67
HKU, xrefs: 00B2CBF0
HKEY_CURRENT_CONFIG, xrefs: 00B2CB79, 00B2CB7E
HKEY_CLASSES_ROOT, xrefs: 00B2CAF3, 00B2CAF8
HKEY_USERS, xrefs: 00B2CBDF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 79e3de7ea057186b5b56dd668669cb8998a435ba4a065050321b7abd2a631523
Instruction ID: 79e1a1e8ef10d396728ac4626a540eac3ad9546544b83b75be4aa1ed6b820797
Opcode Fuzzy Hash: 79e3de7ea057186b5b56dd668669cb8998a435ba4a065050321b7abd2a631523
Instruction Fuzzy Hash: 4971143360013A8BCB20DE7CED515BE3BD1EF65754B2505A8F86E97288EA35CD4583A0

Function 00B3833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B3835A
_wcslen.LIBCMT ref: 00B3836E
_wcslen.LIBCMT ref: 00B38391
_wcslen.LIBCMT ref: 00B383B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00B383F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00B35BF2), ref: 00B3844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B38487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00B384CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B38501
FreeLibrary.KERNEL32(?), ref: 00B3850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B3851D
DestroyIcon.USER32(?,?,?,?,?,00B35BF2), ref: 00B3852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B38549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00B38555

Strings

.dll, xrefs: 00B383AB
.icl, xrefs: 00B38368
.exe, xrefs: 00B38388

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 09340dcf26eddd2cb59835af932ef2413c64fb7faee89553634e0f066b1bbce1
Instruction ID: dfffb13f4189ad98b1e1a2abc5ae5a877a2663d978d20cfab76abba7aafa3e8b
Opcode Fuzzy Hash: 09340dcf26eddd2cb59835af932ef2413c64fb7faee89553634e0f066b1bbce1
Instruction Fuzzy Hash: FF61B071540315BAEB14DF64CC85BBE7BA8FB18B11F204689F815E61D1DF74A984CBA0

Function 00AA7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

Bad directive syntax error, xrefs: 00AE519A
', xrefs: 00AE5169
#notrayicon, xrefs: 00AA77E7
#include, xrefs: 00AA7847
#requireadmin, xrefs: 00AA77FF
#comments-start, xrefs: 00AA785F, 00AA78B1
Unterminated group of comments, xrefs: 00AE528C
#pragma compile, xrefs: 00AA77D3
", xrefs: 00AE5153
#comments-end, xrefs: 00AA78D9
#include-once, xrefs: 00AA782F
#ce, xrefs: 00AA78ED
#OnAutoItStartRegister, xrefs: 00AA7817
#cs, xrefs: 00AA7873, 00AA78C5
Cannot parse #include, xrefs: 00AE5279

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 3d4f4d07ea606bc5f031e38a6b5972a9d0f15d8cd5d30dfceb8ee628e1e9de0b
Instruction ID: 8dbea50abb69914d29e20ed40b8853977e1cc17df4de729d1b759e88f74a9a81
Opcode Fuzzy Hash: 3d4f4d07ea606bc5f031e38a6b5972a9d0f15d8cd5d30dfceb8ee628e1e9de0b
Instruction Fuzzy Hash: 5E81E071A04605BBDB20BF61DD42FBF3BA8AF16300F144068F905AB1E2EB74DA51D7A1

Function 00B05A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00B05A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B05A40
SetWindowTextW.USER32(?,?), ref: 00B05A57
GetDlgItem.USER32(?,000003EA), ref: 00B05A6C
SetWindowTextW.USER32(00000000,?), ref: 00B05A72
GetDlgItem.USER32(?,000003E9), ref: 00B05A82
SetWindowTextW.USER32(00000000,?), ref: 00B05A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B05AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B05AC3
GetWindowRect.USER32(?,?), ref: 00B05ACC
_wcslen.LIBCMT ref: 00B05B33
SetWindowTextW.USER32(?,?), ref: 00B05B6F
GetDesktopWindow.USER32 ref: 00B05B75
GetWindowRect.USER32(00000000), ref: 00B05B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00B05BD3
GetClientRect.USER32(?,?), ref: 00B05BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00B05C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B05C2F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: b2d45f339abeae7d27845a061069970e28eef44f9a7b4d3da57a7d986c9b0d40
Instruction ID: 55e0f34dcd3ec3d68e8cb1b7528f755a139f81548483d271a8adf626d2bec9e2
Opcode Fuzzy Hash: b2d45f339abeae7d27845a061069970e28eef44f9a7b4d3da57a7d986c9b0d40
Instruction Fuzzy Hash: 1A712B31A00A09AFDB20DFA8CE85AAFBFF5FB48704F104558E546A39A0DB75A944CF50

Function 00AC00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00AC00C6

Part of subcall function 00AC00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00B7070C,00000FA0,CEB5C50F,?,?,?,?,00AE23B3,000000FF), ref: 00AC011C
Part of subcall function 00AC00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00AE23B3,000000FF), ref: 00AC0127
Part of subcall function 00AC00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00AE23B3,000000FF), ref: 00AC0138
Part of subcall function 00AC00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00AC014E
Part of subcall function 00AC00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00AC015C
Part of subcall function 00AC00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00AC016A
Part of subcall function 00AC00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00AC0195
Part of subcall function 00AC00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00AC01A0

___scrt_fastfail.LIBCMT ref: 00AC00E7

Part of subcall function 00AC00A3: __onexit.LIBCMT ref: 00AC00A9

Strings

InitializeConditionVariable, xrefs: 00AC0148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00AC0122
SleepConditionVariableCS, xrefs: 00AC0154
WakeAllConditionVariable, xrefs: 00AC0162
kernel32.dll, xrefs: 00AC0133

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 1bbcc0dddaee409825f7902dcbe6d59c1b8750ccc0e2ba66051c94a336f1eddf
Instruction ID: 3880327048e2ebea9f22216e6ad0ffcf3baa7dba3986164c54bb48260e8a4762
Opcode Fuzzy Hash: 1bbcc0dddaee409825f7902dcbe6d59c1b8750ccc0e2ba66051c94a336f1eddf
Instruction Fuzzy Hash: DC21A732A44711EBD7116BA4AD09F7E77E8EB05B51F26063EF815B72A1DFB49C008B90

Function 00B030F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B0318D
_wcslen.LIBCMT ref: 00B031F8

Strings

TEXT, xrefs: 00B0347C
INSTANCE, xrefs: 00B03453
REGEXPCLASS, xrefs: 00B03255, 00B03266
CLASS, xrefs: 00B03188, 00B031A5
NAME, xrefs: 00B03335, 00B03346
CLASSNN, xrefs: 00B031F3, 00B03204

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 3304d2ec3669d875fce7249e1a0e438f22c86789875a23589470944de72796ad
Instruction ID: ed097928b575314d7df5907ebfa460d98f3720301f5d6b45491e59897201bcae
Opcode Fuzzy Hash: 3304d2ec3669d875fce7249e1a0e438f22c86789875a23589470944de72796ad
Instruction Fuzzy Hash: DBE1F532A005169BCB24DF64C899BEEBFF8FF54B10F548199E456B72D0DB30AE858790

Function 00B144C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00B3CC08), ref: 00B14527
_wcslen.LIBCMT ref: 00B1453B
_wcslen.LIBCMT ref: 00B14599
_wcslen.LIBCMT ref: 00B145F4
_wcslen.LIBCMT ref: 00B1463F
_wcslen.LIBCMT ref: 00B146A7

Part of subcall function 00ABF9F2: _wcslen.LIBCMT ref: 00ABF9FD

GetDriveTypeW.KERNEL32(?,00B66BF0,00000061), ref: 00B14743

Strings

removable, xrefs: 00B145EA, 00B145EF
network, xrefs: 00B1469D, 00B146A2
cdrom, xrefs: 00B1458F, 00B14594
ramdisk, xrefs: 00B146F1
fixed, xrefs: 00B14635, 00B1463A
all, xrefs: 00B14531, 00B14536
unknown, xrefs: 00B14708

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: fcf8b66068e4d4b83e6b227c67d25de8248506e168c30049e22c1987ca6a096d
Instruction ID: d89c382d928050e8b52ef93eb7a63cc2c8ef6a6611395bba3f80d18af6e703e6
Opcode Fuzzy Hash: fcf8b66068e4d4b83e6b227c67d25de8248506e168c30049e22c1987ca6a096d
Instruction Fuzzy Hash: 31B1F1316083029FC710DF28C991AAEB7E5EFA6764F94499DF496C7291D730DC84CBA2

Function 00AA326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00B71990), ref: 00AE2F8D
GetMenuItemCount.USER32(00B71990), ref: 00AE303D
GetCursorPos.USER32(?), ref: 00AE3081
SetForegroundWindow.USER32(00000000), ref: 00AE308A
TrackPopupMenuEx.USER32(00B71990,00000000,?,00000000,00000000,00000000), ref: 00AE309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00AE30A9

Strings

0, xrefs: 00AA327D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 6a57a6104af654cc3026503577331ebd57aee3330a0683d4761e8e895b5d0d99
Instruction ID: d874314966aa69529ed1ed9fde3d7ee3c27e2e8a13a025e3f45928f66591bd03
Opcode Fuzzy Hash: 6a57a6104af654cc3026503577331ebd57aee3330a0683d4761e8e895b5d0d99
Instruction Fuzzy Hash: 73710631640255BEEB259F69CC49FAABF78FF05324F204216F5156B1E0CBB1AD64CB90

Function 00B36CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00B36DEB

Part of subcall function 00AA6B57: _wcslen.LIBCMT ref: 00AA6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B36E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B36E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B36E94
DestroyWindow.USER32(?), ref: 00B36EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00AA0000,00000000), ref: 00B36EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B36EFD
GetDesktopWindow.USER32 ref: 00B36F16
GetWindowRect.USER32(00000000), ref: 00B36F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B36F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B36F4D

Part of subcall function 00AB9944: GetWindowLongW.USER32(?,000000EB), ref: 00AB9952

Strings

0, xrefs: 00B36D98
tooltips_class32, xrefs: 00B36E58, 00B36EDD

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: e7861b2365d6f6b7966be562d362c2d5b3c1828061f89bf1fe8bfa479ff60593
Instruction ID: 23d329f0bf3936f2e9353836023f19859ba634ebdf3f3ed0c3463d5e82146b74
Opcode Fuzzy Hash: e7861b2365d6f6b7966be562d362c2d5b3c1828061f89bf1fe8bfa479ff60593
Instruction Fuzzy Hash: C1716974144244AFDB21CF18DC44FAABBE9FB89304F24485DFA9997261CB70A94ACB21

Function 00B3911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AB9BB2

DragQueryPoint.SHELL32(?,?), ref: 00B39147

Part of subcall function 00B37674: ClientToScreen.USER32(?,?), ref: 00B3769A
Part of subcall function 00B37674: GetWindowRect.USER32(?,?), ref: 00B37710
Part of subcall function 00B37674: PtInRect.USER32(?,?,00B38B89), ref: 00B37720

SendMessageW.USER32(?,000000B0,?,?), ref: 00B391B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B391BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B391DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B39225
SendMessageW.USER32(?,000000B0,?,?), ref: 00B3923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00B39255
SendMessageW.USER32(?,000000B1,?,?), ref: 00B39277
DragFinish.SHELL32(?), ref: 00B3927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00B39371

Strings

@GUI_DRAGFILE, xrefs: 00B39320
@GUI_DRAGID, xrefs: 00B392E9
@GUI_DROPID, xrefs: 00B3929E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 533b368cbff0e5516c4fb5e6b065c5aa4fe0e8fa06dfa3cb232810f078642de2
Instruction ID: 3cc201f291b4bc4e08255ece6cac06a3900c96fdf1379a679e24b4e154aae94b
Opcode Fuzzy Hash: 533b368cbff0e5516c4fb5e6b065c5aa4fe0e8fa06dfa3cb232810f078642de2
Instruction Fuzzy Hash: 77618B71108301AFD701EFA4CD85DAFBBE8EF89750F10495DF595932A0DB709A49CB62

Function 00B1C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B1C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B1C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B1C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00B1C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00B1C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00B1C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B1C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B1C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B1C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B1C5F0
InternetCloseHandle.WININET(00000000), ref: 00B1C5FB

Strings

, xrefs: 00B1C575

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: fa123d51ce03974958a3aaa61aaf0699a3cd684db2dedd6d9dbaa4b5ba9b23a6
Instruction ID: bb39406c25a659e4cb6109f8dd77e7a99d9ef54157da8f8eb21655ff052abddd
Opcode Fuzzy Hash: fa123d51ce03974958a3aaa61aaf0699a3cd684db2dedd6d9dbaa4b5ba9b23a6
Instruction Fuzzy Hash: 775139B1540208BFEB218FA4C989ABB7FFDFB18754F504459F945E7210DB34EA889B60

Function 00B3856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00B38592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00B385A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00B385AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00B385BA
GlobalLock.KERNEL32(00000000), ref: 00B385C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00B385D7
GlobalUnlock.KERNEL32(00000000), ref: 00B385E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00B385E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00B385F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,00B3FC38,?), ref: 00B38611
GlobalFree.KERNEL32(00000000), ref: 00B38621
GetObjectW.GDI32(?,00000018,?), ref: 00B38641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00B38671
DeleteObject.GDI32(?), ref: 00B38699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00B386AF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: c68392a251a38c15dbf543eb89628b8f55c34152a450a644f35f03847f7dd728
Instruction ID: ff2bc5ff9811b92a73743e9ace7b5cd381af7941c91748e0732ce856c9241158
Opcode Fuzzy Hash: c68392a251a38c15dbf543eb89628b8f55c34152a450a644f35f03847f7dd728
Instruction Fuzzy Hash: A241F975600204BFDB119FA9DC89EAF7BB8FF89711F208059F905E7260DB30A901DB61

Function 00B114BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00B11502
VariantCopy.OLEAUT32(?,?), ref: 00B1150B
VariantClear.OLEAUT32(?), ref: 00B11517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00B115FB
VarR8FromDec.OLEAUT32(?,?), ref: 00B11657
VariantInit.OLEAUT32(?), ref: 00B11708
SysFreeString.OLEAUT32(?), ref: 00B1178C
VariantClear.OLEAUT32(?), ref: 00B117D8
VariantClear.OLEAUT32(?), ref: 00B117E7
VariantInit.OLEAUT32(00000000), ref: 00B11823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00B11625
Default, xrefs: 00B116AF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 5c46ac91ec5b800a4249eb61cd17c1325e446bbacf69bac1f70f845b0d5bf777
Instruction ID: 8c5ad28c79aa720c9b8e5e8031159b9e8b970bbc4ddd5b05b5e3f2ef64570fc9
Opcode Fuzzy Hash: 5c46ac91ec5b800a4249eb61cd17c1325e446bbacf69bac1f70f845b0d5bf777
Instruction Fuzzy Hash: 48D10071A00115DFDB009F69D884BBDB7F6FF45700FA48996E646AB281DB30DD80DB62

Function 00B2B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Part of subcall function 00B2C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2B6AE,?,?), ref: 00B2C9B5
Part of subcall function 00B2C998: _wcslen.LIBCMT ref: 00B2C9F1
Part of subcall function 00B2C998: _wcslen.LIBCMT ref: 00B2CA68
Part of subcall function 00B2C998: _wcslen.LIBCMT ref: 00B2CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B2B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B2B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00B2B80A
RegCloseKey.ADVAPI32(?), ref: 00B2B87E
RegCloseKey.ADVAPI32(?), ref: 00B2B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00B2B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B2B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00B2B922
FreeLibrary.KERNEL32(00000000), ref: 00B2B983
RegCloseKey.ADVAPI32(00000000), ref: 00B2B994

Strings

advapi32.dll, xrefs: 00B2B8ED
RegDeleteKeyExW, xrefs: 00B2B8FE

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: fe2b6cf588a7339fc861019072c6d2a6a0beec212bc45c99799d982eaf7d6392
Instruction ID: 59cfa3b45b4b9e76861ac4a6208571a83fee23ef164489f19e29ef57220c9e2f
Opcode Fuzzy Hash: fe2b6cf588a7339fc861019072c6d2a6a0beec212bc45c99799d982eaf7d6392
Instruction Fuzzy Hash: 3CC1AD34208211AFD714DF14D495F2ABBE5FF85318F14859CF5AA8B2A2CB35EC45CB92

Function 00B2255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B225D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00B225E8
CreateCompatibleDC.GDI32(?), ref: 00B225F4
SelectObject.GDI32(00000000,?), ref: 00B22601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00B2266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00B226AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00B226D0
SelectObject.GDI32(?,?), ref: 00B226D8
DeleteObject.GDI32(?), ref: 00B226E1
DeleteDC.GDI32(?), ref: 00B226E8
ReleaseDC.USER32(00000000,?), ref: 00B226F3

Strings

(, xrefs: 00B2268D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 1c3174244a4aa7321118c56efc3ec1e098c78cd0ef9a03d5cb36f8dbaad454bb
Instruction ID: 0468a31f6b0769d3ad4b7af101401ca0e79dae15469677c1a9765be8e8b82cfa
Opcode Fuzzy Hash: 1c3174244a4aa7321118c56efc3ec1e098c78cd0ef9a03d5cb36f8dbaad454bb
Instruction Fuzzy Hash: 9E61E076D00219EFCF15CFA4D884AAEBBF6FF48310F208569E959A7250D770A941DFA0

Function 00ADDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00ADDAA1

Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD659
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD66B
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD67D
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD68F
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD6A1
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD6B3
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD6C5
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD6D7
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD6E9
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD6FB
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD70D
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD71F
Part of subcall function 00ADD63C: _free.LIBCMT ref: 00ADD731

_free.LIBCMT ref: 00ADDA96

Part of subcall function 00AD29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000), ref: 00AD29DE
Part of subcall function 00AD29C8: GetLastError.KERNEL32(00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000,00000000), ref: 00AD29F0

_free.LIBCMT ref: 00ADDAB8
_free.LIBCMT ref: 00ADDACD
_free.LIBCMT ref: 00ADDAD8
_free.LIBCMT ref: 00ADDAFA
_free.LIBCMT ref: 00ADDB0D
_free.LIBCMT ref: 00ADDB1B
_free.LIBCMT ref: 00ADDB26
_free.LIBCMT ref: 00ADDB5E
_free.LIBCMT ref: 00ADDB65
_free.LIBCMT ref: 00ADDB82
_free.LIBCMT ref: 00ADDB9A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 7d28868e338698166caf376ad6b48eaa2fa987d1074762d58f3180a8002ef85c
Instruction ID: 4f7ea926a543a2a22f8b4991ce06f929a89b876ca3ef31f9d3908f1a7f405a2e
Opcode Fuzzy Hash: 7d28868e338698166caf376ad6b48eaa2fa987d1074762d58f3180a8002ef85c
Instruction Fuzzy Hash: 3A315A326046049FEB21AB38E945B6A7BE8FF50354F15841BE45ADB3A1DA30AC40DB20

Function 00B0365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00B0369C
_wcslen.LIBCMT ref: 00B036A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00B03797
GetClassNameW.USER32(?,?,00000400), ref: 00B0380C
GetDlgCtrlID.USER32(?), ref: 00B0385D
GetWindowRect.USER32(?,?), ref: 00B03882
GetParent.USER32(?), ref: 00B038A0
ScreenToClient.USER32(00000000), ref: 00B038A7
GetClassNameW.USER32(?,?,00000100), ref: 00B03921
GetWindowTextW.USER32(?,?,00000400), ref: 00B0395D

Strings

%s%u, xrefs: 00B03734

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 8e8307659e1ac03976a0771ef3244e6b9cf8d579f12713cd041c0c18f2043dbc
Instruction ID: d87411b69691b57a733e6b8f332d6a792b65c927e41bb804f83287298f2b101b
Opcode Fuzzy Hash: 8e8307659e1ac03976a0771ef3244e6b9cf8d579f12713cd041c0c18f2043dbc
Instruction Fuzzy Hash: 4E91AC71204706AFD718DF64C889FAABBECFF44750F108669F99A92190DB30EA45CB91

Function 00B04954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00B04994
GetWindowTextW.USER32(?,?,00000400), ref: 00B049DA
_wcslen.LIBCMT ref: 00B049EB
CharUpperBuffW.USER32(?,00000000), ref: 00B049F7
_wcsstr.LIBVCRUNTIME ref: 00B04A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00B04A64
GetWindowTextW.USER32(?,?,00000400), ref: 00B04A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00B04AE6
GetClassNameW.USER32(?,?,00000400), ref: 00B04B20
GetWindowRect.USER32(?,?), ref: 00B04B8B

Strings

ThumbnailClass, xrefs: 00B04A6F, 00B04AF1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 98eacfd26334c56c604d6ec9a0c89a47417827c143ac930c43f80e888d5c44ae
Instruction ID: 13bc76ba7465fb4f9f6cb2eed9a592567795b8f3cd96ee23bb977ab9810058b4
Opcode Fuzzy Hash: 98eacfd26334c56c604d6ec9a0c89a47417827c143ac930c43f80e888d5c44ae
Instruction Fuzzy Hash: E7919AB21082059FDB14DF14C985BAA7BE8FF84314F0484A9FE859A1D6EB30ED45CBA1

Function 00B38D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AB9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B38D5A
GetFocus.USER32 ref: 00B38D6A
GetDlgCtrlID.USER32(00000000), ref: 00B38D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00B38E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00B38ECF
GetMenuItemCount.USER32(?), ref: 00B38EEC
GetMenuItemID.USER32(?,00000000), ref: 00B38EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00B38F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00B38F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B38FA1

Strings

0, xrefs: 00B38E9F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 2823bd2174f4a2be19c8d912b0a5f552c5f9cac0937609fe6069f5c990c37f3e
Instruction ID: eb332ce1efe2d041a585da8d0ffa6cc87be4f909898e1caf531ba39e88c816d5
Opcode Fuzzy Hash: 2823bd2174f4a2be19c8d912b0a5f552c5f9cac0937609fe6069f5c990c37f3e
Instruction Fuzzy Hash: B281B1715043119FDB10DF24D885AAB7BE9FF88314F24099DF99997291DF30D905CBA2

Function 00B0DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00B0DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00B0DC46
_wcslen.LIBCMT ref: 00B0DC50
_wcsstr.LIBVCRUNTIME ref: 00B0DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00B0DCBC

Strings

\VarFileInfo\Translation, xrefs: 00B0DCB4
04090000, xrefs: 00B0DCF2
%u.%u.%u.%u, xrefs: 00B0DD9A
DefaultLangCodepage, xrefs: 00B0DD1F
StringFileInfo\, xrefs: 00B0DC8F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 6611a5e33c5795f6191bf1f8c3dd0070566dbbb0f3bf17a67f903b6dedff8061
Instruction ID: 901ebf4162676aef8f2f443ad2bfb7f31f8f463b339a937e820101e649da0c63
Opcode Fuzzy Hash: 6611a5e33c5795f6191bf1f8c3dd0070566dbbb0f3bf17a67f903b6dedff8061
Instruction Fuzzy Hash: B441F2329402047AEB14A7B49D47FFF7BACEF45750F2401AAF900A71D2EB74DA0197A4

Function 00B2CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B2CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00B2CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B2CD48

Part of subcall function 00B2CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00B2CCAA
Part of subcall function 00B2CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00B2CCBD
Part of subcall function 00B2CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B2CCCF
Part of subcall function 00B2CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B2CD05
Part of subcall function 00B2CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B2CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00B2CCF3

Strings

advapi32.dll, xrefs: 00B2CCB8
RegDeleteKeyExW, xrefs: 00B2CCC9

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: dbdb6772e94360bca0512b998d7fe2a87159f2a24b02cc5bc1937023009a40d5
Instruction ID: 7838cb6903a5f924481f965fa6745113aac2bde0cab1f578c7bcdeff596d1f3a
Opcode Fuzzy Hash: dbdb6772e94360bca0512b998d7fe2a87159f2a24b02cc5bc1937023009a40d5
Instruction Fuzzy Hash: F5316075901129BBD7208BA5EC88EFFBFBCEF45750F1001A5A909E3150DB749E459BE0

Function 00B13D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B13D40
_wcslen.LIBCMT ref: 00B13D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B13D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00B13DBE
RemoveDirectoryW.KERNEL32(?), ref: 00B13DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00B13E55
CloseHandle.KERNEL32(00000000), ref: 00B13E60
CloseHandle.KERNEL32(00000000), ref: 00B13E6B

Strings

:, xrefs: 00B13D82
\??\%s, xrefs: 00B13D5B
\, xrefs: 00B13D77

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 2b97d266fe6d95150cec3dacb2ada46c742945d45a9bf67699e4f7fe94b0e251
Instruction ID: 448a7ad0957a31ca58e857ff799f133353720dc30d789dc68e9d79f7aec84d91
Opcode Fuzzy Hash: 2b97d266fe6d95150cec3dacb2ada46c742945d45a9bf67699e4f7fe94b0e251
Instruction Fuzzy Hash: D8317272900219AADB219FA0DC89FEF37FCEF88B00F5041B5F505E61A0EB7497848B64

Function 00B0E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00B0E6B4

Part of subcall function 00ABE551: timeGetTime.WINMM(?,?,00B0E6D4), ref: 00ABE555

Sleep.KERNEL32(0000000A), ref: 00B0E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00B0E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00B0E727
SetActiveWindow.USER32 ref: 00B0E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B0E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00B0E773
Sleep.KERNEL32(000000FA), ref: 00B0E77E
IsWindow.USER32 ref: 00B0E78A
EndDialog.USER32(00000000), ref: 00B0E79B

Strings

BUTTON, xrefs: 00B0E719

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 24b03a8f9b61b2a2876aa5b0f947e0779a1aaac1eb35363b9d15875d4bce698c
Instruction ID: 134fef3bd5e57064a0d82d657ebb500ffa495942e30be31bd69149f261ee88fe
Opcode Fuzzy Hash: 24b03a8f9b61b2a2876aa5b0f947e0779a1aaac1eb35363b9d15875d4bce698c
Instruction Fuzzy Hash: 63215471200205AFEB116F64EC8AA293FA9F755749F241865F52AA31F1DF71DC409B24

Function 00B0E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B0EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B0EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B0EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B0EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B0EAA7

Strings

open , xrefs: 00B0EA0C
play PlayMe, xrefs: 00B0EAA2
status PlayMe mode, xrefs: 00B0EA58
play PlayMe wait, xrefs: 00B0EA91
alias PlayMe, xrefs: 00B0EA36
close PlayMe, xrefs: 00B0EA6E, 00B0EA9B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 6c87478377e0abad27980e7e5a24d55b54078b149a604a518e8177ece6a622e5
Instruction ID: 34f1d5f25e7704b4683ed99ae1c28e211296c9194f21ca2ebad29ca7d2c17a18
Opcode Fuzzy Hash: 6c87478377e0abad27980e7e5a24d55b54078b149a604a518e8177ece6a622e5
Instruction Fuzzy Hash: A5115131A5021979D720A7A2DD4ADFF6BBCEBDAB40F0408A97811A70E1EFB04905C9B0

Function 00B05CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00B05CE2
GetWindowRect.USER32(00000000,?), ref: 00B05CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00B05D59
GetDlgItem.USER32(?,00000002), ref: 00B05D69
GetWindowRect.USER32(00000000,?), ref: 00B05D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00B05DCF
GetDlgItem.USER32(?,000003E9), ref: 00B05DDD
GetWindowRect.USER32(00000000,?), ref: 00B05DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00B05E31
GetDlgItem.USER32(?,000003EA), ref: 00B05E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B05E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00B05E67

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: f56bda51698071005f64a4fa68896e40125b23875b01baa4f502be37e89438cd
Instruction ID: 92039f89740c11e052a3b3ce1699a35e1c87b415176f78b33361cae9e3203138
Opcode Fuzzy Hash: f56bda51698071005f64a4fa68896e40125b23875b01baa4f502be37e89438cd
Instruction Fuzzy Hash: 3151F0B1A00615AFDB18CFA8DD89AAE7BF5FB48300F248269F915E7690DB709D04CF50

Function 00AB8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AB8BE8,?,00000000,?,?,?,?,00AB8BBA,00000000,?), ref: 00AB8FC5

DestroyWindow.USER32(?), ref: 00AB8C81
KillTimer.USER32(00000000,?,?,?,?,00AB8BBA,00000000,?), ref: 00AB8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00AF6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00AB8BBA,00000000,?), ref: 00AF69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00AB8BBA,00000000,?), ref: 00AF69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00AB8BBA,00000000), ref: 00AF69D4
DeleteObject.GDI32(00000000), ref: 00AF69E6

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 7fa776ae05e6f1e4e1ebf9f32d40ea767aeab8020c459e3e5de953c065c3f5eb
Instruction ID: 9e5184c6bca5d058a503c63ec44e305c1e782e2a9f043552aa26e96b7fb6f30e
Opcode Fuzzy Hash: 7fa776ae05e6f1e4e1ebf9f32d40ea767aeab8020c459e3e5de953c065c3f5eb
Instruction Fuzzy Hash: F361BB71102604DFCB259F6CCA48BB97BF9FB41312F244919E2469B561CB79AC82DFA0

Function 00AB9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00AB9944: GetWindowLongW.USER32(?,000000EB), ref: 00AB9952

GetSysColor.USER32(0000000F), ref: 00AB9862

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 2156e6dab95dc5c70ba9e2fd449c6e6fa6efb6cdca77c593f57a307b2a55655c
Instruction ID: 0c017c3c925450e6086449b5906cfdd438faef52fff9802296cd533127536131
Opcode Fuzzy Hash: 2156e6dab95dc5c70ba9e2fd449c6e6fa6efb6cdca77c593f57a307b2a55655c
Instruction Fuzzy Hash: 05418131104644AFDB215FB89C85BFE3BB9AB06331F244659FAA6971E2DB319C42DB10

Function 00B096E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00AEF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00B09717
LoadStringW.USER32(00000000,?,00AEF7F8,00000001), ref: 00B09720

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00AEF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00B09742
LoadStringW.USER32(00000000,?,00AEF7F8,00000001), ref: 00B09745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00B09866

Strings

Line %d (File "%s"):, xrefs: 00B0978F
Line %d:, xrefs: 00B097A0
^ ERROR, xrefs: 00B097FB
%s (%d) : ==> %s: %s %s, xrefs: 00B0984A
Error: , xrefs: 00B0981D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: b90fde7132fc33c499dcc465d0d909b5634ce8e50ccf12b29070c1f269eed842
Instruction ID: 4139ed5cd460d3262e3aaf604147a6809ac7ab0b75eb8ad9298be75ca1cb2bf9
Opcode Fuzzy Hash: b90fde7132fc33c499dcc465d0d909b5634ce8e50ccf12b29070c1f269eed842
Instruction Fuzzy Hash: C6410872800219AACF05EBE0CE86EEEB7B8AF56340F604065F505771D2EF256F48CB61

Function 00B006DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA6B57: _wcslen.LIBCMT ref: 00AA6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B007A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B007BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B007DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B00804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00B0082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B00837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B0083C

Strings

SOFTWARE\Classes\, xrefs: 00B0070E
\CLSID, xrefs: 00B00724
\IPC$, xrefs: 00B00784

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: fc07668b800dea1318cfd2a8df17bd4426455825623cbaf869be8dcbc283386a
Instruction ID: 0d329d0fdb0e625a4cbc2ea10da6bbc89da128973738a71fad3dbbd6cbe19062
Opcode Fuzzy Hash: fc07668b800dea1318cfd2a8df17bd4426455825623cbaf869be8dcbc283386a
Instruction Fuzzy Hash: 9A41F872C10229ABDF15EFA4DD859EEBBB8FF14350F544169E901B71A1EB345E04CBA0

Function 00B23C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B23C5C
CoInitialize.OLE32(00000000), ref: 00B23C8A
CoUninitialize.OLE32 ref: 00B23C94
_wcslen.LIBCMT ref: 00B23D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00B23DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00B23ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00B23F0E
CoGetObject.OLE32(?,00000000,00B3FB98,?), ref: 00B23F2D
SetErrorMode.KERNEL32(00000000), ref: 00B23F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00B23FC4
VariantClear.OLEAUT32(?), ref: 00B23FD8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 79115baba27a021271bb2c53e8ed6a4f73855f70e2fe01951ed07e8cbd0d59d3
Instruction ID: 4241825de17bf51b2cdedf9fb8b71c111bfbcba3ed644f305fbca5924e040448
Opcode Fuzzy Hash: 79115baba27a021271bb2c53e8ed6a4f73855f70e2fe01951ed07e8cbd0d59d3
Instruction Fuzzy Hash: 65C168716083159FC700DF68D98492BBBE9FF89B44F1049ADF98A9B250DB34EE05CB52

Function 00B17A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B17AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00B17B8F
SHGetDesktopFolder.SHELL32(?), ref: 00B17BA3
CoCreateInstance.OLE32(00B3FD08,00000000,00000001,00B66E6C,?), ref: 00B17BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00B17C74
CoTaskMemFree.OLE32(?,?), ref: 00B17CCC
SHBrowseForFolderW.SHELL32(?), ref: 00B17D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00B17D7A
CoTaskMemFree.OLE32(00000000), ref: 00B17D81
CoTaskMemFree.OLE32(00000000), ref: 00B17DD6
CoUninitialize.OLE32 ref: 00B17DDC

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 5b8402b1b16daa3b4715c874d5b2730e264783fa59b7538e3f7a3f1fb2a2e754
Instruction ID: d5b5dd0354e07b97d52a469ad5ee55c577082fadf399434b1f8e24749558dc1d
Opcode Fuzzy Hash: 5b8402b1b16daa3b4715c874d5b2730e264783fa59b7538e3f7a3f1fb2a2e754
Instruction Fuzzy Hash: 04C11C75A04109AFCB14DFA4D894DAEBBF9FF48314B1484A9E416DB361DB30EE81CB90

Function 00B3541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00B35504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B35515
CharNextW.USER32(00000158), ref: 00B35544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00B35585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00B3559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B355AC

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: c0552a893833cae39d0648b51b11b82e01beb745cdc21e4a3a531e98fbaf2923
Instruction ID: c008b608e4153cbca7ccbb1d10288c2943ed8478218f9de43650e3649e45b911
Opcode Fuzzy Hash: c0552a893833cae39d0648b51b11b82e01beb745cdc21e4a3a531e98fbaf2923
Instruction Fuzzy Hash: 33617D71904608EFDF20DF94CC85AFE7BF9EB09721F204185F925AB291DB749A81DB60

Function 00AFFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00AFFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00AFFB08
VariantInit.OLEAUT32(?), ref: 00AFFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00AFFB3A
VariantCopy.OLEAUT32(?,?), ref: 00AFFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00AFFBA1
VariantClear.OLEAUT32(?), ref: 00AFFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00AFFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00AFFBCC
VariantClear.OLEAUT32(?), ref: 00AFFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00AFFBE9

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 9c0d882be65180f2c622fb02c002b73cdeac9e47b3b49ea3c978792474387cd6
Instruction ID: 0873df6aba09529039ea045da70713693a268488fb9f7f44e3b6363b81f4d0db
Opcode Fuzzy Hash: 9c0d882be65180f2c622fb02c002b73cdeac9e47b3b49ea3c978792474387cd6
Instruction Fuzzy Hash: 51412C35A00219AFDB10DFA8D8549BEBBB9FF48354F108069F956A7361DB30E945CBA0

Function 00B09C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B09CA1
GetAsyncKeyState.USER32(000000A0), ref: 00B09D22
GetKeyState.USER32(000000A0), ref: 00B09D3D
GetAsyncKeyState.USER32(000000A1), ref: 00B09D57
GetKeyState.USER32(000000A1), ref: 00B09D6C
GetAsyncKeyState.USER32(00000011), ref: 00B09D84
GetKeyState.USER32(00000011), ref: 00B09D96
GetAsyncKeyState.USER32(00000012), ref: 00B09DAE
GetKeyState.USER32(00000012), ref: 00B09DC0
GetAsyncKeyState.USER32(0000005B), ref: 00B09DD8
GetKeyState.USER32(0000005B), ref: 00B09DEA

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 90ebff0adedc83a53cc04a0868bfb9a75c81d2afd52b98cd30a9744e1554b292
Instruction ID: 44e36c53e1c1886a29d36523499e141d7cb878cf10cd77ff116bb1aabeaeed56
Opcode Fuzzy Hash: 90ebff0adedc83a53cc04a0868bfb9a75c81d2afd52b98cd30a9744e1554b292
Instruction Fuzzy Hash: 0541A8349447C969FF359664C8043B5BEE0EF11344F0481EADAC6575C3DBA59DC8C792

Function 00B2055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B205BC
inet_addr.WSOCK32(?), ref: 00B2061C
gethostbyname.WSOCK32(?), ref: 00B20628
IcmpCreateFile.IPHLPAPI ref: 00B20636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00B206C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00B206E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00B207B9
WSACleanup.WSOCK32 ref: 00B207BF

Strings

Ping, xrefs: 00B20676

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: bdcbcccf1f418798e25334c711b2455f236ccfb0de335fc225da06bbbe842480
Instruction ID: 8cf38cda3ecf98b7988d841ad342430bc6d59a26b650dad342f0b9c04ff0848c
Opcode Fuzzy Hash: bdcbcccf1f418798e25334c711b2455f236ccfb0de335fc225da06bbbe842480
Instruction Fuzzy Hash: DE918D356182119FD320EF15D988F1ABBE0EF49318F1485A9F4699B6A3CB30ED45CF91

Function 00B28CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00B28CF3

Part of subcall function 00B08E54: _wcslen.LIBCMT ref: 00B08E77

_wcslen.LIBCMT ref: 00B28D4E
_wcslen.LIBCMT ref: 00B28D9C
_wcslen.LIBCMT ref: 00B28DDC
_wcslen.LIBCMT ref: 00B28E6E

Strings

winapi, xrefs: 00B28D96, 00B28D9B
none, xrefs: 00B28E65, 00B28E6A
stdcall, xrefs: 00B28DD6, 00B28DDB
cdecl, xrefs: 00B28D48, 00B28D4D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 9bb7cb0cbfb5988f71200afe2936ae657db64eb6d3b69a110082212a405b61f0
Instruction ID: 147591e9ae92f377a954fdf8f6541026d46c1be025b75ad190b51fe1e3a849d7
Opcode Fuzzy Hash: 9bb7cb0cbfb5988f71200afe2936ae657db64eb6d3b69a110082212a405b61f0
Instruction Fuzzy Hash: 4151C332A011269BCB14EF6CD9909BEB7E5FF65364B2142A9E42AE72C4DF34DD40C790

Function 00B2372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00B23774
CoUninitialize.OLE32 ref: 00B2377F
CoCreateInstance.OLE32(?,00000000,00000017,00B3FB78,?), ref: 00B237D9
IIDFromString.OLE32(?,?), ref: 00B2384C
VariantInit.OLEAUT32(?), ref: 00B238E4
VariantClear.OLEAUT32(?), ref: 00B23936

Strings

Invalid parameter, xrefs: 00B23865
Failed to create object, xrefs: 00B237E4, 00B2389A
NULL Pointer assignment, xrefs: 00B2381E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: c0f7ea92fbb54c4d05135b43229d30434729a5b583de5468f6db4eed81532f1e
Instruction ID: 7cfc4cd6bf232c993c8a79c62dffd5db934eb5fb6ebcaf3537418567bb71e3bf
Opcode Fuzzy Hash: c0f7ea92fbb54c4d05135b43229d30434729a5b583de5468f6db4eed81532f1e
Instruction Fuzzy Hash: EA61C370608311AFD710DF54D888F6EBBE8EF49B14F104889F5899B2A1D774EE48CB92

Function 00B18195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B18257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B18267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00B18273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B18310
SetCurrentDirectoryW.KERNEL32(?), ref: 00B18324
SetCurrentDirectoryW.KERNEL32(?), ref: 00B18356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B1838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00B18395

Strings

*.*, xrefs: 00B1839B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 000798120dfae5a995e1357b9b35f6b85fcca76af0153e45d624bcef287bfa64
Instruction ID: fcdd8be76debd1d10b72597b7a4f3a211f0e307830f744f09ccb6ad029fbacf2
Opcode Fuzzy Hash: 000798120dfae5a995e1357b9b35f6b85fcca76af0153e45d624bcef287bfa64
Instruction Fuzzy Hash: 86618A725043059FCB10EF60D8809AFB3E8FF8A310F44896EF99993291DB31E945CB92

Function 00B13388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00B133CF

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00B133F0

Strings

Line %d (File "%s"):, xrefs: 00B13443, 00B1345C
"%s" (%d) : ==> %s:%s%s, xrefs: 00B13504
Incorrect parameters to object property !, xrefs: 00B134AB
^ ERROR , xrefs: 00B1349E
"%s" (%d) : ==> %s:, xrefs: 00B13522
Error: , xrefs: 00B134D1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 9030b48040d0946cf4fe242fa9a67ffbce01e701d8f6ebd41623aa95c5abaa55
Instruction ID: 05253d418f275b21e94f836b8d27065ee057647b405310bc680147d48da5728e
Opcode Fuzzy Hash: 9030b48040d0946cf4fe242fa9a67ffbce01e701d8f6ebd41623aa95c5abaa55
Instruction Fuzzy Hash: E6517D32900209AADF15EBA0CE42EEEB7B9EF15740F1440A5F405731A2EF252F98DB61

Function 00B0B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B0B5FC
_wcslen.LIBCMT ref: 00B0B608
_wcslen.LIBCMT ref: 00B0B64D
_wcslen.LIBCMT ref: 00B0B68C
_wcslen.LIBCMT ref: 00B0B6C7

Strings

KEYS, xrefs: 00B0B647, 00B0B64C
APPEND, xrefs: 00B0B6C1, 00B0B6C6
REMOVE, xrefs: 00B0B602, 00B0B607
EXISTS, xrefs: 00B0B686, 00B0B68B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 848cf60a9244d687d6ac55120a113323ec4dd3578331237e67791018393c51ef
Instruction ID: 7808186bf861b1d33259ba05e571ae80a088ffc3b4f3219d6822ebf950d668c3
Opcode Fuzzy Hash: 848cf60a9244d687d6ac55120a113323ec4dd3578331237e67791018393c51ef
Instruction Fuzzy Hash: 0641A532A001279ACB205F7DC990DBEBFE5EB65B54B2542A9E421D72C4E736CD81C790

Function 00B15393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B153A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00B15416
GetLastError.KERNEL32 ref: 00B15420
SetErrorMode.KERNEL32(00000000,READY), ref: 00B154A7

Strings

UNKNOWN, xrefs: 00B15444
READONLY, xrefs: 00B15452
NOTREADY, xrefs: 00B1544B
INVALID, xrefs: 00B15459
READY, xrefs: 00B15460, 00B15468

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 80cef1c4f5e22d4cc427060d6489264125ee65d56c39d30b3f114f59d07f7727
Instruction ID: 6392d5eee1b15aad717b57d33fe3eb11566819b8ebe4d8af1fe80ba6656bc61c
Opcode Fuzzy Hash: 80cef1c4f5e22d4cc427060d6489264125ee65d56c39d30b3f114f59d07f7727
Instruction Fuzzy Hash: 74316B35A00608DFD720DF68C984AEABBF4EB89305F5480A9E4059B396DB75DDC6CB90

Function 00B33C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00B33C79
SetMenu.USER32(?,00000000), ref: 00B33C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B33D10
IsMenu.USER32(?), ref: 00B33D24
CreatePopupMenu.USER32 ref: 00B33D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B33D5B
DrawMenuBar.USER32 ref: 00B33D63

Strings

F, xrefs: 00B33D4E
0, xrefs: 00B33C54

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: b0e77bdbf1b7e7bad5afe80fb031d12a0c1b2f0570d7dc902ee8a8f10b9afbf1
Instruction ID: 6fe8ad00208ae50ffb35635246b2cb8ffbd97fc364c551bdc76717f5f055fc24
Opcode Fuzzy Hash: b0e77bdbf1b7e7bad5afe80fb031d12a0c1b2f0570d7dc902ee8a8f10b9afbf1
Instruction Fuzzy Hash: 9B415979A01209EFDB14CFA4D884AAA7BF5FF49750F240069F956A7360DB30AA10CF94

Function 00B33A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B33A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B33AA0
GetWindowLongW.USER32(?,000000F0), ref: 00B33AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B33AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B33B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00B33BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00B33BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00B33BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00B33BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00B33C13

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 1655ac528b4c1f463bb8d73bc40c5c0a2560b1b4337a20d82b35d892d7d9daf7
Instruction ID: 43550e28db9462a36894656565aa91c1de961f7cbab2e63db251fc4337638358
Opcode Fuzzy Hash: 1655ac528b4c1f463bb8d73bc40c5c0a2560b1b4337a20d82b35d892d7d9daf7
Instruction Fuzzy Hash: 9A616C75900248AFDB10DFA8CC81EEE77F8EB09700F204199FA15A72A1D774AE46DB60

Function 00B0B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B0B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B0A1E1,?,00000001), ref: 00B0B165
GetWindowThreadProcessId.USER32(00000000), ref: 00B0B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B0A1E1,?,00000001), ref: 00B0B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B0B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00B0A1E1,?,00000001), ref: 00B0B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B0A1E1,?,00000001), ref: 00B0B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B0A1E1,?,00000001), ref: 00B0B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00B0A1E1,?,00000001), ref: 00B0B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00B0A1E1,?,00000001), ref: 00B0B21D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: bfd8bddcbf874af3358dc645bee2f06710f075fc4120585ad94ca8696072b662
Instruction ID: f828a6efe0b6224f8d315fdc93c481f9b003578d192e98e80f5bc796a1c6e80f
Opcode Fuzzy Hash: bfd8bddcbf874af3358dc645bee2f06710f075fc4120585ad94ca8696072b662
Instruction Fuzzy Hash: 6331BB75500204BFDB109F64DC99F6D7FE9FB61711F204444FA09E72A0DBB49A808F60

Function 00AD2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AD2C94

Part of subcall function 00AD29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000), ref: 00AD29DE
Part of subcall function 00AD29C8: GetLastError.KERNEL32(00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000,00000000), ref: 00AD29F0

_free.LIBCMT ref: 00AD2CA0
_free.LIBCMT ref: 00AD2CAB
_free.LIBCMT ref: 00AD2CB6
_free.LIBCMT ref: 00AD2CC1
_free.LIBCMT ref: 00AD2CCC
_free.LIBCMT ref: 00AD2CD7
_free.LIBCMT ref: 00AD2CE2
_free.LIBCMT ref: 00AD2CED
_free.LIBCMT ref: 00AD2CFB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fc1f23af8225f1cb4c6a8582a12060def63c37c818515792999fd4dd6b364103
Instruction ID: 93f821a3d387b2fed8cd12f8de1afcb0d2c68ec430a16f332394738d3f068037
Opcode Fuzzy Hash: fc1f23af8225f1cb4c6a8582a12060def63c37c818515792999fd4dd6b364103
Instruction Fuzzy Hash: B311A476500108AFCB02EF54DA92EDD3BA5FF55350F4144A6FA4A9F322DA31EE50EB90

Function 00B17DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B17FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00B17FC1
GetFileAttributesW.KERNEL32(?), ref: 00B17FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00B18005
SetCurrentDirectoryW.KERNEL32(?), ref: 00B18017
SetCurrentDirectoryW.KERNEL32(?), ref: 00B18060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B180B0

Strings

*.*, xrefs: 00B18066

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: c3b0804768bef94746a35818716a131203d013c762b1b3e5a06efe0d591f3a57
Instruction ID: 8e4486b25b937188d30b5711701bae2e1aa679db66f5d046c74c4731e09fd2f9
Opcode Fuzzy Hash: c3b0804768bef94746a35818716a131203d013c762b1b3e5a06efe0d591f3a57
Instruction Fuzzy Hash: FC8191725482459BCB20EF54C8849EEB7E8FF89310F9448AEF885D7250DF35DD858B92

Function 00AA5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00AA5C7A

Part of subcall function 00AA5D0A: GetClientRect.USER32(?,?), ref: 00AA5D30
Part of subcall function 00AA5D0A: GetWindowRect.USER32(?,?), ref: 00AA5D71
Part of subcall function 00AA5D0A: ScreenToClient.USER32(?,?), ref: 00AA5D99

GetDC.USER32 ref: 00AE46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00AE4708
SelectObject.GDI32(00000000,00000000), ref: 00AE4716
SelectObject.GDI32(00000000,00000000), ref: 00AE472B
ReleaseDC.USER32(?,00000000), ref: 00AE4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00AE47C4

Strings

U, xrefs: 00AE4693

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: c8b25a79d1fbb73b852a0011ce745f2a953a636b4e6ef678208368ee458808d5
Instruction ID: 89d5d0fbada04375cd68a8fc7fe77692dd1687571eca60d8b70602d4d8073464
Opcode Fuzzy Hash: c8b25a79d1fbb73b852a0011ce745f2a953a636b4e6ef678208368ee458808d5
Instruction Fuzzy Hash: 1B71F330800245DFCF218F69C984ABA7BB9FF4E360F244269ED555B1AAC7318C81DFA0

Function 00B1359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00B135E4

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

LoadStringW.USER32(00B72390,?,00000FFF,?), ref: 00B1360A

Strings

Line %d (File "%s"):, xrefs: 00B1366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00B13724
^ ERROR, xrefs: 00B136C9
"%s" (%d) : ==> %s:, xrefs: 00B13742
Error: , xrefs: 00B136EF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 6f48142a47fc33b8a757956566b51b4ea0032080160cdc384bcb5e68ea0f0601
Instruction ID: f26487777b1d8bdf11e09a851b55d9fd3c5a3f5355255d67c10a6794628414e5
Opcode Fuzzy Hash: 6f48142a47fc33b8a757956566b51b4ea0032080160cdc384bcb5e68ea0f0601
Instruction Fuzzy Hash: BB515C72800219BADF15EBA0CD42EEEBBB8EF15740F5441A5F105731E2EB311A99DFA1

Function 00B38B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AB9BB2

Part of subcall function 00AB912D: GetCursorPos.USER32(?), ref: 00AB9141
Part of subcall function 00AB912D: ScreenToClient.USER32(00000000,?), ref: 00AB915E
Part of subcall function 00AB912D: GetAsyncKeyState.USER32(00000001), ref: 00AB9183
Part of subcall function 00AB912D: GetAsyncKeyState.USER32(00000002), ref: 00AB919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00B38B6B
ImageList_EndDrag.COMCTL32 ref: 00B38B71
ReleaseCapture.USER32 ref: 00B38B77
SetWindowTextW.USER32(?,00000000), ref: 00B38C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00B38C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00B38CFF

Strings

@GUI_DRAGFILE, xrefs: 00B38C9A
@GUI_DROPID, xrefs: 00B38C51

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 06a2e274adac67ba008fd1347209226d9d8a2676cabc997e3a6ab757782fcc61
Instruction ID: d425e0d210f15a883bf9f6cfabeae05e8c6ad4c83ea16863b527bf02a15b183c
Opcode Fuzzy Hash: 06a2e274adac67ba008fd1347209226d9d8a2676cabc997e3a6ab757782fcc61
Instruction Fuzzy Hash: 42518B71104300AFD704DF18DD56FAE77E4FB88714F500A69F956672E1CB70A945CB62

Function 00B1C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B1C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B1C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B1C2CA
GetLastError.KERNEL32 ref: 00B1C322
SetEvent.KERNEL32(?), ref: 00B1C336
InternetCloseHandle.WININET(00000000), ref: 00B1C341

Strings

, xrefs: 00B1C2BB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: cbf778069a762725faf658f4a544b648c881a889e92dafbed7f2cd3bba2ccd67
Instruction ID: 8271e2d11ca4e858e3f9677198af3a5510d3cc52218806498244ae4f6589daf9
Opcode Fuzzy Hash: cbf778069a762725faf658f4a544b648c881a889e92dafbed7f2cd3bba2ccd67
Instruction Fuzzy Hash: EE317FB1540204AFD7219FA59C88AEF7FFCEB49744B50855DF456E3200DB30DD849B65

Function 00B0989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00AE3AAF,?,?,Bad directive syntax error,00B3CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00B098BC
LoadStringW.USER32(00000000,?,00AE3AAF,?), ref: 00B098C3

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00B09987

Strings

Line %d (File "%s"):, xrefs: 00B0992D
Error: , xrefs: 00B09955
Line %d:, xrefs: 00B09912
., xrefs: 00B0996D
%s (%d) : ==> %s.: %s %s, xrefs: 00B098F1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: c623e4a56bfc52ac4870c1eb0c4dce714c5479933dd7946d909dde1ca8d89163
Instruction ID: 1c968eb40666d058885000ce93ef3a7ea129c8083ef5a64f8b69b58a4f325e8f
Opcode Fuzzy Hash: c623e4a56bfc52ac4870c1eb0c4dce714c5479933dd7946d909dde1ca8d89163
Instruction Fuzzy Hash: E921603280021AAFCF16AF90CD06EEE7BB9FF19700F044495F515660E2EF759A18DB61

Function 00B0209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00B020AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00B020C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B0214D

Strings

SHELLDLL_DefView, xrefs: 00B020CC
list, xrefs: 00B0212F
largeicons, xrefs: 00B020E1
smallicons, xrefs: 00B02115
details, xrefs: 00B020FB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 1d0c2778dd22c003b004193c32c08d0f5fa787481da9d918537f4b7230a065b1
Instruction ID: 29d072581c973372328c6f2fc84c4f58d75490a84719efb22cdb2cf338e03dc9
Opcode Fuzzy Hash: 1d0c2778dd22c003b004193c32c08d0f5fa787481da9d918537f4b7230a065b1
Instruction Fuzzy Hash: CA112976688706B9FA252720DC0FDEA7BDCCF09364F21019AFB04B60E1FE65685A5618

Function 00AD8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c387b715740f6e6d184f25bdf7b9f0cb1af56f3b44ff28215958a4f91e215b
Instruction ID: 5fa911cc808a6f814534c00d48f03339f712f44f9340dbd1754bbebf117d8a22
Opcode Fuzzy Hash: 97c387b715740f6e6d184f25bdf7b9f0cb1af56f3b44ff28215958a4f91e215b
Instruction Fuzzy Hash: 68C1E574904349AFDF11EFA8D841BEEBBB1BF19310F14405AE51AAB392CB34D941CB61

Function 00ADCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00ADCEB7
_free.LIBCMT ref: 00ADCF22
_free.LIBCMT ref: 00ADCF48
_free.LIBCMT ref: 00ADCF71
_free.LIBCMT ref: 00ADCFA9
_free.LIBCMT ref: 00ADCFDA
_free.LIBCMT ref: 00ADD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00ADD09C
_free.LIBCMT ref: 00ADD0B5

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: f0efd0585dd81c94fc82b4bf809f11354b23b26d0771fa24bcf6820775874633
Instruction ID: c1044a71d68c50fcbd8b425dfc202f34a0888417eaabe110925f0339e5881e3b
Opcode Fuzzy Hash: f0efd0585dd81c94fc82b4bf809f11354b23b26d0771fa24bcf6820775874633
Instruction Fuzzy Hash: 2F6147B1904302AFDB21AFB8D985BAD7BA5EF09320F44416FF947A7381EA319D41D790

Function 00AB8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00AF6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00AF68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00AF68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00AF68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00AF68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00AB8874,00000000,00000000,00000000,000000FF,00000000), ref: 00AF6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00AF691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00AB8874,00000000,00000000,00000000,000000FF,00000000), ref: 00AF692D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 4a66c713a497472d50b3ffee85125d02b5f7b26bad2e81fef7e714f684aa9a38
Instruction ID: a9cfc17c914954bad923e38aad6c388bceaf9df52a48cc5f8c0ac9eea5d5df33
Opcode Fuzzy Hash: 4a66c713a497472d50b3ffee85125d02b5f7b26bad2e81fef7e714f684aa9a38
Instruction Fuzzy Hash: 29518870600209EFDB20CF68CC95FAE7BB9EF58750F204518FA16A72A0DB74E991DB50

Function 00B1C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B1C182
GetLastError.KERNEL32 ref: 00B1C195
SetEvent.KERNEL32(?), ref: 00B1C1A9

Part of subcall function 00B1C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B1C272
Part of subcall function 00B1C253: GetLastError.KERNEL32 ref: 00B1C322
Part of subcall function 00B1C253: SetEvent.KERNEL32(?), ref: 00B1C336
Part of subcall function 00B1C253: InternetCloseHandle.WININET(00000000), ref: 00B1C341

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 70c1be7499fd3bc2c03525a0c1b3d0039f8aca70c1d3810cde15a29543dbd104
Instruction ID: 6f1c422700dedc276d741c4945e671b3bb179b2b3703f69317886cc090fb1eb1
Opcode Fuzzy Hash: 70c1be7499fd3bc2c03525a0c1b3d0039f8aca70c1d3810cde15a29543dbd104
Instruction Fuzzy Hash: 0F317A71280601EFDB219FE5DC48AAABFF9FF18300B50445DF95A93610DB30E9949BA0

Function 00B025A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B03A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B03A57
Part of subcall function 00B03A3D: GetCurrentThreadId.KERNEL32 ref: 00B03A5E
Part of subcall function 00B03A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B025B3), ref: 00B03A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00B025BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00B025DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00B025DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B025E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00B02601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00B02605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B0260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00B02623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00B02627

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 7ece0f3a2372bf6352220c7aa7a772ad4b25404f36e34a3b9fea6dbe0a9fba20
Instruction ID: ae09bbbb6b563360615e7eb33daebdffbf2da34ae1decd7393d6a5731c4c8311
Opcode Fuzzy Hash: 7ece0f3a2372bf6352220c7aa7a772ad4b25404f36e34a3b9fea6dbe0a9fba20
Instruction Fuzzy Hash: EA01D431390610BBFB1067A89C8EF5D3F99EB4EB12F200001F318BF0E1CDE224449A69

Function 00B01803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00B01449,?,?,00000000), ref: 00B0180C
HeapAlloc.KERNEL32(00000000,?,00B01449,?,?,00000000), ref: 00B01813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B01449,?,?,00000000), ref: 00B01828
GetCurrentProcess.KERNEL32(?,00000000,?,00B01449,?,?,00000000), ref: 00B01830
DuplicateHandle.KERNEL32(00000000,?,00B01449,?,?,00000000), ref: 00B01833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B01449,?,?,00000000), ref: 00B01843
GetCurrentProcess.KERNEL32(00B01449,00000000,?,00B01449,?,?,00000000), ref: 00B0184B
DuplicateHandle.KERNEL32(00000000,?,00B01449,?,?,00000000), ref: 00B0184E
CreateThread.KERNEL32(00000000,00000000,00B01874,00000000,00000000,00000000), ref: 00B01868

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 48a64d5271aa6f866dd6648d23662723e9177888ae2a7e29ffaec21b9cf84c9e
Instruction ID: 90d638d9c879a5c06dc8c3eae28ca26b1a5ee483e77677ad4cd6c2133ba22c4d
Opcode Fuzzy Hash: 48a64d5271aa6f866dd6648d23662723e9177888ae2a7e29ffaec21b9cf84c9e
Instruction Fuzzy Hash: 1F01BBB5240708BFE710ABA5DC4DF6B3FACEB89B11F108411FA05EB1A1CA70D810DB20

Function 00B2A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00B0D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00B0D501
Part of subcall function 00B0D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00B0D50F
Part of subcall function 00B0D4DC: CloseHandle.KERNEL32(00000000), ref: 00B0D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B2A16D
GetLastError.KERNEL32 ref: 00B2A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B2A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00B2A268
GetLastError.KERNEL32(00000000), ref: 00B2A273
CloseHandle.KERNEL32(00000000), ref: 00B2A2C4

Strings

SeDebugPrivilege, xrefs: 00B2A18F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 5f02a5fd1b4ccebe2eeebc5beccd06ca363c0471ea9960b4e313ded0f03fd62d
Instruction ID: b64a7699e49730fc8e414259d97ddcee332ee2b2334f93679d8068c5e9db7ba7
Opcode Fuzzy Hash: 5f02a5fd1b4ccebe2eeebc5beccd06ca363c0471ea9960b4e313ded0f03fd62d
Instruction Fuzzy Hash: 01618E302042529FD720DF18D494F1ABBE5EF45318F18849CE46A9B7A3C776EC49CB92

Function 00B33886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B33925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00B3393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B33954
_wcslen.LIBCMT ref: 00B33999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00B339C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B339F4

Strings

SysListView32, xrefs: 00B338F7

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 6836185ec7c77413264cba90a2e8f7a896e93542eb412db1979770f7d0b4a295
Instruction ID: bd2f9f7b345421ccd6f4d283410bfe7642f2413a5586a66d1e6016e3b55fdf54
Opcode Fuzzy Hash: 6836185ec7c77413264cba90a2e8f7a896e93542eb412db1979770f7d0b4a295
Instruction Fuzzy Hash: C741A471A00218ABEB219F64CC45FEF7BE9EF08754F200566F559E7291D7719D80CB90

Function 00B0BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B0BCFD
IsMenu.USER32(00000000), ref: 00B0BD1D
CreatePopupMenu.USER32 ref: 00B0BD53
GetMenuItemCount.USER32(011C62F8), ref: 00B0BDA4
InsertMenuItemW.USER32(011C62F8,?,00000001,00000030), ref: 00B0BDCC

Strings

2, xrefs: 00B0BD37
0, xrefs: 00B0BCA8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 1123c3b771c50165c0605b4afd61c00c34d6726eb868c9cee030da66a4ef763d
Instruction ID: 0225c6be0efb4ea36df9a9bbb03fcab3c49cc55676dad1d34288709793128b96
Opcode Fuzzy Hash: 1123c3b771c50165c0605b4afd61c00c34d6726eb868c9cee030da66a4ef763d
Instruction Fuzzy Hash: 5F518C70A00206EBDB20DFA8D889FAEFFF4EF55354F2482A9E411A72D1D7709945CB61

Function 00B0C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00B0C913

Strings

stop, xrefs: 00B0C8E4
question, xrefs: 00B0C8CC
info, xrefs: 00B0C8B4
warning, xrefs: 00B0C8FC
blank, xrefs: 00B0C895

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: c6ededa03912db855b972d332d83fc185372695c763e1f07eae9bfbc5d6cc6f4
Instruction ID: 88d5aac780fb02eab6c6202d7953c675cab27e1376fcdb2b154d2040858be893
Opcode Fuzzy Hash: c6ededa03912db855b972d332d83fc185372695c763e1f07eae9bfbc5d6cc6f4
Instruction Fuzzy Hash: 9E110A32689306BAE7169B549CC3DBE7FDCDF15354B2041AEF904A62D2E7B49E00526C

Function 00B0ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00B0ED2A
_wcslen.LIBCMT ref: 00B0ED3B
_wcslen.LIBCMT ref: 00B0ED79
_wcslen.LIBCMT ref: 00B0EDAF
_wcslen.LIBCMT ref: 00B0EDDF
_wcslen.LIBCMT ref: 00B0EDEF
_wcslen.LIBCMT ref: 00B0EE2B
_wcslen.LIBCMT ref: 00B0EE5A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 56ec14bab143e79aadbec94110c8fd5cce686eed047ebd7595d166b5170922d3
Instruction ID: 3247f654447d2c3f8684a3e6cd09d4effc12cdff20ebc49f54fcf7a485a81278
Opcode Fuzzy Hash: 56ec14bab143e79aadbec94110c8fd5cce686eed047ebd7595d166b5170922d3
Instruction Fuzzy Hash: F341C165C1021875DB51EBF4C98AECFB7ACEF05300F11896AE528E3161FB34E245C3A9

Function 00ABF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00AF682C,00000004,00000000,00000000), ref: 00ABF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00AF682C,00000004,00000000,00000000), ref: 00AFF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00AF682C,00000004,00000000,00000000), ref: 00AFF454

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 51135e7e8abdd0b1b5714c7301af333b78766e71d8bc6b12d8bc2ae30eff240f
Instruction ID: f48f3979648ac037c29d6497a94b66169232784a8ffbed9118fe78df9e0df074
Opcode Fuzzy Hash: 51135e7e8abdd0b1b5714c7301af333b78766e71d8bc6b12d8bc2ae30eff240f
Instruction Fuzzy Hash: BC411A31608680FEC7398B6D8C887BA7FA9AF56314F2C453CF59767562CA31A880D711

Function 00B32D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B32D1B
GetDC.USER32(00000000), ref: 00B32D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B32D2E
ReleaseDC.USER32(00000000,00000000), ref: 00B32D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00B32D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B32D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B35A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00B32DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B32DE1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 3ed0af1975dce459d02d1290a50b2359ad1873ea282ef5f7b63cb98c7ef68467
Instruction ID: 40a4e64328ed3dd48f64b960fd8415447c4070a453b7caac736e89fa700a0223
Opcode Fuzzy Hash: 3ed0af1975dce459d02d1290a50b2359ad1873ea282ef5f7b63cb98c7ef68467
Instruction Fuzzy Hash: 85316D72201614BBEB114F54CC8AFEB3FA9EB09715F144065FE08AB291CA759C50C7A4

Function 00B05622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00B05637
_memcmp.LIBVCRUNTIME ref: 00B05659
_memcmp.LIBVCRUNTIME ref: 00B05671
_memcmp.LIBVCRUNTIME ref: 00B05684
_memcmp.LIBVCRUNTIME ref: 00B0569E
_memcmp.LIBVCRUNTIME ref: 00B056B1
_memcmp.LIBVCRUNTIME ref: 00B056C9
_memcmp.LIBVCRUNTIME ref: 00B056E4

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: e16690067118611a3f2b666a306aaab13178921508b502d34b99ff00fdd5234c
Instruction ID: 93830b4aad345ef1e9b9ec060a0ccc2911427af0bd11f485a90adae81c5360ef
Opcode Fuzzy Hash: e16690067118611a3f2b666a306aaab13178921508b502d34b99ff00fdd5234c
Instruction Fuzzy Hash: C8219861B40A097BD62459118F82FBB37DCEE22384F5400A4FD055AAC2F722ED1089A5

Function 00B24FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00B2502E, 00B25383
Not an Object type, xrefs: 00B25007

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: a74ab0fc7fd1c6ccee7c295e7f740f1f4514adceb482f119502a4d00dac535f6
Instruction ID: 1cbb337eb9e91e4b9e87b80fa500b8761dccb30280b6b426f6cf339ecbec70d5
Opcode Fuzzy Hash: a74ab0fc7fd1c6ccee7c295e7f740f1f4514adceb482f119502a4d00dac535f6
Instruction Fuzzy Hash: 9FD1B371A0061A9FDF20CF98D881BAEB7F5FF48354F1484A9E919AB291E770DD41CB90

Function 00AE1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00AE17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00AE15CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00AE17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00AE1651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00AE17FB,?,00AE17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00AE16E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00AE17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00AE16FB

Part of subcall function 00AD3820: RtlAllocateHeap.NTDLL(00000000,?,00B71444,?,00ABFDF5,?,?,00AAA976,00000010,00B71440,00AA13FC,?,00AA13C6,?,00AA1129), ref: 00AD3852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00AE17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00AE1777
__freea.LIBCMT ref: 00AE17A2
__freea.LIBCMT ref: 00AE17AE

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 8e8101046a96f76e49f51ed6cc31997f2f776c02e9bd858d4d7f487bebd6f68e
Instruction ID: 455793d82890471944ff2b22ad155aec0643b6b575f646fe9fb12ea883ea64a7
Opcode Fuzzy Hash: 8e8101046a96f76e49f51ed6cc31997f2f776c02e9bd858d4d7f487bebd6f68e
Instruction Fuzzy Hash: 0D91B572E002A69EDF208FB6CD81EEE7BB5AF49750F184659E812E7181DB35DD40CB60

Function 00B24523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B24648
VariantInit.OLEAUT32(?), ref: 00B24749
VariantClear.OLEAUT32(?), ref: 00B24753
VariantClear.OLEAUT32(?), ref: 00B247B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00B2472C
Null Object assignment in FOR..IN loop, xrefs: 00B245D8, 00B24706, 00B247BE

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 72026f5f6aa061eb4304dac83a2bad9b871ec9caabca6a51f4d9ce94bcce72ac
Instruction ID: cbb9e1edf6777ec79402e0289d338279e369cb6f8bb1618c77b1430283dfa0de
Opcode Fuzzy Hash: 72026f5f6aa061eb4304dac83a2bad9b871ec9caabca6a51f4d9ce94bcce72ac
Instruction Fuzzy Hash: E2917171A00225ABDF20CFA4D884FAEBBF8EF46714F108599F519AB291D7709D45CFA0

Function 00B11187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00B1125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00B11284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00B112A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B112D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B1135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B113C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B11430

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 8fe28e226cfdadfaceb4d45a50af66d87ae985131fe55d3055360701f963443b
Instruction ID: 851aa296d78ee741550d45d0284e27618ec102de903c174718b2a80b30412379
Opcode Fuzzy Hash: 8fe28e226cfdadfaceb4d45a50af66d87ae985131fe55d3055360701f963443b
Instruction Fuzzy Hash: A991EF71A00219AFDB00DFA8D884BFEB7F5FF45714F6448A9E600E7291D774A981CB90

Function 00AB948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7322e70888a30633045cb745656fe2577fe4c70e4027653d2e6427e255633a59
Instruction ID: e6f6722f8762a45557504a901515b8085739183273e059b8a5eac7be9581b4fe
Opcode Fuzzy Hash: 7322e70888a30633045cb745656fe2577fe4c70e4027653d2e6427e255633a59
Instruction Fuzzy Hash: AB912671D40219EFCB14CFA9CD84AEEBBB8FF49320F248155E615B7252D774AA41CB60

Function 00B23947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B2396B
CharUpperBuffW.USER32(?,?), ref: 00B23A7A
_wcslen.LIBCMT ref: 00B23A8A
VariantClear.OLEAUT32(?), ref: 00B23C1F

Part of subcall function 00B10CDF: VariantInit.OLEAUT32(00000000), ref: 00B10D1F
Part of subcall function 00B10CDF: VariantCopy.OLEAUT32(?,?), ref: 00B10D28
Part of subcall function 00B10CDF: VariantClear.OLEAUT32(?), ref: 00B10D34

Strings

AUTOIT.ERROR, xrefs: 00B23A80, 00B23A85
Incorrect Parameter format, xrefs: 00B239A6, 00B23BA1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 90d3f0a6d41ed2f97e3d519ef835dd2c2c03c52e92c00052fe702a0c4eb1c269
Instruction ID: c698cdb931498e128b36d3608857dab85f8e59ddfc42cd261e6c902d8e529e4d
Opcode Fuzzy Hash: 90d3f0a6d41ed2f97e3d519ef835dd2c2c03c52e92c00052fe702a0c4eb1c269
Instruction Fuzzy Hash: D89179746083119FC700EF24D58496ABBE4FF89714F1489ADF88A9B351DB34EE45CB92

Function 00B24BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00B0000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00AFFF41,80070057,?,?,?,00B0035E), ref: 00B0002B
Part of subcall function 00B0000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00AFFF41,80070057,?,?), ref: 00B00046
Part of subcall function 00B0000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00AFFF41,80070057,?,?), ref: 00B00054
Part of subcall function 00B0000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00AFFF41,80070057,?), ref: 00B00064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00B24C51
_wcslen.LIBCMT ref: 00B24D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00B24DCF
CoTaskMemFree.OLE32(?), ref: 00B24DDA

Strings

NULL Pointer assignment, xrefs: 00B24E23, 00B24E52

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 343fe58a6b7e1b7679ddc21cd76f373896007cf069f2444e09077500a51707d0
Instruction ID: dfb54bfc02b64c30e874dea6c2f686290c6f6b778957d43a4d23e75784b59d06
Opcode Fuzzy Hash: 343fe58a6b7e1b7679ddc21cd76f373896007cf069f2444e09077500a51707d0
Instruction Fuzzy Hash: 1C910871D002299FDF14DFA4D891AEEBBB9FF09310F1085A9E519A7291DB349E44CF60

Function 00B320FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00B32183
GetMenuItemCount.USER32(00000000), ref: 00B321B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B321DD
_wcslen.LIBCMT ref: 00B32213
GetMenuItemID.USER32(?,?), ref: 00B3224D
GetSubMenu.USER32(?,?), ref: 00B3225B

Part of subcall function 00B03A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B03A57
Part of subcall function 00B03A3D: GetCurrentThreadId.KERNEL32 ref: 00B03A5E
Part of subcall function 00B03A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B025B3), ref: 00B03A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B322E3

Part of subcall function 00B0E97B: Sleep.KERNEL32 ref: 00B0E9F3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: ac2a656254528666510994089fa602a46573c119bda693fd344c5cfb65ad227d
Instruction ID: 7b458a94339b3426a987cdba00cceea0aabdda17772410e0c6fa498edff7b749
Opcode Fuzzy Hash: ac2a656254528666510994089fa602a46573c119bda693fd344c5cfb65ad227d
Instruction Fuzzy Hash: D4715D75A00215AFCB10DFA4CD85AAEBBF5EF49310F248499E916BB351DB34ED418B90

Function 00B0AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B0AEF9
GetKeyboardState.USER32(?), ref: 00B0AF0E
SetKeyboardState.USER32(?), ref: 00B0AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00B0AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00B0AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00B0AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B0B020

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: a90b80bb5d7a64d95125be7dad75a0373d2312e507836846b6cc53876ee0851e
Instruction ID: ca9d65e746198ee2b6991838d889173d8200c8062a45f5b32730b2be270fa5c2
Opcode Fuzzy Hash: a90b80bb5d7a64d95125be7dad75a0373d2312e507836846b6cc53876ee0851e
Instruction Fuzzy Hash: A15191A1A047D63DFB368334CC45BBABEE99B06304F0889C9E1D9968C2D799ACC4D751

Function 00B0ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B0AD19
GetKeyboardState.USER32(?), ref: 00B0AD2E
SetKeyboardState.USER32(?), ref: 00B0AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B0ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B0ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B0AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B0AE38

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8c9ab3a60bc8eae247920d78df2a905f03f103eea1207cb11db81f739760cdab
Instruction ID: 5272706eb954ee66564b29b57b2f41506da94b43914ae05ed5de94dc82b8370b
Opcode Fuzzy Hash: 8c9ab3a60bc8eae247920d78df2a905f03f103eea1207cb11db81f739760cdab
Instruction Fuzzy Hash: 4051F5A15047D53DFB338334CC95BBABEE8AB46300F1889D9E1D5568C3D694EC88D762

Function 00AD542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00AE3CD6,?,?,?,?,?,?,?,?,00AD5BA3,?,?,00AE3CD6,?,?), ref: 00AD5470
__fassign.LIBCMT ref: 00AD54EB
__fassign.LIBCMT ref: 00AD5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00AE3CD6,00000005,00000000,00000000), ref: 00AD552C
WriteFile.KERNEL32(?,00AE3CD6,00000000,00AD5BA3,00000000,?,?,?,?,?,?,?,?,?,00AD5BA3,?), ref: 00AD554B
WriteFile.KERNEL32(?,?,00000001,00AD5BA3,00000000,?,?,?,?,?,?,?,?,?,00AD5BA3,?), ref: 00AD5584

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 6b85b9d1568926d6c049c18a6998ca5667dab916dd3d6797f8005f3abbcb22ee
Instruction ID: 2b8ec10df840b18c6e83db769abb81dbdb34fc9aafcc9a411c4e5b9fd1bfb3e8
Opcode Fuzzy Hash: 6b85b9d1568926d6c049c18a6998ca5667dab916dd3d6797f8005f3abbcb22ee
Instruction Fuzzy Hash: 1C519FB1E00649AFDB11CFA8E845AEEBBF9EF09300F14411BE556E7391D6309A81CB61

Function 00AC2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00AC2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00AC2D53
_ValidateLocalCookies.LIBCMT ref: 00AC2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00AC2E0C
_ValidateLocalCookies.LIBCMT ref: 00AC2E61

Strings

csm, xrefs: 00AC2DF6

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 2c91d2d525397b86a1af2f51c1f29aa13dab6b7599ba2006369ea66dbe38569e
Instruction ID: dc9e79ef6517f70d5ea39cc0ba616b5d3837b77291360a4ea2becd64bb11cf96
Opcode Fuzzy Hash: 2c91d2d525397b86a1af2f51c1f29aa13dab6b7599ba2006369ea66dbe38569e
Instruction Fuzzy Hash: F441B034A00209ABCF10DF68C845FAEBBB5BF44324F168159E815AB392DB31AA01CBD0

Function 00B210B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2304E: inet_addr.WSOCK32(?), ref: 00B2307A
Part of subcall function 00B2304E: _wcslen.LIBCMT ref: 00B2309B

socket.WSOCK32(00000002,00000001,00000006), ref: 00B21112
WSAGetLastError.WSOCK32 ref: 00B21121
WSAGetLastError.WSOCK32 ref: 00B211C9
closesocket.WSOCK32(00000000), ref: 00B211F9

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: fd3b2ad505e4fc692fb4c375b487c502e4581f86915e2230f9d4df602cfa72ee
Instruction ID: f22154e089e2441bfb80bae9ceb0df126cf21d90890ab901377dadaf6938e24d
Opcode Fuzzy Hash: fd3b2ad505e4fc692fb4c375b487c502e4581f86915e2230f9d4df602cfa72ee
Instruction Fuzzy Hash: 07410931600214AFDB109F58D885BAEBBE9FF45325F148599FD09AB291C770EE41CBE1

Function 00B0CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B0CF22,?), ref: 00B0DDFD

Part of subcall function 00B0DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B0CF22,?), ref: 00B0DE16

lstrcmpiW.KERNEL32(?,?), ref: 00B0CF45
MoveFileW.KERNEL32(?,?), ref: 00B0CF7F
_wcslen.LIBCMT ref: 00B0D005
_wcslen.LIBCMT ref: 00B0D01B
SHFileOperationW.SHELL32(?), ref: 00B0D061

Strings

\*.*, xrefs: 00B0CFF3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: a2df4419c1367c192f2796ed0b64af1ee2bc2fd2774e1c298eafd072999b9e07
Instruction ID: 2eb46657a5b075a1b86ea6c79e2f578db0dfb1cb7d70543c583ca6bdbcd1636c
Opcode Fuzzy Hash: a2df4419c1367c192f2796ed0b64af1ee2bc2fd2774e1c298eafd072999b9e07
Instruction Fuzzy Hash: 824117719452195EDF12EFA4D981EDE7BF9EF48380F1001E6E509E7181EF34A648CB51

Function 00B32DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B32E1C
GetWindowLongW.USER32(?,000000F0), ref: 00B32E4F
GetWindowLongW.USER32(?,000000F0), ref: 00B32E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B32EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B32EE0
GetWindowLongW.USER32(?,000000F0), ref: 00B32EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B32F0B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 5f1b00fe8916535844a84c7d449041095f867f2ef78b1d08b3096b7a7c20e4ce
Instruction ID: 2581fe25b7047acc6174c5a1830cae6b1d7fff54fe3ebc7754d14c6b8d4b31cd
Opcode Fuzzy Hash: 5f1b00fe8916535844a84c7d449041095f867f2ef78b1d08b3096b7a7c20e4ce
Instruction Fuzzy Hash: 90310635604260AFDB21CF5CDC86F6937E1FB9A710F2501A4FA049F2B1CB71A881DB51

Function 00B07726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B07769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B0778F
SysAllocString.OLEAUT32(00000000), ref: 00B07792
SysAllocString.OLEAUT32(?), ref: 00B077B0
SysFreeString.OLEAUT32(?), ref: 00B077B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00B077DE
SysAllocString.OLEAUT32(?), ref: 00B077EC

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f844ca02639124ad34ca9f6d0fe94839989f786e245ab826852a8776b373e7d0
Instruction ID: e1ee94b5cd6d62ac54b22666b727b3544ad21a77defc5bfd6fe930f82ec2d9c3
Opcode Fuzzy Hash: f844ca02639124ad34ca9f6d0fe94839989f786e245ab826852a8776b373e7d0
Instruction Fuzzy Hash: 5F218376A04219BFDB10DFA8CC88CBB7BECEB097A47148065B915DB291DA70ED418764

Function 00B077FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B07842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B07868
SysAllocString.OLEAUT32(00000000), ref: 00B0786B
SysAllocString.OLEAUT32 ref: 00B0788C
SysFreeString.OLEAUT32 ref: 00B07895
StringFromGUID2.OLE32(?,?,00000028), ref: 00B078AF
SysAllocString.OLEAUT32(?), ref: 00B078BD

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: a3115584084ba25ef5ac0dc076ac4b13651d55db5146ded91ea3efa042dbc269
Instruction ID: d4cb4d906aebef2989e1bdbbbd14f62de7d0527941d9aeb639d8984c5e1e9735
Opcode Fuzzy Hash: a3115584084ba25ef5ac0dc076ac4b13651d55db5146ded91ea3efa042dbc269
Instruction Fuzzy Hash: C9215132A04204BFDB109BE9DC8CDAABBECEB097607148165B915DB2E1DE74EC41CB64

Function 00B104D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00B104F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B1052E

Strings

nul, xrefs: 00B10567

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 94516c7d4058a557f031af2dafe14861512c886bb1caf7d70e9c2cc70c6c301d
Instruction ID: 28bbe475bfe018928c521f9be3ce876a7ba0b7cd50919df4fa4da1748b3a38e4
Opcode Fuzzy Hash: 94516c7d4058a557f031af2dafe14861512c886bb1caf7d70e9c2cc70c6c301d
Instruction Fuzzy Hash: FE218071510305ABDB20AF69DC84ADA7BF5EF54724F604A59F8A1E72E0D7B099D0CF20

Function 00B105A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00B105C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B10601

Strings

nul, xrefs: 00B10639

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 8974804eed330a16c4a027634ddadffe1c6ea33d77ec066de09d41cfac87aa62
Instruction ID: acb0116e48c4b6fa42156901fd379b7a24542cb530fe3dad6c3393a755c437a4
Opcode Fuzzy Hash: 8974804eed330a16c4a027634ddadffe1c6ea33d77ec066de09d41cfac87aa62
Instruction Fuzzy Hash: 50219575510305ABDB20AF69DC44ADA77E4FF95720F600A59F8A1E72E0DBF098E0CB10

Function 00B340AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AA604C
Part of subcall function 00AA600E: GetStockObject.GDI32(00000011), ref: 00AA6060
Part of subcall function 00AA600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AA606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B34112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B3411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B3412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B34139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B34145

Strings

Msctls_Progress32, xrefs: 00B340E3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 55e899c20be77a1795033164afee10e6954bd9579d8e61cb8b196d1bd202b491
Instruction ID: bf5380878b7b8f66134577ee5030cb3c1583f8c7d5b68cc2d8e9cd5e7f8274e7
Opcode Fuzzy Hash: 55e899c20be77a1795033164afee10e6954bd9579d8e61cb8b196d1bd202b491
Instruction Fuzzy Hash: 2A11B2B2140219BEEF118F64CC86EE77FADEF08798F114111FA18A6090CB729C61DBA4

Function 00ADD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ADD7A3: _free.LIBCMT ref: 00ADD7CC

_free.LIBCMT ref: 00ADD82D

Part of subcall function 00AD29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000), ref: 00AD29DE
Part of subcall function 00AD29C8: GetLastError.KERNEL32(00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000,00000000), ref: 00AD29F0

_free.LIBCMT ref: 00ADD838
_free.LIBCMT ref: 00ADD843
_free.LIBCMT ref: 00ADD897
_free.LIBCMT ref: 00ADD8A2
_free.LIBCMT ref: 00ADD8AD
_free.LIBCMT ref: 00ADD8B8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 6cdbb734768161fba9956c197a71fd4a872b6a437e7ebc21e0cb0afb545d4a52
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 3B115E71540B04AAD621BFB0CE47FCB7BDCAF50700F400826B29FAA292DA65B6059760

Function 00B0DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B0DA74
LoadStringW.USER32(00000000), ref: 00B0DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B0DA91
LoadStringW.USER32(00000000), ref: 00B0DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B0DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B0DAB9

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: ecfeb51361ddf560d236dd99db0a42c5c2c0c3f1f55ad78048124850a3ef6c88
Instruction ID: dd15663cbec18de05e87314898cfb7a2af0159120ca8b8f1f3faf029ffe4c9c3
Opcode Fuzzy Hash: ecfeb51361ddf560d236dd99db0a42c5c2c0c3f1f55ad78048124850a3ef6c88
Instruction Fuzzy Hash: BA014FF25002087BE7509BE09D89EEA3AACE708701F500495B706F3081EA749E844B74

Function 00B1096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(011BE398,011BE398), ref: 00B1097B
EnterCriticalSection.KERNEL32(011BE378,00000000), ref: 00B1098D
TerminateThread.KERNEL32(?,000001F6), ref: 00B1099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00B109A9
CloseHandle.KERNEL32(?), ref: 00B109B8
InterlockedExchange.KERNEL32(011BE398,000001F6), ref: 00B109C8
LeaveCriticalSection.KERNEL32(011BE378), ref: 00B109CF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 7a2622f824f68ba85b250c1ceec59c0d8c102958dd885c67a74d5c516ea66651
Instruction ID: 18e4c394be1e0fc8fde32a8d461b1e2de032b5fccb07ea40e9f8c248817629e8
Opcode Fuzzy Hash: 7a2622f824f68ba85b250c1ceec59c0d8c102958dd885c67a74d5c516ea66651
Instruction Fuzzy Hash: 4FF0CD31442912BBD7515B94EE89ADA7A65FF05742FA01015F101A18A1CBB594B5CF90

Function 00B21C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?), ref: 00B21DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00B21DE1
WSAGetLastError.WSOCK32 ref: 00B21DF2
htons.WSOCK32(?), ref: 00B21EDB
inet_ntoa.WSOCK32(?), ref: 00B21E8C

Part of subcall function 00B039E8: _strlen.LIBCMT ref: 00B039F2

Part of subcall function 00B23224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00B1EC0C), ref: 00B23240

_strlen.LIBCMT ref: 00B21F35

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 99f8327179bf846ad1470271bbd1c2f2dd79711a0a69322bc66ebc1e528b2b44
Instruction ID: aec260a1e091ea434cc1c09a12517254d34599033ee16c512cecb56f695936ed
Opcode Fuzzy Hash: 99f8327179bf846ad1470271bbd1c2f2dd79711a0a69322bc66ebc1e528b2b44
Instruction Fuzzy Hash: 1CB1F230604310AFC324DF28D995E6A7BE5EF95318F58899CF45A5B2E2CB31ED42CB91

Function 00AA5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00AA5D30
GetWindowRect.USER32(?,?), ref: 00AA5D71
ScreenToClient.USER32(?,?), ref: 00AA5D99
GetClientRect.USER32(?,?), ref: 00AA5ED7
GetWindowRect.USER32(?,?), ref: 00AA5EF8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 4dd254c02e144ff957659de75f1157c32164c2495d5edd6e120af96818318f4f
Instruction ID: 94c0df351809f63ef0ee5ec86818efcfb0f2e9963ab6eee85aec14946876219c
Opcode Fuzzy Hash: 4dd254c02e144ff957659de75f1157c32164c2495d5edd6e120af96818318f4f
Instruction Fuzzy Hash: E7B16A35A00A8ADBDB24CFB9C4407EEB7F5FF58310F14841AE8A9D7290DB34AA51DB54

Function 00AD01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00AD00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AD00D6
__allrem.LIBCMT ref: 00AD00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AD010B
__allrem.LIBCMT ref: 00AD0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AD0140

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: bd662939c6e7712e4ea2a37fbdbf08403bbf1fa4b6f877b96852bb4175e907a1
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: C681C172A00706AFE720AB69CD41F6A73A9EF41764F25462FF552DB781E770DA008B90

Function 00AD61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00AC82D9,00AC82D9,?,?,?,00AD644F,00000001,00000001,8BE85006), ref: 00AD6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00AD644F,00000001,00000001,8BE85006,?,?,?), ref: 00AD62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00AD63D8
__freea.LIBCMT ref: 00AD63E5

Part of subcall function 00AD3820: RtlAllocateHeap.NTDLL(00000000,?,00B71444,?,00ABFDF5,?,?,00AAA976,00000010,00B71440,00AA13FC,?,00AA13C6,?,00AA1129), ref: 00AD3852

__freea.LIBCMT ref: 00AD63EE
__freea.LIBCMT ref: 00AD6413

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 19656727a0828baeaa3ad340023805f6300bf269d642ec3a76bb9f180e275322
Instruction ID: b8ee12a38b308cf0ef38d70328c6ba615f2af519c33b3e9a9e74d24f71b43b4c
Opcode Fuzzy Hash: 19656727a0828baeaa3ad340023805f6300bf269d642ec3a76bb9f180e275322
Instruction Fuzzy Hash: 6C51E172A00216ABDF258F64DD81EAF7BA9EF44750F15462AFC06DB241DB34DC44D660

Function 00B2BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Part of subcall function 00B2C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2B6AE,?,?), ref: 00B2C9B5
Part of subcall function 00B2C998: _wcslen.LIBCMT ref: 00B2C9F1
Part of subcall function 00B2C998: _wcslen.LIBCMT ref: 00B2CA68
Part of subcall function 00B2C998: _wcslen.LIBCMT ref: 00B2CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B2BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B2BD25
RegCloseKey.ADVAPI32(00000000), ref: 00B2BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B2BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B2BDF3
RegCloseKey.ADVAPI32(?), ref: 00B2BDFF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 5764c256f126c666badd67bf6e5882c0d3345dc8bb7f2b050e271d02b2e42310
Instruction ID: 389cbb8c2f38ea90b726363996101915b6841db320dd75e2d1eeb17259a56302
Opcode Fuzzy Hash: 5764c256f126c666badd67bf6e5882c0d3345dc8bb7f2b050e271d02b2e42310
Instruction Fuzzy Hash: AB81AC30208241AFC714DF24D881E6ABBE5FF85348F1489ACF5598B2A2DF31ED45CB92

Function 00AFF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00AFF7B9
SysAllocString.OLEAUT32(00000001), ref: 00AFF860
VariantCopy.OLEAUT32(00AFFA64,00000000), ref: 00AFF889
VariantClear.OLEAUT32(00AFFA64), ref: 00AFF8AD
VariantCopy.OLEAUT32(00AFFA64,00000000), ref: 00AFF8B1
VariantClear.OLEAUT32(?), ref: 00AFF8BB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 84418035439939dd330b8bec794fcc2f79be4327b8f60b51a093de974232064f
Instruction ID: ae4e7ae3c25b36fe126912d774ab89a0f604e288b82b96ee7876d628423349d1
Opcode Fuzzy Hash: 84418035439939dd330b8bec794fcc2f79be4327b8f60b51a093de974232064f
Instruction Fuzzy Hash: DF51B635500318BECF24ABE5D8D5B79B3A8EF45710B249467FA05DF292DBB08C40D7A6

Function 00B1910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00AA7620: _wcslen.LIBCMT ref: 00AA7625

Part of subcall function 00AA6B57: _wcslen.LIBCMT ref: 00AA6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00B194E5
_wcslen.LIBCMT ref: 00B19506
_wcslen.LIBCMT ref: 00B1952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00B19585

Strings

X, xrefs: 00B19412

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 4923bd23cae37d2d925ff86b409c98a99ed8259e05f35fd3a7f644be7fca4fe9
Instruction ID: 87c8c2b9237b725ba333b9a32a0edeb118306485bf0acadda23752a494499c69
Opcode Fuzzy Hash: 4923bd23cae37d2d925ff86b409c98a99ed8259e05f35fd3a7f644be7fca4fe9
Instruction Fuzzy Hash: A9E1C0319083418FD724DF24C991AAEB7E5FF85310F1489ADF8999B2A2DB30DD45CB92

Function 00AB920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00AB9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AB9BB2

BeginPaint.USER32(?,?,?), ref: 00AB9241
GetWindowRect.USER32(?,?), ref: 00AB92A5
ScreenToClient.USER32(?,?), ref: 00AB92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00AB92D3
EndPaint.USER32(?,?,?,?,?), ref: 00AB9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00AF71EA

Part of subcall function 00AB9339: BeginPath.GDI32(00000000), ref: 00AB9357

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: baab8c285dc236cc055611b23d5437a6747983517a7f8b012a08dc8aae41cdd1
Instruction ID: e376b96954ac5b109e73b17dd61faa47ce4c2b230ae0fea04d8d55d38d919700
Opcode Fuzzy Hash: baab8c285dc236cc055611b23d5437a6747983517a7f8b012a08dc8aae41cdd1
Instruction Fuzzy Hash: 90418D71104200AFD711DF68C885FBB7BB8EB55320F140669FAA9972B2CB319846DB61

Function 00B107EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00B1080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00B10847
EnterCriticalSection.KERNEL32(?), ref: 00B10863
LeaveCriticalSection.KERNEL32(?), ref: 00B108DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00B108F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00B10921

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: f62aa3b10f2671baa8c2e081562bcc229de1060d7e0a5f806b3136d6b53c39b9
Instruction ID: 7322cb343e6c08fe5c5e689a0abeb13b11f52bf1a842abcd0bc1b1ee5f435a87
Opcode Fuzzy Hash: f62aa3b10f2671baa8c2e081562bcc229de1060d7e0a5f806b3136d6b53c39b9
Instruction Fuzzy Hash: 49418D71900205EFDF14AFA4DD85AAA77B9FF04310F1440A9ED04AB297DB74DEA0DBA0

Function 00B381DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00AFF3AB,00000000,?,?,00000000,?,00AF682C,00000004,00000000,00000000), ref: 00B3824C
EnableWindow.USER32(?,00000000), ref: 00B38272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00B382D1
ShowWindow.USER32(?,00000004), ref: 00B382E5
EnableWindow.USER32(?,00000001), ref: 00B3830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00B3832F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 8491bd1fc6e1a381d339ca4d098ec915e422c3dc103b4e49e271f72ab7cd6f10
Instruction ID: 2c5ec1deb5e11c205b087170914ecedad12fc3b272e1bc6c310f3e5710e467dd
Opcode Fuzzy Hash: 8491bd1fc6e1a381d339ca4d098ec915e422c3dc103b4e49e271f72ab7cd6f10
Instruction Fuzzy Hash: 8F418334601744AFDB12CF19DC99BA57BE0FB4A714F2841E9FA085B262CB31A842CF52

Function 00B04C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B04C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B04CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B04CEA
_wcslen.LIBCMT ref: 00B04D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B04D10
_wcsstr.LIBVCRUNTIME ref: 00B04D1A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 8388d42cfc7bc8ba37d6cb45aeee8ccb6f22fc46fdfa56b43e625c5c0ddebfad
Instruction ID: d1bdce861d0fb25626cbed6feeed020533ef68e9a78ff6c06e3a906a5348f271
Opcode Fuzzy Hash: 8388d42cfc7bc8ba37d6cb45aeee8ccb6f22fc46fdfa56b43e625c5c0ddebfad
Instruction Fuzzy Hash: 6D21F2B2204200BBEB255B69AD4AE7F7FDCDF45750F1081B9F905DB192EB61DC0097A0

Function 00B1581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AA3A97,?,?,00AA2E7F,?,?,?,00000000), ref: 00AA3AC2

_wcslen.LIBCMT ref: 00B1587B
CoInitialize.OLE32(00000000), ref: 00B15995
CoCreateInstance.OLE32(00B3FCF8,00000000,00000001,00B3FB68,?), ref: 00B159AE
CoUninitialize.OLE32 ref: 00B159CC

Strings

.lnk, xrefs: 00B15876, 00B158C1, 00B15985

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: baee6110a7aba5776957bb4ef0c8cafedcf0cc30ca306b5ae083b5776fa33048
Instruction ID: 844e7375c0cd7473bb951f20f99b6e122d023611b205b7c6b7424fa0a33bec40
Opcode Fuzzy Hash: baee6110a7aba5776957bb4ef0c8cafedcf0cc30ca306b5ae083b5776fa33048
Instruction Fuzzy Hash: C8D15471608601DFC724DF24C580A6EBBE5EF89710F54889DF88A9B261DB31ED85CB92

Function 00B0175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B00FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B00FCA
Part of subcall function 00B00FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B00FD6
Part of subcall function 00B00FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B00FE5
Part of subcall function 00B00FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B00FEC
Part of subcall function 00B00FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B01002

GetLengthSid.ADVAPI32(?,00000000,00B01335), ref: 00B017AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B017BA
HeapAlloc.KERNEL32(00000000), ref: 00B017C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00B017DA
GetProcessHeap.KERNEL32(00000000,00000000,00B01335), ref: 00B017EE
HeapFree.KERNEL32(00000000), ref: 00B017F5

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 17c42430e93e94a151fbde532b3d5411b00fabdfe65f87dcb4e025ccceb3a87f
Instruction ID: e39c49ac4f8ceac8e79d166f3e2e01bc3cbb35e8c9c9e6ffe046bc9a06ab3c63
Opcode Fuzzy Hash: 17c42430e93e94a151fbde532b3d5411b00fabdfe65f87dcb4e025ccceb3a87f
Instruction Fuzzy Hash: C711BEB6500605FFDB18DFA8CC49BAE7FE9EB45355F204898F482A7290CB35AD40DB60

Function 00B014CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00B014FF
OpenProcessToken.ADVAPI32(00000000), ref: 00B01506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00B01515
CloseHandle.KERNEL32(00000004), ref: 00B01520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B0154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00B01563

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 8ccf9af51fc2958f50e1fa1abbba18b3a7062eadff2c026fe56306b396f2b5d0
Instruction ID: 062ba48f98698b1e6970369b25e1085fe748ca6221e4aa7d43c8605987076d57
Opcode Fuzzy Hash: 8ccf9af51fc2958f50e1fa1abbba18b3a7062eadff2c026fe56306b396f2b5d0
Instruction Fuzzy Hash: F7114472500209ABDB11CFA8DD49BDE7FA9EB48708F144064FA05A21A0C7718E649B60

Function 00AC3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00AC3379,00AC2FE5), ref: 00AC3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00AC339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00AC33B7
SetLastError.KERNEL32(00000000,?,00AC3379,00AC2FE5), ref: 00AC3409

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: dc5c6d5caefdcd528137150432eaaff4917ace8cf0c5684b0d8b74db885714cc
Instruction ID: 49c33c85c99fa684014fa417ef24a98491c63c9acd110520660b7265e60143fc
Opcode Fuzzy Hash: dc5c6d5caefdcd528137150432eaaff4917ace8cf0c5684b0d8b74db885714cc
Instruction Fuzzy Hash: EA01D83360D351BEAF152BB47D95F6B2E94EB15379732822DF410862F0EF554D016688

Function 00AD2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00AD5686,00AE3CD6,?,00000000,?,00AD5B6A,?,?,?,?,?,00ACE6D1,?,00B68A48), ref: 00AD2D78
_free.LIBCMT ref: 00AD2DAB
_free.LIBCMT ref: 00AD2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00ACE6D1,?,00B68A48,00000010,00AA4F4A,?,?,00000000,00AE3CD6), ref: 00AD2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00ACE6D1,?,00B68A48,00000010,00AA4F4A,?,?,00000000,00AE3CD6), ref: 00AD2DEC
_abort.LIBCMT ref: 00AD2DF2

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 89de516f4a4b50e9013150017207bb8952154e2279bedce949c68b11d4629934
Instruction ID: c54e91e07d85fd802926f749a39a06047081a0f2575a4e33a27810297ed91b6b
Opcode Fuzzy Hash: 89de516f4a4b50e9013150017207bb8952154e2279bedce949c68b11d4629934
Instruction Fuzzy Hash: F1F0A93654460067D71227746D0AB5E39666BF27A1F344417F8A7A33D1EE748901D361

Function 00B38A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00AB9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AB9693
Part of subcall function 00AB9639: SelectObject.GDI32(?,00000000), ref: 00AB96A2
Part of subcall function 00AB9639: BeginPath.GDI32(?), ref: 00AB96B9
Part of subcall function 00AB9639: SelectObject.GDI32(?,00000000), ref: 00AB96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00B38A4E
LineTo.GDI32(?,00000003,00000000), ref: 00B38A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00B38A70
LineTo.GDI32(?,00000000,00000003), ref: 00B38A80
EndPath.GDI32(?), ref: 00B38A90
StrokePath.GDI32(?), ref: 00B38AA0

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: a5bb812400ce17985c8499ba01f1a8daf532209704d24b374ba7e080cfd907b8
Instruction ID: 873cf03a549bc195a67fb5b3990a747f52bab3bc1ce7848e2f242fa68114fcdd
Opcode Fuzzy Hash: a5bb812400ce17985c8499ba01f1a8daf532209704d24b374ba7e080cfd907b8
Instruction Fuzzy Hash: 41111B7600014CFFDF129F98DC88EAA7FACEB08350F108052BA19AA1A1CB719D55DFA0

Function 00B051FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B05218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B05229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B05230
ReleaseDC.USER32(00000000,00000000), ref: 00B05238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B0524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00B05261

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: c58823e0f39782b1732ed2ed2117218cb3c8c7e19fc219584e1700df38a0f295
Instruction ID: 72f6894503cdf0bfd378e1383b8ca2a9914143ea7a4ad117161c6d38e59f0b33
Opcode Fuzzy Hash: c58823e0f39782b1732ed2ed2117218cb3c8c7e19fc219584e1700df38a0f295
Instruction Fuzzy Hash: 0E014F75A00718BBEB109BE59C49A5EBFB8EF48751F144065FA04F7291DA709800CFA0

Function 00AA1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AA1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00AA1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AA1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AA1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00AA1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AA1C22

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: ab900a3b82fe12a4a4da786696817e433d2923ddcc1ec22fe47ad9fe46c53865
Instruction ID: 01b7055dd971590273a8bee69076f1ac98db2d6d4a9f8f5b7555e5f0cdd218b0
Opcode Fuzzy Hash: ab900a3b82fe12a4a4da786696817e433d2923ddcc1ec22fe47ad9fe46c53865
Instruction Fuzzy Hash: B00167B0902B5ABDE3008F6A8C85B56FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 00B0EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B0EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B0EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00B0EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B0EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B0EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B0EB75

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: ff690e64e100207956251ddf60e405dce1509e784e7e3b2689d96f21a825dec9
Instruction ID: bc247652eecefb6e0e75e4552daf319cb62300950205f90a5d83f8595c85f31f
Opcode Fuzzy Hash: ff690e64e100207956251ddf60e405dce1509e784e7e3b2689d96f21a825dec9
Instruction Fuzzy Hash: B7F01772240558BBE7215BA29C0EEAF3E7CEBCAB11F104158F611F20919BA05A0197B5

Function 00AF7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00AF7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00AF7469
GetWindowDC.USER32(?), ref: 00AF7475
GetPixel.GDI32(00000000,?,?), ref: 00AF7484
ReleaseDC.USER32(?,00000000), ref: 00AF7496
GetSysColor.USER32(00000005), ref: 00AF74B0

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 1c9314447502f11d8a58b750f1514aebef845fa338663375d1438d3bcc2bd35b
Instruction ID: 99106892b2df201128ecc39567570ee64cb0d2f2a1f5a0725c84a6f8ccc0238b
Opcode Fuzzy Hash: 1c9314447502f11d8a58b750f1514aebef845fa338663375d1438d3bcc2bd35b
Instruction Fuzzy Hash: 88012831400619EFEB515FA8DC0ABAE7FB5FB04312F610164FA15A31A1CF311E51AB50

Function 00B01874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B0187F
UnloadUserProfile.USERENV(?,?), ref: 00B0188B
CloseHandle.KERNEL32(?), ref: 00B01894
CloseHandle.KERNEL32(?), ref: 00B0189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B018A5
HeapFree.KERNEL32(00000000), ref: 00B018AC

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: a4d43d665ceef6dc321de0ac2c5324937a76a4edca06a3db73139accc879c4f8
Instruction ID: 1c1a78e2f8e0e4f9274b4f074b83ee7d3b92c2728edcc05a29163456f2b6e241
Opcode Fuzzy Hash: a4d43d665ceef6dc321de0ac2c5324937a76a4edca06a3db73139accc879c4f8
Instruction Fuzzy Hash: D4E0C236004501BBDB015BE1ED0C90ABF29FB49B22B208220F225A2070CF329430EB50

Function 00B0C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA7620: _wcslen.LIBCMT ref: 00AA7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B0C6EE
_wcslen.LIBCMT ref: 00B0C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B0C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B0C7CA

Strings

0, xrefs: 00B0C6AF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: da049af7bda6f71052c7a44933738a50bf21de0cc7a334f6a0835c453cbbf597
Instruction ID: 2aa2e8bfed0fe14239a31c9c54fe4a1fb840b63ab2c9ba89557199a189c96963
Opcode Fuzzy Hash: da049af7bda6f71052c7a44933738a50bf21de0cc7a334f6a0835c453cbbf597
Instruction Fuzzy Hash: 5251BD716043009BD7259F28C985B6A7FE8EB49310F044BADF9A5E31E1DB60DD048B66

Function 00B2AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00B2AEA3

Part of subcall function 00AA7620: _wcslen.LIBCMT ref: 00AA7625

GetProcessId.KERNEL32(00000000), ref: 00B2AF38
CloseHandle.KERNEL32(00000000), ref: 00B2AF67

Strings

@, xrefs: 00B2AE72
<, xrefs: 00B2AE6B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: b230ba535a2937c9087d70f58dfd7e4dab091c31f934449ca27f4baabd78d1cb
Instruction ID: a824c268e10c2daea0a5f63f8407f84a15e6813815646ee6a534b90f76acd56e
Opcode Fuzzy Hash: b230ba535a2937c9087d70f58dfd7e4dab091c31f934449ca27f4baabd78d1cb
Instruction Fuzzy Hash: 75718B71A00625DFCB14EF54D584A9EBBF0FF09310F158499E81AAB392CB74ED45CB91

Function 00B0719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B07206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B0723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B0724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B072CF

Strings

DllGetClassObject, xrefs: 00B07242

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 12410d4963a71c42a10fd6dc1108f934139b61227331bc896b3434341b5dee7a
Instruction ID: 2568dca1bdbd48fb0aaf6c728c3350373ccb359885f0d1223a0e2f45551581d0
Opcode Fuzzy Hash: 12410d4963a71c42a10fd6dc1108f934139b61227331bc896b3434341b5dee7a
Instruction Fuzzy Hash: 42416071A44204AFDB15CF54C884A9ABFE9EF45350F2580EDBD059F24ADBB0ED44DBA0

Function 00B33D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B33E35
IsMenu.USER32(?), ref: 00B33E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B33E92
DrawMenuBar.USER32 ref: 00B33EA5

Strings

0, xrefs: 00B33D89

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: cfa02a16076cb1beef0acf9fb8d2367a59fb1c1024c60750409185fd66f5a821
Instruction ID: d387dcb0c1aab7659aec8168301d712567ca7e3a5e61fffab4a08274eb1d3fb7
Opcode Fuzzy Hash: cfa02a16076cb1beef0acf9fb8d2367a59fb1c1024c60750409185fd66f5a821
Instruction Fuzzy Hash: 77414875A00219EFDB10DF94D884EAABBF9FF49750F2441A9E905AB250DB30AE45CF60

Function 00B01DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Part of subcall function 00B03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B03CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B01E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B01E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00B01EA9

Part of subcall function 00AA6B57: _wcslen.LIBCMT ref: 00AA6B6A

Strings

ListBox, xrefs: 00B01E25
ComboBox, xrefs: 00B01DF0

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: ef0bfd22f78de4dbc9681b2ddc3187f7362e52611f510aadca9f0b78c93987bd
Instruction ID: 03a4e41b4d4a0cd43d231a07d502955cede380c11378e22f7ce26e4fd66b1539
Opcode Fuzzy Hash: ef0bfd22f78de4dbc9681b2ddc3187f7362e52611f510aadca9f0b78c93987bd
Instruction Fuzzy Hash: A421B771A00104BFDB189BA4DD46CFFBBF9EF46354F144559F815A71E1DB3849069620

Function 00B32F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B32F8D
LoadLibraryW.KERNEL32(?), ref: 00B32F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B32FA9
DestroyWindow.USER32(?), ref: 00B32FB1

Strings

SysAnimate32, xrefs: 00B32F68

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: e4b9b8b92a29ba704b460f81347ec51939bc7a6f2a7f56fb4014fa0328ae9199
Instruction ID: 591929f70b62befe8ebbc598f65501c2a19042f93c8fe69a01b0efb0dcd453d2
Opcode Fuzzy Hash: e4b9b8b92a29ba704b460f81347ec51939bc7a6f2a7f56fb4014fa0328ae9199
Instruction Fuzzy Hash: 62218C72204205ABEB104FA4DC81EBB77FDEB59364F204658FA50E72A0DB71DC919760

Function 00AC4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00AC4D1E,00AD28E9,?,00AC4CBE,00AD28E9,00B688B8,0000000C,00AC4E15,00AD28E9,00000002), ref: 00AC4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AC4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00AC4D1E,00AD28E9,?,00AC4CBE,00AD28E9,00B688B8,0000000C,00AC4E15,00AD28E9,00000002,00000000), ref: 00AC4DC3

Strings

mscoree.dll, xrefs: 00AC4D86
CorExitProcess, xrefs: 00AC4D98

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 022ccf8da6227845dc46c425989fc546c9fb060447dd90414ac2a994d3b659a7
Instruction ID: b696c9dd974dcce193b93b9a819d7a072a1b5bfa7b0e35340d2f714607be7842
Opcode Fuzzy Hash: 022ccf8da6227845dc46c425989fc546c9fb060447dd90414ac2a994d3b659a7
Instruction Fuzzy Hash: 52F03C35A40208BBDB11AB90DC49FAEBFE5EF48751F1101A8E90AB2260CF745E40DB95

Function 00AA4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AA4EDD,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AA4EAE
FreeLibrary.KERNEL32(00000000,?,?,00AA4EDD,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00AA4EA8
kernel32.dll, xrefs: 00AA4E94

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: db1350036f5b492834b580897108c58df55a135f30b38e9a6a8bc25f890cdecd
Instruction ID: 103af36b1c969c8a6f3faf26b1be44d2b13a9ad3847cf8fc8fbdba541fff14f3
Opcode Fuzzy Hash: db1350036f5b492834b580897108c58df55a135f30b38e9a6a8bc25f890cdecd
Instruction Fuzzy Hash: 87E0CD36A059225BD23217657C18B9F7994AFC7F63B150115FC05F3150DFE4CD0156E0

Function 00AA4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AE3CDE,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AA4E74
FreeLibrary.KERNEL32(00000000,?,?,00AE3CDE,?,00B71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AA4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00AA4E6E
kernel32.dll, xrefs: 00AA4E5B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: ac0a71cc9e70931278bce62e381acb4ba0efd1e4cfe63ba1f83073b1bc1fc6c9
Instruction ID: a055cf9d0303eeb6cce3254395e3e240e30b937ad9d92770c5e2a14bf63626ad
Opcode Fuzzy Hash: ac0a71cc9e70931278bce62e381acb4ba0efd1e4cfe63ba1f83073b1bc1fc6c9
Instruction Fuzzy Hash: 1CD0C236502A215746321B647C18EDF7E98AFCAF113150111F905F31A0CFA0CD0192D0

Function 00B12947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B12C05
DeleteFileW.KERNEL32(?), ref: 00B12C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B12C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B12CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B12CC0

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 8894d7a069f48af8483192eeb93ea38a411469e0c39596108ab5b0b0569e95aa
Instruction ID: 287c0587019e182a2bc7a20f09509a90c6d3f765c2f0445b1b4b16ed20e236d9
Opcode Fuzzy Hash: 8894d7a069f48af8483192eeb93ea38a411469e0c39596108ab5b0b0569e95aa
Instruction Fuzzy Hash: EFB14C72D00119ABDF11DBA4CD85EDEBBBDEF49350F5040AAF609E7141EB309A948FA1

Function 00B2A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00B2A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00B2A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00B2A468
CloseHandle.KERNEL32(?), ref: 00B2A63D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 0ac5f9356c705041e1b2f4230a48ae82247c41af36627d5e8420f5a27879b1ed
Instruction ID: 3e0af0f2be96942c91575899bc471b59fad0f4ed3a50b6a91ebcd505098ec123
Opcode Fuzzy Hash: 0ac5f9356c705041e1b2f4230a48ae82247c41af36627d5e8420f5a27879b1ed
Instruction Fuzzy Hash: FCA17F71604301AFE720DF24D986F2AB7E5AF84714F14885DF55A9B3D2DBB0EC418B92

Function 00ADBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00B43700), ref: 00ADBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00B7121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00ADBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00B71270,000000FF,?,0000003F,00000000,?), ref: 00ADBC36
_free.LIBCMT ref: 00ADBB7F

Part of subcall function 00AD29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000), ref: 00AD29DE
Part of subcall function 00AD29C8: GetLastError.KERNEL32(00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000,00000000), ref: 00AD29F0

_free.LIBCMT ref: 00ADBD4B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 11f9192066450353ee29b6e14cf0f9000c273939d42ca14d8559594a82f90a69
Instruction ID: 1f8849aa37457a31fe8258cd1e4e9ca3e86b7384ecc06b6ddbb001ed0a71489b
Opcode Fuzzy Hash: 11f9192066450353ee29b6e14cf0f9000c273939d42ca14d8559594a82f90a69
Instruction Fuzzy Hash: 5951C571910209EFCB10EF699D819AEB7B8FF44350B12466BE456E73A1EF709E409B70

Function 00B0E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B0CF22,?), ref: 00B0DDFD

Part of subcall function 00B0DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B0CF22,?), ref: 00B0DE16

Part of subcall function 00B0E199: GetFileAttributesW.KERNEL32(?,00B0CF95), ref: 00B0E19A

lstrcmpiW.KERNEL32(?,?), ref: 00B0E473
MoveFileW.KERNEL32(?,?), ref: 00B0E4AC
_wcslen.LIBCMT ref: 00B0E5EB
_wcslen.LIBCMT ref: 00B0E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00B0E650

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 5bc9ccf679d28f76b93a3b59a7f0723c17894d7d6f3754ff41f70517daf5c787
Instruction ID: c911bcdcf880cc132739f93d2cbecf481410db6a19d91f2217ca4ccdd16b31c1
Opcode Fuzzy Hash: 5bc9ccf679d28f76b93a3b59a7f0723c17894d7d6f3754ff41f70517daf5c787
Instruction Fuzzy Hash: 67518FB24083449BC724EBA4DC81ADFB7ECEF85340F00496EF59993191EF75E6888766

Function 00B2B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Part of subcall function 00B2C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2B6AE,?,?), ref: 00B2C9B5
Part of subcall function 00B2C998: _wcslen.LIBCMT ref: 00B2C9F1
Part of subcall function 00B2C998: _wcslen.LIBCMT ref: 00B2CA68
Part of subcall function 00B2C998: _wcslen.LIBCMT ref: 00B2CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B2BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B2BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B2BB63
RegCloseKey.ADVAPI32(?,?), ref: 00B2BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00B2BBB3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 19b02554da74fc4b4948da16ac871c796df4b00fe8a8644e87c2a2bffaebd6c4
Instruction ID: c7e114d2efdbe20e5973ad91a9e670bde9f0b22da481a263809e5190756ef8cc
Opcode Fuzzy Hash: 19b02554da74fc4b4948da16ac871c796df4b00fe8a8644e87c2a2bffaebd6c4
Instruction Fuzzy Hash: 5E61B031208241AFD714DF14D494E2ABBE5FF85348F1489ACF49A8B2A2DF31ED45CB92

Function 00B08BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B08BCD
VariantClear.OLEAUT32 ref: 00B08C3E
VariantClear.OLEAUT32 ref: 00B08C9D
VariantClear.OLEAUT32(?), ref: 00B08D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B08D3B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 69908abc108c5212fa916572fa4e31e4099b87d7e27c27dcc9aee91b183731cd
Instruction ID: 7499b61f8dd7426a7b85e42c30e2c88f3b2880d60fd0bae0ac65b2b95656dcd2
Opcode Fuzzy Hash: 69908abc108c5212fa916572fa4e31e4099b87d7e27c27dcc9aee91b183731cd
Instruction Fuzzy Hash: DB517DB5A00219EFCB10CF58C894AAABBF5FF89310B158669F945DB350E730EA11CF90

Function 00B18AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00B18BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00B18BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00B18C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00B18C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00B18C5F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: dc146317e7f6820f19bd823c42f96904ab857fd7160a97f0656ce6d593ef922a
Instruction ID: f9dfa906f05f1664f6bc1e1639c1c4c9a2ea795053712e376bf1e94492a661a8
Opcode Fuzzy Hash: dc146317e7f6820f19bd823c42f96904ab857fd7160a97f0656ce6d593ef922a
Instruction Fuzzy Hash: CA513035A00215DFCB05DF64C981AAEBBF5FF49314F088498E8496B3A2DB35ED51CB90

Function 00B28EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00B28F40
GetProcAddress.KERNEL32(00000000,?), ref: 00B28FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00B28FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00B29032
FreeLibrary.KERNEL32(00000000), ref: 00B29052

Part of subcall function 00ABF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00B11043,?,7529E610), ref: 00ABF6E6
Part of subcall function 00ABF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00AFFA64,00000000,00000000,?,?,00B11043,?,7529E610,?,00AFFA64), ref: 00ABF70D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: e71d1dca02844267b58940b30320eb7e8bb8d7a00a3f07039bec89bd00efa007
Instruction ID: 9ccb41d1a1876f7889c25f5be5005a27cf19f81264294818b1b10c843ea078f0
Opcode Fuzzy Hash: e71d1dca02844267b58940b30320eb7e8bb8d7a00a3f07039bec89bd00efa007
Instruction Fuzzy Hash: 24515C35A01215DFC711DF58D5948AEBBF1FF49314F0884A9E80AAB362DB31ED86CB90

Function 00B36B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00B36C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00B36C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00B36C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00B1AB79,00000000,00000000), ref: 00B36C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00B36CC7

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 91234cc0008848386cca3002039dc43bb952b57b3832f0968bf2e6072b8bef71
Instruction ID: 5f47505625142504154640b57b74b5815ffeb507a9cf18e4519efc24fcfc9a07
Opcode Fuzzy Hash: 91234cc0008848386cca3002039dc43bb952b57b3832f0968bf2e6072b8bef71
Instruction Fuzzy Hash: AB41E635A04104BFDB24CF68CC95FA9BFE4EB09350F6592A8F899A72E0D771ED41CA50

Function 00AD2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00AD20C3
_free.LIBCMT ref: 00AD20E3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e7eb7cee21afe6a5b153a8f44983ad240ff86d0b1ee0ebbba56a3b6e4ff1234d
Instruction ID: 49c7f63668ff0a9b79fc3c472bd6293254cec7b52614e969864587b2a4d4ff96
Opcode Fuzzy Hash: e7eb7cee21afe6a5b153a8f44983ad240ff86d0b1ee0ebbba56a3b6e4ff1234d
Instruction Fuzzy Hash: C841B632A00200AFCB24DF78C981B6DB7B5EF99714F154569E516EB391DA31ED01DB80

Function 00AB912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00AB9141
ScreenToClient.USER32(00000000,?), ref: 00AB915E
GetAsyncKeyState.USER32(00000001), ref: 00AB9183
GetAsyncKeyState.USER32(00000002), ref: 00AB919D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 75ea90d57ef912d3375f15e8942624de2bd4c2561916256da24b674a4c0a88a0
Instruction ID: bf075eb6c8dfd10ba95b2dfc7142a85dbfadb349be22ab327db1b703fbf6b8dc
Opcode Fuzzy Hash: 75ea90d57ef912d3375f15e8942624de2bd4c2561916256da24b674a4c0a88a0
Instruction Fuzzy Hash: CF414D7190850AAADB159FA8D844BFEBB74FF05320F208319F529A72A1CB345954DB51

Function 00B13874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00B138CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00B13922
TranslateMessage.USER32(?), ref: 00B1394B
DispatchMessageW.USER32(?), ref: 00B13955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B13966

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 0ba67dfead616cc1ba57ad6c3c10766081e46ab41bfc1063908a74cdeb08f994
Instruction ID: a4e830e2d66bb921c0c3c9e743f437661dd5aa28255e1270a2b4c696b1523622
Opcode Fuzzy Hash: 0ba67dfead616cc1ba57ad6c3c10766081e46ab41bfc1063908a74cdeb08f994
Instruction Fuzzy Hash: 7C31C6705043419EEB35CB789849BF63BE8EB15740F9405E9E467D30A0FBB4AAC5CB21

Function 00B1CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00B1C21E,00000000), ref: 00B1CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00B1CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00B1C21E,00000000), ref: 00B1CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B1C21E,00000000), ref: 00B1CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B1C21E,00000000), ref: 00B1CFF2

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 789d8552d9e2e4bb5ff49438d31842f3bc46f23515d942370670fba7b40c1b82
Instruction ID: 3a0266afb8d6b4a475814b10db4024c238a539b77040dc654d43021df03cb63b
Opcode Fuzzy Hash: 789d8552d9e2e4bb5ff49438d31842f3bc46f23515d942370670fba7b40c1b82
Instruction Fuzzy Hash: 1B313A71540205AFDB20DFA5C984AABBFF9EB14354B6044AEF516E3141DB30EE8A9B60

Function 00B01901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B01915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00B019C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00B019C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00B019DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00B019E2

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 847de4d0c25f22cd1b65ecb871533157b62ed02526744cecf1a8f9bf6b32201a
Instruction ID: 1fe31bbc1d37416820057684b7057e08fa8c3857661e5e71080e06d76c3129c3
Opcode Fuzzy Hash: 847de4d0c25f22cd1b65ecb871533157b62ed02526744cecf1a8f9bf6b32201a
Instruction Fuzzy Hash: 2231C071A00219EFCB04CFACCD99ADE3FB5EB45315F108669FA21A72D1C7709945DB90

Function 00B35706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B35745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00B3579D
_wcslen.LIBCMT ref: 00B357AF
_wcslen.LIBCMT ref: 00B357BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B35816

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 4710f3a895467bb966cf1ddeb9389c26deb780db20c2c186fd2ee5ed3ef70ae9
Instruction ID: 66875b469e4780e3f7782e4d46ac7cd28a65b5b9b632d92b3cc860349ffdd4eb
Opcode Fuzzy Hash: 4710f3a895467bb966cf1ddeb9389c26deb780db20c2c186fd2ee5ed3ef70ae9
Instruction Fuzzy Hash: 55216575904618DADB309FA4DC85AED7BF8FF04724F208296E929EB2C4D7709985CF50

Function 00B20930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B20951
GetForegroundWindow.USER32 ref: 00B20968
GetDC.USER32(00000000), ref: 00B209A4
GetPixel.GDI32(00000000,?,00000003), ref: 00B209B0
ReleaseDC.USER32(00000000,00000003), ref: 00B209E8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 5b7ffe03b2465619dbfa738b03c369bab33f021ac9da27bb25ca67a49ea7e7d8
Instruction ID: fbefa2ab662b00351e0263bc8ff62bfbd95d5dc4f83b5c1dbd2a4ca8c5ed6c4a
Opcode Fuzzy Hash: 5b7ffe03b2465619dbfa738b03c369bab33f021ac9da27bb25ca67a49ea7e7d8
Instruction Fuzzy Hash: 0B219635600214AFD704EFA9D985A9EBBF5EF49700F148468F84AE7762CB30EC44CB50

Function 00ADCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00ADCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00ADCDE9

Part of subcall function 00AD3820: RtlAllocateHeap.NTDLL(00000000,?,00B71444,?,00ABFDF5,?,?,00AAA976,00000010,00B71440,00AA13FC,?,00AA13C6,?,00AA1129), ref: 00AD3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00ADCE0F
_free.LIBCMT ref: 00ADCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00ADCE31

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: eb50f625e7fc53623fcbb6f430161bb3c5d599feee09d55b4c22a02621933ad4
Instruction ID: 780b3add48663028d4156d4b469affb18eed32ff39e2b15d8dcd8afcdcb705c9
Opcode Fuzzy Hash: eb50f625e7fc53623fcbb6f430161bb3c5d599feee09d55b4c22a02621933ad4
Instruction Fuzzy Hash: B10175B26016167F672117BA6C48D7FBE6DEEC6BB1365012AF906D7301EE618D01D2B0

Function 00AB9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AB9693
SelectObject.GDI32(?,00000000), ref: 00AB96A2
BeginPath.GDI32(?), ref: 00AB96B9
SelectObject.GDI32(?,00000000), ref: 00AB96E2

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 4e94147e625b4881742c937bc6f1e5ab280f5de0b8f709f0d68e1d4f61b2d56a
Instruction ID: b2708fd143ff2b435a4286620f2ab2284bb2e88d75b7a971d7cf876d4e1a6b3b
Opcode Fuzzy Hash: 4e94147e625b4881742c937bc6f1e5ab280f5de0b8f709f0d68e1d4f61b2d56a
Instruction Fuzzy Hash: E3217F31802305EBDB119F6CDC29BEE7BB8BB10315F100616F619A71B2DB705893CBA0

Function 00AB990E Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00AB98CC
SetTextColor.GDI32(?,?), ref: 00AB98D6
SetBkMode.GDI32(?,00000001), ref: 00AB98E9
GetStockObject.GDI32(00000005), ref: 00AB98F1
GetWindowLongW.USER32(?,000000EB), ref: 00AB9952

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 4308b22a024f02154323d69ca5f3e05c640e3debfa5969d1b5655c41c23cab7f
Instruction ID: c0caf4516d51bef4544a0e8878768d0a789a328dcefab351536017d8a3383a18
Opcode Fuzzy Hash: 4308b22a024f02154323d69ca5f3e05c640e3debfa5969d1b5655c41c23cab7f
Instruction Fuzzy Hash: E111C832146250AFCB128FA5EC5AEEF3F78EB127117140559F642AB5B3CB254991CB50

Function 00B05711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00B05726
_memcmp.LIBVCRUNTIME ref: 00B05744
_memcmp.LIBVCRUNTIME ref: 00B05757
_memcmp.LIBVCRUNTIME ref: 00B0576F
_memcmp.LIBVCRUNTIME ref: 00B05787

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f0fbc94c84a3734daa93cd540428509f4e84a93067815a17c7e37d5c86f415fd
Instruction ID: 87bae541a8ebc7637d4a5f31b36627881209ab9ec1b12b4a5a6d738730a52d2d
Opcode Fuzzy Hash: f0fbc94c84a3734daa93cd540428509f4e84a93067815a17c7e37d5c86f415fd
Instruction Fuzzy Hash: 0701B9B5781605BBD72855109F82FBB77DCEF21398F504064FD049EAC2F760ED1096A1

Function 00AD2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00ACF2DE,00AD3863,00B71444,?,00ABFDF5,?,?,00AAA976,00000010,00B71440,00AA13FC,?,00AA13C6), ref: 00AD2DFD
_free.LIBCMT ref: 00AD2E32
_free.LIBCMT ref: 00AD2E59
SetLastError.KERNEL32(00000000,00AA1129), ref: 00AD2E66
SetLastError.KERNEL32(00000000,00AA1129), ref: 00AD2E6F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 36a6535faa40116864035dfc5eb8ee8f891eaea7f181f35d5d8ece0cfbf341a6
Instruction ID: 4a873a25afaffa9ac63104b05ff901ae621a273e1840b2b9573aeaca78779587
Opcode Fuzzy Hash: 36a6535faa40116864035dfc5eb8ee8f891eaea7f181f35d5d8ece0cfbf341a6
Instruction Fuzzy Hash: 0C01D1366056006B872227756D45F2B3F69ABF13A2B34442BF837A33D2EEB48801C320

Function 00B0000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00AFFF41,80070057,?,?,?,00B0035E), ref: 00B0002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00AFFF41,80070057,?,?), ref: 00B00046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00AFFF41,80070057,?,?), ref: 00B00054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00AFFF41,80070057,?), ref: 00B00064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00AFFF41,80070057,?,?), ref: 00B00070

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c016179a1144cd78d640625da959e6f06c7534a1668aec7cc22abde97fc01f2d
Instruction ID: d3a6a4bc0615d47e2d44f304dfdd2e17540f9929222137d3eef90a1755d06f40
Opcode Fuzzy Hash: c016179a1144cd78d640625da959e6f06c7534a1668aec7cc22abde97fc01f2d
Instruction Fuzzy Hash: BE01A276610208BFDB115FA8DC48BAE7EEDEF44751F248164F905E3250EB71DE408BA0

Function 00B0E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00B0E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00B0E9A5
Sleep.KERNEL32(00000000), ref: 00B0E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00B0E9B7
Sleep.KERNEL32 ref: 00B0E9F3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 639467a793eff54dcff6f2137b3f0bc9ab832519d36d9d190d6ea1b199c6c9af
Instruction ID: 4b11a12d4bd0cb563405a2a3524470e6305aa1515887d60a9929813a957728ab
Opcode Fuzzy Hash: 639467a793eff54dcff6f2137b3f0bc9ab832519d36d9d190d6ea1b199c6c9af
Instruction Fuzzy Hash: 4A011731C01A29DBCF00ABE5DD59AEDBFB8FB09701F100996E512B2291CF309654DBA1

Function 00B010F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B01114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00B00B9B,?,?,?), ref: 00B01120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B00B9B,?,?,?), ref: 00B0112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B00B9B,?,?,?), ref: 00B01136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B0114D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 87c662245a051cb078a1a5602809ce1cd84daf1fafa677aa46f8ffa075d592a6
Instruction ID: 1771060a834e1b86af07300fcfd135225a71c7b6266757d47b3247147b4ec232
Opcode Fuzzy Hash: 87c662245a051cb078a1a5602809ce1cd84daf1fafa677aa46f8ffa075d592a6
Instruction Fuzzy Hash: 45011979200615FFDB154FA9DC49A6A3FAEEF893A0B204459FA45E73A0DE31DC009B60

Function 00B00FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B00FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B00FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B00FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B00FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B01002

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 857c5f7680773c4d9e13ebe345748454a2469bc80579a48e5086d94e3ff1a02a
Instruction ID: 4ab8a7ab56a51bd17df94bdefefcd5c6a5594f806dbfb128eb91ade97e0ee0cf
Opcode Fuzzy Hash: 857c5f7680773c4d9e13ebe345748454a2469bc80579a48e5086d94e3ff1a02a
Instruction Fuzzy Hash: 37F04939200301BBDB264FA89C49F5A3FADEF89762F204854FA85E7291DE70DC508B60

Function 00B01014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B0102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B01036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B01045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B0104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B01062

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 08bb8aa7c873bb9854415df66526cfde67cde419e0fde532cf847aed6fc3e649
Instruction ID: 035601ad5c0324475d5dddc260bb1325bfbead68cabaf4d2844b1e1ed01c305c
Opcode Fuzzy Hash: 08bb8aa7c873bb9854415df66526cfde67cde419e0fde532cf847aed6fc3e649
Instruction Fuzzy Hash: 29F04939200301BFDB255FA8EC49F5A3FADEF89761F200814FA85E7290DE70D8508B60

Function 00B1030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00B1017D,?,00B132FC,?,00000001,00AE2592,?), ref: 00B10324
CloseHandle.KERNEL32(?,?,?,?,00B1017D,?,00B132FC,?,00000001,00AE2592,?), ref: 00B10331
CloseHandle.KERNEL32(?,?,?,?,00B1017D,?,00B132FC,?,00000001,00AE2592,?), ref: 00B1033E
CloseHandle.KERNEL32(?,?,?,?,00B1017D,?,00B132FC,?,00000001,00AE2592,?), ref: 00B1034B
CloseHandle.KERNEL32(?,?,?,?,00B1017D,?,00B132FC,?,00000001,00AE2592,?), ref: 00B10358
CloseHandle.KERNEL32(?,?,?,?,00B1017D,?,00B132FC,?,00000001,00AE2592,?), ref: 00B10365

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c39bbd742e3ae23b1bf95113c1bb4ecac39c3d3c45b65a00d675c0f45b8f4512
Instruction ID: 755911c0ae0b95c671ff4a2ab7f0f24ecc9145cfdcabaf408a538f302853cf6f
Opcode Fuzzy Hash: c39bbd742e3ae23b1bf95113c1bb4ecac39c3d3c45b65a00d675c0f45b8f4512
Instruction Fuzzy Hash: E201EE72800B019FCB30AF66E880842FBF9FF643053148A3FD1A252930C3B0A999CF84

Function 00ADD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00ADD752

Part of subcall function 00AD29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000), ref: 00AD29DE
Part of subcall function 00AD29C8: GetLastError.KERNEL32(00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000,00000000), ref: 00AD29F0

_free.LIBCMT ref: 00ADD764
_free.LIBCMT ref: 00ADD776
_free.LIBCMT ref: 00ADD788
_free.LIBCMT ref: 00ADD79A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 66ab9a0cfb7402804fd95cd45db0dfa22f41c7409606008875abadeb1b58bbdb
Instruction ID: 5e2360da156aa8fe7c8cb22b05ce717c8d25e723b2d966f529ca27d725ae0947
Opcode Fuzzy Hash: 66ab9a0cfb7402804fd95cd45db0dfa22f41c7409606008875abadeb1b58bbdb
Instruction Fuzzy Hash: D5F03632544204AB8625EB64FAC5D267BDDBB94750B940C47F09EE7781CB74FC80CB64

Function 00B05C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00B05C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00B05C6F
MessageBeep.USER32(00000000), ref: 00B05C87
KillTimer.USER32(?,0000040A), ref: 00B05CA3
EndDialog.USER32(?,00000001), ref: 00B05CBD

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 5120f64f02baf92bd14eeba76f555408d0eed5e682d497b10f36ed77d5376cd4
Instruction ID: f56ff2cfecac37cd53b6cf10396f1a066f08578c0f1d9861d8dbaf757d9b7dc0
Opcode Fuzzy Hash: 5120f64f02baf92bd14eeba76f555408d0eed5e682d497b10f36ed77d5376cd4
Instruction Fuzzy Hash: 9801FB31500B04ABFB315B50DE8EFAA7FA8EB04B45F141599A582A24E1DBB4A9848F90

Function 00AD22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AD22BE

Part of subcall function 00AD29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000), ref: 00AD29DE
Part of subcall function 00AD29C8: GetLastError.KERNEL32(00000000,?,00ADD7D1,00000000,00000000,00000000,00000000,?,00ADD7F8,00000000,00000007,00000000,?,00ADDBF5,00000000,00000000), ref: 00AD29F0

_free.LIBCMT ref: 00AD22D0
_free.LIBCMT ref: 00AD22E3
_free.LIBCMT ref: 00AD22F4
_free.LIBCMT ref: 00AD2305

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9ea776ef7fbcaa4476fe2890f9b55b3d590e652b4b784a63a64de2241f9f34fd
Instruction ID: 2ac0a475e415e6c523e48abe5af8690c76f95dda51972fe1eb95c8fb842db39b
Opcode Fuzzy Hash: 9ea776ef7fbcaa4476fe2890f9b55b3d590e652b4b784a63a64de2241f9f34fd
Instruction Fuzzy Hash: C8F03AB18101208F8622BF68BD11A683FA4B778760700094BF41AD73B2CF740891FBA4

Function 00AB95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00AB95D4
StrokeAndFillPath.GDI32(?,?,00AF71F7,00000000,?,?,?), ref: 00AB95F0
SelectObject.GDI32(?,00000000), ref: 00AB9603
DeleteObject.GDI32 ref: 00AB9616
StrokePath.GDI32(?), ref: 00AB9631

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 2a7cefe96edfff1e052ce37b9988dfb2f9db8c254e400dee032d2aed9866e059
Instruction ID: 1ce0757963b7c014628822a71ef7c0e40d138449d236fbe02914cd6b0965b9ed
Opcode Fuzzy Hash: 2a7cefe96edfff1e052ce37b9988dfb2f9db8c254e400dee032d2aed9866e059
Instruction Fuzzy Hash: 78F0B631005644EBDB265FADED187A97F65AB01322F148614E66A660F2CF308997DF20

Function 00AD0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00AD10F9
__freea.LIBCMT ref: 00AD1117

Part of subcall function 00AD1537: _free.LIBCMT ref: 00AD154F

Strings

am/pm, xrefs: 00AD117A
a/p, xrefs: 00AD11DE

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: b00c9ff40218c87cb55138337f199cf5b4451afe645aaed4d0969b4075a18df6
Instruction ID: 14f94ea2cf28f25464f0d1c2fd10fb1c8c20ddc492500320847321e6947d5e0c
Opcode Fuzzy Hash: b00c9ff40218c87cb55138337f199cf5b4451afe645aaed4d0969b4075a18df6
Instruction Fuzzy Hash: A8D1F031900206EADB689F68C989BFAB7B1EF05700F28426BE9079F751D3759D80CB91

Function 00B27B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00AC0242: EnterCriticalSection.KERNEL32(00B7070C,00B71884,?,?,00AB198B,00B72518,?,?,?,00AA12F9,00000000), ref: 00AC024D
Part of subcall function 00AC0242: LeaveCriticalSection.KERNEL32(00B7070C,?,00AB198B,00B72518,?,?,?,00AA12F9,00000000), ref: 00AC028A

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Part of subcall function 00AC00A3: __onexit.LIBCMT ref: 00AC00A9

__Init_thread_footer.LIBCMT ref: 00B27BFB

Part of subcall function 00AC01F8: EnterCriticalSection.KERNEL32(00B7070C,?,?,00AB8747,00B72514), ref: 00AC0202
Part of subcall function 00AC01F8: LeaveCriticalSection.KERNEL32(00B7070C,?,00AB8747,00B72514), ref: 00AC0235

Strings

Variable must be of type 'Object'., xrefs: 00B27C3A
G, xrefs: 00B27C7F
5, xrefs: 00B27C78

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: f76d43c39b8e344fecaf7f86881cc7f64c238c526e7935bc24ca6b7cedfead6c
Instruction ID: f1a214c85a3064e782589bdb183afa5db492d522fdb668a20c1756f81c97dc88
Opcode Fuzzy Hash: f76d43c39b8e344fecaf7f86881cc7f64c238c526e7935bc24ca6b7cedfead6c
Instruction Fuzzy Hash: 3D919E70A44219EFCB14EF94E990DADB7F1FF49340F108099F80A6B2A2DB31AE41CB55

Function 00B02716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B021D0,?,?,00000034,00000800,?,00000034), ref: 00B0B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B02760

Part of subcall function 00B0B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B021FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00B0B3F8

Part of subcall function 00B0B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00B0B355
Part of subcall function 00B0B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B02194,00000034,?,?,00001004,00000000,00000000), ref: 00B0B365
Part of subcall function 00B0B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B02194,00000034,?,?,00001004,00000000,00000000), ref: 00B0B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B027CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B0281A

Strings

@, xrefs: 00B02832

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: fdd48bb80db5a5290575e8bdfce70db1beebf170314ffb9bf7721165eadf36c7
Instruction ID: 357e3fe2aee6a53a5459dca160670608ca2b77766ff78c4819a080f5b5fc8819
Opcode Fuzzy Hash: fdd48bb80db5a5290575e8bdfce70db1beebf170314ffb9bf7721165eadf36c7
Instruction Fuzzy Hash: 7E41EB76900218AFDB10DFA4CD46EEEBBB8EF09700F108095FA55B7191DB716E49CBA1

Function 00AD172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\6eftz6UKDm.exe,00000104), ref: 00AD1769
_free.LIBCMT ref: 00AD1834
_free.LIBCMT ref: 00AD183E

Strings

C:\Users\user\Desktop\6eftz6UKDm.exe, xrefs: 00AD1760, 00AD1767, 00AD1796, 00AD17CE

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\6eftz6UKDm.exe
API String ID: 2506810119-2987197194
Opcode ID: deafea1c00ed99ed810e23e65adcde30bd0e328e1731a0f26bde168b7d6c42fe
Instruction ID: 4410268bc959d563fa023d2025b4fbfe26ebdc19dcc157895ebc05152ab91525
Opcode Fuzzy Hash: deafea1c00ed99ed810e23e65adcde30bd0e328e1731a0f26bde168b7d6c42fe
Instruction Fuzzy Hash: 11316E75A00218BFDB21DB99D985D9EBBFCEB95310B1441A7F806D7321DA708E80DBA0

Function 00B0C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00B0C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00B0C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00B71990,011C62F8), ref: 00B0C395

Strings

0, xrefs: 00B0C2DF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: e6f6d05b97cf3a773d8c0821cafea4e367f7346507f69f92f8aeffc6f9c14199
Instruction ID: a6b6bd5a3c21b4808a24be65918b4e207cc90b73be098e1057cc0bc476d3b6a2
Opcode Fuzzy Hash: e6f6d05b97cf3a773d8c0821cafea4e367f7346507f69f92f8aeffc6f9c14199
Instruction Fuzzy Hash: F5418E312043019FD720DF25D885B5ABFE4EF85360F148B9DF9A5972D2DB30A904CB66

Function 00B34416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00B3CC08,00000000,?,?,?,?), ref: 00B344AA
GetWindowLongW.USER32 ref: 00B344C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B344D7

Strings

SysTreeView32, xrefs: 00B3447C

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 3b97133095614dec1498e9ae1cf71a88c30836c924ca0a0054bfe3126cfa12ee
Instruction ID: a6ae8271684213eb9a162112d64250ccbfd13840d0c099dc2cdba9bb95fd6ee4
Opcode Fuzzy Hash: 3b97133095614dec1498e9ae1cf71a88c30836c924ca0a0054bfe3126cfa12ee
Instruction Fuzzy Hash: 29317A32210605ABDB209E78DC45BEA7BA9EB09324F314765F979A32E1DB70EC509B50

Function 00B2304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00B23077,?,?), ref: 00B23378

inet_addr.WSOCK32(?), ref: 00B2307A
_wcslen.LIBCMT ref: 00B2309B
htons.WSOCK32(00000000), ref: 00B23106

Strings

255.255.255.255, xrefs: 00B23095, 00B2309A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 90a009e40daaf348951560aeeea3cb39e1ebbb6150eae2b12b0ac4ecb6db92f1
Instruction ID: 00e8e479f67fac034b68db2fcf4ebfb100984c38b5561a377fb99da998882f8d
Opcode Fuzzy Hash: 90a009e40daaf348951560aeeea3cb39e1ebbb6150eae2b12b0ac4ecb6db92f1
Instruction Fuzzy Hash: C131F3392002219FCB10CF68D586FAA77E0EF14718F248099E8199B392CB3AEF41C770

Function 00B33EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B33F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B33F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B33F78

Strings

SysMonthCal32, xrefs: 00B33F0B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 1c6b098c9821674f239b2e5d1773c190fece5ec5e63e2015e722462f942e8717
Instruction ID: 26663118620a4d58a8ac7184e48e7ea0e2c5839b3867567054f64fd1713ead9f
Opcode Fuzzy Hash: 1c6b098c9821674f239b2e5d1773c190fece5ec5e63e2015e722462f942e8717
Instruction Fuzzy Hash: 19219F32600219BBDF219F94DC46FEB3BB9EB48714F210254FA157B1D0DAB5A9908BA0

Function 00B34653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00B34705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00B34713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00B3471A

Strings

msctls_updown32, xrefs: 00B34684

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 5f09a37cf29e9105cebd25b24352c8a863b182c88fb63cfa9b442ced9c2382ef
Instruction ID: 2e815d4b9ed2d0562351274e688b4677be74f74a5424f697d2a4cdaef2dfe3d9
Opcode Fuzzy Hash: 5f09a37cf29e9105cebd25b24352c8a863b182c88fb63cfa9b442ced9c2382ef
Instruction Fuzzy Hash: 08214CB5600208AFDB10DF68DC81DAA37EDEB5A3A4B140499FA059B291CB70FC52CA60

Function 00B095AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B0961D

Strings

#notrayicon, xrefs: 00B095B7
#OnAutoItStartRegister, xrefs: 00B095F3
#requireadmin, xrefs: 00B095D9

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: e4f58c92f9fe0c57b65f5e7141e6ea34cf82850e8652e2c4459714617006c5ac
Instruction ID: 49f23dc81f8686a6fc344ffdea7b474c6cfbbb85b2bec0650d46455f8baf50ed
Opcode Fuzzy Hash: e4f58c92f9fe0c57b65f5e7141e6ea34cf82850e8652e2c4459714617006c5ac
Instruction Fuzzy Hash: B02157722046116AD331BB259D42FBBBBD8EFA5300F14406AF949970C3EB66ED41C3D5

Function 00B337B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B33840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B33850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B33876

Strings

Listbox, xrefs: 00B3380F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 2112801a539cdb9e4d5cbe19b0ca1418a930435dc3b23b4419dcd9986a877fd1
Instruction ID: b0a9ee486d5003ea2cec3daa219ec71a0c0f8276e6cc521e0d1931f7a0075eec
Opcode Fuzzy Hash: 2112801a539cdb9e4d5cbe19b0ca1418a930435dc3b23b4419dcd9986a877fd1
Instruction Fuzzy Hash: 0A21A472610218BBEF218F54DC85FBB37EEEF89B54F218154F9059B190CA71DC5287A0

Function 00B149F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B14A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00B14A5C
SetErrorMode.KERNEL32(00000000,?,?,00B3CC08), ref: 00B14AD0

Strings

%lu, xrefs: 00B14A6F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: ad8ce5dfd99672438e667a9fb036fd3a118637981aae1b03ca3b480c8fba20d7
Instruction ID: 1447aaa2aa708bdca3bfd3dc56399def61ea26b820e69b992986dca5b828122e
Opcode Fuzzy Hash: ad8ce5dfd99672438e667a9fb036fd3a118637981aae1b03ca3b480c8fba20d7
Instruction Fuzzy Hash: 09316575A00109AFD710DF54C985EAEBBF8EF09318F148095F509EB262DB71ED45CB61

Function 00B341EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B3424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B34264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B34271

Strings

msctls_trackbar32, xrefs: 00B34226

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 8781df4b4f7c05d5d42453fb9d0d912892bbba8e32bd7d287d740a031ef7ece9
Instruction ID: 48f35ef448706b0fed6d969a13451bece13363efba99369aeb4a35183aae39e9
Opcode Fuzzy Hash: 8781df4b4f7c05d5d42453fb9d0d912892bbba8e32bd7d287d740a031ef7ece9
Instruction Fuzzy Hash: 6D119E31250248BEEF205E69CC46FAB3BECEB95B64F214524FA55E60A0D671E8519B20

Function 00B02F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA6B57: _wcslen.LIBCMT ref: 00AA6B6A

Part of subcall function 00B02DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B02DC5
Part of subcall function 00B02DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B02DD6
Part of subcall function 00B02DA7: GetCurrentThreadId.KERNEL32 ref: 00B02DDD
Part of subcall function 00B02DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B02DE4

GetFocus.USER32 ref: 00B02F78

Part of subcall function 00B02DEE: GetParent.USER32(00000000), ref: 00B02DF9

GetClassNameW.USER32(?,?,00000100), ref: 00B02FC3
EnumChildWindows.USER32(?,00B0303B), ref: 00B02FEB

Strings

%s%d, xrefs: 00B02FFF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: cd3b5e3f3448e9616aafd2b04ab3d5a4da59151f778f63777a925cafb48f4191
Instruction ID: c7487b750f10b20e313aea07aa0f158331cc09a25511bcd4d21883ea8e1f4953
Opcode Fuzzy Hash: cd3b5e3f3448e9616aafd2b04ab3d5a4da59151f778f63777a925cafb48f4191
Instruction Fuzzy Hash: 8111A2716002056BDF157FA48D8AFED7BEEAF84304F1440B9F909AB1D2DE3099498B70

Function 00B35882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B358C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B358EE
DrawMenuBar.USER32(?), ref: 00B358FD

Strings

0, xrefs: 00B3588F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 81b99fa77ea226b71e075bd93fdf8634dbeacf721fe4d0d3822ab6c3061a133a
Instruction ID: 7bb82e104463b28752491e38a6aa6c01701ec2aec429442bd868a5a4684bdd50
Opcode Fuzzy Hash: 81b99fa77ea226b71e075bd93fdf8634dbeacf721fe4d0d3822ab6c3061a133a
Instruction Fuzzy Hash: CE012D31500218EFDB219F51DC85BEEBBB9FB45361F2480D9E849D6251DB309A94EF31

Function 00B0007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5770f61f7d5c910dde0dc6a70c425a9cfbcd4b7c9d5809f0455f20a5ba8048b5
Instruction ID: 1d984fb823ecd9b972eb288014b59259ecf6dc4f349f0b03f52d86de6a809bb9
Opcode Fuzzy Hash: 5770f61f7d5c910dde0dc6a70c425a9cfbcd4b7c9d5809f0455f20a5ba8048b5
Instruction Fuzzy Hash: 71C13775A1020AEFDB15DFA4C894BAEBBB5FF48304F208598E505EB291D731EE41CB94

Function 00AD3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00AD3F0B
__alldvrm.LIBCMT ref: 00AD410C
__alldvrm.LIBCMT ref: 00AD412E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 74e734fc262ba0004de3aa167af007f5ad8203de4d5f6eeb3d8ad998a110cc7c
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: A4A13772D003869FEB25CF18C8917AEBBF5EF69350F18426FE5969B381C2388941C751

Function 00B2342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B23459
CoUninitialize.OLE32 ref: 00B23463
VariantInit.OLEAUT32(?), ref: 00B2346E
VariantClear.OLEAUT32(?), ref: 00B2371B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 6b301e6126365fd4b59712e15f67c5509bc07f577d6c5dfc4cf04c6888e5ded2
Instruction ID: 5f5e3fae79927ed006117f5ff4b5f48b41f373a8692586551b08cde933ffe858
Opcode Fuzzy Hash: 6b301e6126365fd4b59712e15f67c5509bc07f577d6c5dfc4cf04c6888e5ded2
Instruction Fuzzy Hash: D5A16D756043119FC700EF24D985A2EB7E5FF89714F048899F98A9B3A2DB34EE01CB91

Function 00B00436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00B3FC08,?), ref: 00B005F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00B3FC08,?), ref: 00B00608
CLSIDFromProgID.OLE32(?,?,00000000,00B3CC40,000000FF,?,00000000,00000800,00000000,?,00B3FC08,?), ref: 00B0062D
_memcmp.LIBVCRUNTIME ref: 00B0064E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 3ce6332cc4d67cd5605211ab6c80e39e2dddbd79a8868caf8f3162735452f3e0
Instruction ID: 888a84b7355de5a58fd8cbaaa89bc4b9bf365f4c9948778ae298656a71923c6d
Opcode Fuzzy Hash: 3ce6332cc4d67cd5605211ab6c80e39e2dddbd79a8868caf8f3162735452f3e0
Instruction Fuzzy Hash: B781EE75A10109EFCB04DF94C984EEEBBF9FF89315F204598E516AB290DB71AE05CB60

Function 00B2A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B2A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00B2A6BA

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00B2A79C
CloseHandle.KERNEL32(00000000), ref: 00B2A7AB

Part of subcall function 00ABCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00AE3303,?), ref: 00ABCE8A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: e25b6aa759bb51a2321824c61574f7a2a9d09069298b48345f4c559732d5913a
Instruction ID: 3a9b4f638c8fada9f0cb94131199d44bebe0cb2693496e186920441aef4e7b25
Opcode Fuzzy Hash: e25b6aa759bb51a2321824c61574f7a2a9d09069298b48345f4c559732d5913a
Instruction Fuzzy Hash: 59514C71508310AFD710EF24D986E6BBBE8FF89754F00895DF59997292EB30D904CB92

Function 00AE1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00AE14C0

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6fb518712003663e6bd011f6a93b868853baa288a6e0c39d7aa6e686b5d7bdc9
Instruction ID: 56d23e42f2474cee3c0db800be2c7658a5719a0ddae2eb282c1341b7eba3b5f6
Opcode Fuzzy Hash: 6fb518712003663e6bd011f6a93b868853baa288a6e0c39d7aa6e686b5d7bdc9
Instruction Fuzzy Hash: DF415CB1A00561ABDB216BBA8D45BBE3AF5EF41330F15422AF41AD73D2E63488419361

Function 00B36278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B362E2
ScreenToClient.USER32(?,?), ref: 00B36315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00B36382

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 51f874f72453d59638f77eeca9508354d002695b8aedd4a0430847dffa99af07
Instruction ID: c2df02068af4e2a5099a4dfd91394345eedcf07d2e2543535ba2db1f031dd985
Opcode Fuzzy Hash: 51f874f72453d59638f77eeca9508354d002695b8aedd4a0430847dffa99af07
Instruction Fuzzy Hash: 74512A75A00209EFCB14DF68D881AAE7BF5EB45360F208599F9559B2A0DB30ED81CB50

Function 00B21AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00B21AFD
WSAGetLastError.WSOCK32 ref: 00B21B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00B21B8A
WSAGetLastError.WSOCK32 ref: 00B21B94

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 3f6fdbfe69efc8a4fe28cc982e5bbf441d20e4e6c97e6b7273ca58b1703d4bcd
Instruction ID: 8c4f5287ddb4afc14f1f9eeaa351cc07f93d9ac0275d2fcd181901b98733a144
Opcode Fuzzy Hash: 3f6fdbfe69efc8a4fe28cc982e5bbf441d20e4e6c97e6b7273ca58b1703d4bcd
Instruction Fuzzy Hash: D841D234600210AFE720AF24D98AF6A77E5EB45718F548488F91A9F3D3D772DD418B90

Function 00ADB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4390cb0066a7d4c61633dc47aca3ccad195d028f5b5e2e7064a866d23a41a0c5
Instruction ID: 96c7ad1245768278f5f3992e1a7f0ee2fb1dad707bfb7c237176bc95996b5a78
Opcode Fuzzy Hash: 4390cb0066a7d4c61633dc47aca3ccad195d028f5b5e2e7064a866d23a41a0c5
Instruction Fuzzy Hash: 2F41E2B6A10354EFD724DF38C941BAABBB9EB88710F11852FF152DB382D771990187A0

Function 00B156D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00B15783
GetLastError.KERNEL32(?,00000000), ref: 00B157A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00B157CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00B157FA

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 783ccad5cc1cdf13e153297da33934e1cb815d46b4e1223d5bae4ca28d75eda3
Instruction ID: fe77daf749fdbb8867f7f80e58f33e92aff4074c4ac4bb44324a0ee6a824aa77
Opcode Fuzzy Hash: 783ccad5cc1cdf13e153297da33934e1cb815d46b4e1223d5bae4ca28d75eda3
Instruction Fuzzy Hash: D141EE35600611DFCB11EF55C585A5EBBE2EF89720F19C498E84A6B3A2CB34FD41CB91

Function 00ADD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00AC6D71,00000000,00000000,00AC82D9,?,00AC82D9,?,00000001,00AC6D71,8BE85006,00000001,00AC82D9,00AC82D9), ref: 00ADD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00ADD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00ADD9AB
__freea.LIBCMT ref: 00ADD9B4

Part of subcall function 00AD3820: RtlAllocateHeap.NTDLL(00000000,?,00B71444,?,00ABFDF5,?,?,00AAA976,00000010,00B71440,00AA13FC,?,00AA13C6,?,00AA1129), ref: 00AD3852

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 016a82a006063a095919f7ce0b5581cab022cc487fe0739bd224d22d5b361535
Instruction ID: faa9288d3a046d32e1e076f526d11507a5a8a63ae150b1ce3e678e5d4a91076c
Opcode Fuzzy Hash: 016a82a006063a095919f7ce0b5581cab022cc487fe0739bd224d22d5b361535
Instruction Fuzzy Hash: 4531E172A0020AABDF24CF64DC95EAE7BA5EB40310F154169FC05E7250EB36DD50CB90

Function 00B352C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00B35352
GetWindowLongW.USER32(?,000000F0), ref: 00B35375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B35382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B353A8

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 373a5ae92b169e32b899c45a6eda6febc0a603a7f2d4f84a57bd211b605a8560
Instruction ID: dd108bd414795780087aac621d27d72de63830fd7087d61baa52b60ac2869eff
Opcode Fuzzy Hash: 373a5ae92b169e32b899c45a6eda6febc0a603a7f2d4f84a57bd211b605a8560
Instruction Fuzzy Hash: 8931C434A95A0CEFEB309E58CC46BE837E5EB05390F784181FA12971E1C7B0AD80DB59

Function 00B0AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00B0ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00B0AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00B0AC74
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00B0ACC6

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c50a435c95d856e2e8f3a4c99140113a5d524e1da18e9b42fc92dd63484d4304
Instruction ID: 64ac2889beab969415f735c4b64a96dda914ea365095ebf7c5e0b1885f80a664
Opcode Fuzzy Hash: c50a435c95d856e2e8f3a4c99140113a5d524e1da18e9b42fc92dd63484d4304
Instruction Fuzzy Hash: 32311030A04718AFFB358B648C09BFE7FE5EB89310F098A9AE485971D1C77499858792

Function 00B37674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00B3769A
GetWindowRect.USER32(?,?), ref: 00B37710
PtInRect.USER32(?,?,00B38B89), ref: 00B37720
MessageBeep.USER32(00000000), ref: 00B3778C

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: f3188964a0088247dd81af40cbc37b765dd78529f29c76bda4652c560394253d
Instruction ID: 9ac490be080256f301f80a06e31f0efef747527f69b52700d32dfe56ed80073c
Opcode Fuzzy Hash: f3188964a0088247dd81af40cbc37b765dd78529f29c76bda4652c560394253d
Instruction Fuzzy Hash: 54418DB4645214EFCB22CF98C895EA97BF5FB49314F2580E8E5259B261CB30AD42CF90

Function 00B316DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00B316EB

Part of subcall function 00B03A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B03A57
Part of subcall function 00B03A3D: GetCurrentThreadId.KERNEL32 ref: 00B03A5E
Part of subcall function 00B03A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B025B3), ref: 00B03A65

GetCaretPos.USER32(?), ref: 00B316FF
ClientToScreen.USER32(00000000,?), ref: 00B3174C
GetForegroundWindow.USER32 ref: 00B31752

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: d724b5c15fec78197a2b96aa6709d22042bb743244e1babaa2ebf259b4c4b27b
Instruction ID: 98f974ee727f01e78d9e029da844a5181cabb3049ffce972984ee31b9a80cdba
Opcode Fuzzy Hash: d724b5c15fec78197a2b96aa6709d22042bb743244e1babaa2ebf259b4c4b27b
Instruction Fuzzy Hash: 583152B1E00249AFD700DFA9C981CAEBBFDEF49304B5484A9E415E7251DB31DE45CBA0

Function 00B38FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AB9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AB9BB2

GetCursorPos.USER32(?), ref: 00B39001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00AF7711,?,?,?,?,?), ref: 00B39016
GetCursorPos.USER32(?), ref: 00B3905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00AF7711,?,?,?), ref: 00B39094

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 8eea1ce6ff6c8293f671c39970e79a19918cdc9942e5e5b287763dc7701babef
Instruction ID: 30f3fd55d453ba21602eee8b0fab125aceca51ecb8bc47fbca83a23463f9be8b
Opcode Fuzzy Hash: 8eea1ce6ff6c8293f671c39970e79a19918cdc9942e5e5b287763dc7701babef
Instruction Fuzzy Hash: 6D21D135600118EFCB298F98CC59EFE3BF9EF49350F204095F90557261C771A991DB60

Function 00B0D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00B3CB68), ref: 00B0D2FB
GetLastError.KERNEL32 ref: 00B0D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B0D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00B3CB68), ref: 00B0D376

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: e986e7c15e15857c8474f85394886d7d57c219ecb9eebfe40d60870325eaf6ea
Instruction ID: b2639fcfec32c40d0e3f1db4ecce7958aa4733caf5777c4bc49d90864acd1c04
Opcode Fuzzy Hash: e986e7c15e15857c8474f85394886d7d57c219ecb9eebfe40d60870325eaf6ea
Instruction Fuzzy Hash: 02217C705083019FC700DFA8C98186FBBE4EE5A364F204A5DF499D72E1EB309946CB97

Function 00B01571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B01014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B0102A
Part of subcall function 00B01014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B01036
Part of subcall function 00B01014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B01045
Part of subcall function 00B01014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B0104C
Part of subcall function 00B01014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B01062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00B015BE
_memcmp.LIBVCRUNTIME ref: 00B015E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B01617
HeapFree.KERNEL32(00000000), ref: 00B0161E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 2c6ef1454f484f511427d1e39e4c10ba549b679479a9016f44f14e5047971896
Instruction ID: b75a6ad55ec4e235686297672c59d4982c25b8f974f288ebe6e896741e4b989b
Opcode Fuzzy Hash: 2c6ef1454f484f511427d1e39e4c10ba549b679479a9016f44f14e5047971896
Instruction Fuzzy Hash: 2F217C31E00108AFDB18DFA8CD45BEEBBF8EF44344F184899E441AB291E731AA45DB50

Function 00B32782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00B3280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B32824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B32832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00B32840

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: bd449c3c386442cb7454bc0e45f0b197e8cde241ea13b330186dfe05f35bd0d0
Instruction ID: f5734f314edb935942cac831cb84c4a5456a5fc26c72f893df81400cf4a5cf36
Opcode Fuzzy Hash: bd449c3c386442cb7454bc0e45f0b197e8cde241ea13b330186dfe05f35bd0d0
Instruction Fuzzy Hash: F721B331605511AFD7149B24C855FAA7B95FF46324F258198F4268B6E2CB71FC42C790

Function 00B078F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00B0790A,?,000000FF,?,00B08754,00000000,?,0000001C,?,?), ref: 00B08D8C
Part of subcall function 00B08D7D: lstrcpyW.KERNEL32(00000000,?,?,00B0790A,?,000000FF,?,00B08754,00000000,?,0000001C,?,?,00000000), ref: 00B08DB2
Part of subcall function 00B08D7D: lstrcmpiW.KERNEL32(00000000,?,00B0790A,?,000000FF,?,00B08754,00000000,?,0000001C,?,?), ref: 00B08DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00B08754,00000000,?,0000001C,?,?,00000000), ref: 00B07923
lstrcpyW.KERNEL32(00000000,?,?,00B08754,00000000,?,0000001C,?,?,00000000), ref: 00B07949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00B08754,00000000,?,0000001C,?,?,00000000), ref: 00B07984

Strings

cdecl, xrefs: 00B0797B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 15c15ac0493a1356e9d5f421b56396c14378426766a156baf634760f457bd0ff
Instruction ID: 2b1fc3aa76bde77fc61221e6dec68ddcbd09801fb59e722b1029c1edd099df6a
Opcode Fuzzy Hash: 15c15ac0493a1356e9d5f421b56396c14378426766a156baf634760f457bd0ff
Instruction Fuzzy Hash: 6411E13A200202BFCB159F38C845D7ABBE9EF85350B50806AE842C72A4EF31A911D7A1

Function 00B37CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00B37D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00B37D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00B37D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00B1B7AD,00000000), ref: 00B37D6B

Part of subcall function 00AB9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AB9BB2

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: b8e3cab28caeb0faee5fe75c0a0d24a67385155c9471fff964343dfdbaf09c12
Instruction ID: 71ea17539380beed1e9db98947c08abc920fc1c8f88f389844b20843318752c0
Opcode Fuzzy Hash: b8e3cab28caeb0faee5fe75c0a0d24a67385155c9471fff964343dfdbaf09c12
Instruction Fuzzy Hash: D911ACB6244654AFCB208F6CCC04AAA3BE4EF45360F218764F939D72E0DF308961DB50

Function 00B35660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00B356BB
_wcslen.LIBCMT ref: 00B356CD
_wcslen.LIBCMT ref: 00B356D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B35816

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 0c89f1b1888edc3b09b022baf76743bfbe48f49a58e9fbaebed9a68ac2945b94
Instruction ID: 240ab5193433ef508216d9cbc2ec9e1ac5a6180f434375ee881cd6d5d26bec26
Opcode Fuzzy Hash: 0c89f1b1888edc3b09b022baf76743bfbe48f49a58e9fbaebed9a68ac2945b94
Instruction Fuzzy Hash: 7911D37560061896DB30DFA5CCC6AEE77ECEF15760F7041AAF915D6181EB70DA80CB60

Function 00AD1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfab4b669815ca071df9ab3f53025906ec2918e561fe1a22e3ae9c9b14d25dc
Instruction ID: 24732365b8b49cfa5ec34d4a23cfa5bab1c46384f676abc061a2e74cab6b9a05
Opcode Fuzzy Hash: 8cfab4b669815ca071df9ab3f53025906ec2918e561fe1a22e3ae9c9b14d25dc
Instruction Fuzzy Hash: 590162B2209A167EF62126B87CC1F67766EDF917B8B340327F567613D2DB608C409270

Function 00B01A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00B01A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B01A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B01A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B01A8A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 62b555150a20a1b2a108d1c6cbb23530c12a8daaaecbc859c6387f03dde2066d
Instruction ID: dbe494d6e84d7763a378e6a46b7c88bf4a24b0cf4b8b5f25d9645ddea6e08d24
Opcode Fuzzy Hash: 62b555150a20a1b2a108d1c6cbb23530c12a8daaaecbc859c6387f03dde2066d
Instruction Fuzzy Hash: AE11FA3AA01219FFEB119BA9CD85FADBBB8EB04750F200491E614B7290DA716E50DB94

Function 00B0E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B0E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00B0E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B0E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B0E24D

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: addd8afd9413a2f4184b800a90f7a7aa88de5d3b191bab4181222c552192b7b9
Instruction ID: ef8002e9e89b4e4bffa6083bf083ed99e55d42b5020861f7123385c490180780
Opcode Fuzzy Hash: addd8afd9413a2f4184b800a90f7a7aa88de5d3b191bab4181222c552192b7b9
Instruction Fuzzy Hash: 7211A176904254BBC7019FECAC09A9E7FACEB45324F154A69F928E3291DAB0D94487A0

Function 00ACD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00ACCFF9,00000000,00000004,00000000), ref: 00ACD218
GetLastError.KERNEL32 ref: 00ACD224
__dosmaperr.LIBCMT ref: 00ACD22B
ResumeThread.KERNEL32(00000000), ref: 00ACD249

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 32145fd1844c4d15374d663edfd8ed4cea16e12c2e2593aa224a789f2af9f1c6
Instruction ID: a90bb23a25e9d30f8c8d512700d8a8a72ad39b91ca4ee613d9247db59698bd83
Opcode Fuzzy Hash: 32145fd1844c4d15374d663edfd8ed4cea16e12c2e2593aa224a789f2af9f1c6
Instruction Fuzzy Hash: 05018076805204BBDB215BA9DC09FEE7E69EF81731F22422DF925A61D0DF71C901D7A0

Function 00AA600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AA604C
GetStockObject.GDI32(00000011), ref: 00AA6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AA606A

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: c9b3b64f72f91e7236ca4a61495b0625baebcabf73070514a9a1e1add392e48b
Instruction ID: d749ad79949d33370d2aca1c5d72065f68ea9581c3cf43ccd612dfff49536ac9
Opcode Fuzzy Hash: c9b3b64f72f91e7236ca4a61495b0625baebcabf73070514a9a1e1add392e48b
Instruction Fuzzy Hash: 7B116D72501949BFEF124FA49C44EEABF6DEF093A5F194215FA1463150DB329CA0EFA0

Function 00AC3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00AC3B56

Part of subcall function 00AC3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00AC3AD2
Part of subcall function 00AC3AA3: ___AdjustPointer.LIBCMT ref: 00AC3AED

_UnwindNestedFrames.LIBCMT ref: 00AC3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00AC3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00AC3BA4

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 66a04a1d869950e0cdf5bb13ea439dbdb65293ffe8de1569a6c4a32ddb76f804
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 5901D733100149BBDF126F95CD46EEB7B6DEF58754F068018FE4866121C632E9619BA0

Function 00AD3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00AA13C6,00000000,00000000,?,00AD301A,00AA13C6,00000000,00000000,00000000,?,00AD328B,00000006,FlsSetValue), ref: 00AD30A5
GetLastError.KERNEL32(?,00AD301A,00AA13C6,00000000,00000000,00000000,?,00AD328B,00000006,FlsSetValue,00B42290,FlsSetValue,00000000,00000364,?,00AD2E46), ref: 00AD30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00AD301A,00AA13C6,00000000,00000000,00000000,?,00AD328B,00000006,FlsSetValue,00B42290,FlsSetValue,00000000), ref: 00AD30BF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 0d1989a52d1022e2790106119aa590c69a31e7eed13f2aaec88a12b75be1ce2e
Instruction ID: ebb143d9faea073a6fffa4f4d991eecbaf62ab193b52a03026e235580765cdf1
Opcode Fuzzy Hash: 0d1989a52d1022e2790106119aa590c69a31e7eed13f2aaec88a12b75be1ce2e
Instruction Fuzzy Hash: 0601F737701222ABCF314BB8AC44A5B7BA8AF05B61B240621F907F7340CB21D901C7E1

Function 00B07464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00B0747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00B07497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00B074AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00B074CA

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 4618238d7980e061c8aeb0facefd4d40aec48762c772ca754d3deb53ffd40033
Instruction ID: fee56db19181c9d57f01b22fed666847d10173763b33b94b4b06ce0471f8a3e2
Opcode Fuzzy Hash: 4618238d7980e061c8aeb0facefd4d40aec48762c772ca754d3deb53ffd40033
Instruction Fuzzy Hash: 3F11A5B56453149BE7208F54EC48F9ABFFCEB00700F108599A556D7291DB70F904DB90

Function 00B0B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B0ACD3,?,00008000), ref: 00B0B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B0ACD3,?,00008000), ref: 00B0B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B0ACD3,?,00008000), ref: 00B0B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B0ACD3,?,00008000), ref: 00B0B126

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 1cc80e1f234cc7c9cfe67fa5ee7b6ea25a57f69d2184e5e59cc915beb6aaf8a7
Instruction ID: f333a79e0e4da3b9ce0fe2d4a771abef6f28afd7a7f2452dc5669616c44ad783
Opcode Fuzzy Hash: 1cc80e1f234cc7c9cfe67fa5ee7b6ea25a57f69d2184e5e59cc915beb6aaf8a7
Instruction Fuzzy Hash: 8C113931C01928E7CF00AFE4E998AEEBFB8FF09711F204085D941B3181CF305A609B91

Function 00B02DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B02DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B02DD6
GetCurrentThreadId.KERNEL32 ref: 00B02DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B02DE4

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 68dc53d12940f1c1605e0ad1b05a2633211429303a292c152dc33efee3e0c3e7
Instruction ID: e7d80db41cc31785d2511c15d5d85596ed4b68347d4f8a27583ecc8a06840fa5
Opcode Fuzzy Hash: 68dc53d12940f1c1605e0ad1b05a2633211429303a292c152dc33efee3e0c3e7
Instruction Fuzzy Hash: 7DE06D711016247ADB201BA29C0EEEB3EACEB42BA1F200165B506E30809AA0C844C7B0

Function 00B38863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00AB9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AB9693
Part of subcall function 00AB9639: SelectObject.GDI32(?,00000000), ref: 00AB96A2
Part of subcall function 00AB9639: BeginPath.GDI32(?), ref: 00AB96B9
Part of subcall function 00AB9639: SelectObject.GDI32(?,00000000), ref: 00AB96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00B38887
LineTo.GDI32(?,?,?), ref: 00B38894
EndPath.GDI32(?), ref: 00B388A4
StrokePath.GDI32(?), ref: 00B388B2

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: e9403cd43884345fa7cf2fe108de89211a87e1fd735521089e8d8a6adf1c8820
Instruction ID: 618a08b7f96d188843ed0cb4fed212e643049274d1f11a2dca1993f8878fbaf4
Opcode Fuzzy Hash: e9403cd43884345fa7cf2fe108de89211a87e1fd735521089e8d8a6adf1c8820
Instruction Fuzzy Hash: D5F03A36045698BADB125F98AC09FCE3F69AF06310F248040FB12760E2CB755552DBA5

Function 00AB98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00AB98CC
SetTextColor.GDI32(?,?), ref: 00AB98D6
SetBkMode.GDI32(?,00000001), ref: 00AB98E9
GetStockObject.GDI32(00000005), ref: 00AB98F1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 97fac2afafd2dd5754c46cc2d314445956a7e22333ff246c14e5c8936c7a4d94
Instruction ID: a4d73356115d98faf36c557c4b6677229e9122babcbfdc2583161b6f0c5af825
Opcode Fuzzy Hash: 97fac2afafd2dd5754c46cc2d314445956a7e22333ff246c14e5c8936c7a4d94
Instruction Fuzzy Hash: 35E06531244644AADB215BB4AC09BED3F10AB11336F148219F7F5650E1C77146409B10

Function 00B0162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00B01634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00B011D9), ref: 00B0163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00B011D9), ref: 00B01648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00B011D9), ref: 00B0164F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: bdd293fc4fa3851b9d04bb01c8f730571b7c5e644ddd9d32a82860d7e716f3f4
Instruction ID: 8f1b5bc116ccca74bf5f4f1c458487157694c60a8c38d60de56fbde9a0251a10
Opcode Fuzzy Hash: bdd293fc4fa3851b9d04bb01c8f730571b7c5e644ddd9d32a82860d7e716f3f4
Instruction Fuzzy Hash: 54E08C32602211EBD7201FE4AE0DB8B3FBCEF44792F248848F245EA080EB348444CB68

Function 00AFD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00AFD858
GetDC.USER32(00000000), ref: 00AFD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00AFD882
ReleaseDC.USER32(?), ref: 00AFD8A3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f8db0f73a3b7575637ca4d37bc5aaaaf11c9d35360f38cccaed9b8c2c5ead22d
Instruction ID: 35e102deb06b1ea719f7306840f429b6aa64830a2f7a42ce7b1b2123659b4a7b
Opcode Fuzzy Hash: f8db0f73a3b7575637ca4d37bc5aaaaf11c9d35360f38cccaed9b8c2c5ead22d
Instruction Fuzzy Hash: E8E0EEB1800204EFCB41AFE09909A6DBFB6AB08310F208009F846E7260CB388901AF40

Function 00AFD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00AFD86C
GetDC.USER32(00000000), ref: 00AFD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00AFD882
ReleaseDC.USER32(?), ref: 00AFD8A3

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f75c17e53570466e86fb808c0c10bae6b4127064850c3184d653ad09c98ebc99
Instruction ID: 31586898d86c9dbae025b7c04a42a57f6921b23b12c39d643440399137ff39ec
Opcode Fuzzy Hash: f75c17e53570466e86fb808c0c10bae6b4127064850c3184d653ad09c98ebc99
Instruction Fuzzy Hash: 7EE092B5800604EFCB51AFE0D94D66DBFB5BB08311F248449F94AF7260DB389905EF50

Function 00B14D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA7620: _wcslen.LIBCMT ref: 00AA7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00B14ED4

Strings

LPT, xrefs: 00B14DFB
*, xrefs: 00B14E10

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 242f87928a75de5f825e95e229244c4571c7ef90468f52ad588916b7a0cd7526
Instruction ID: 503c3641bef2ef37bca95aa7d9dfa8728f68a7dd51ecd9d51e3d53541dc50393
Opcode Fuzzy Hash: 242f87928a75de5f825e95e229244c4571c7ef90468f52ad588916b7a0cd7526
Instruction Fuzzy Hash: 05914E75A002049FCB14DF58C584EAABBF5EF49304F5980D9E40A9F3A2D735EE86CB91

Function 00ACE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00ACE30D

Strings

pow, xrefs: 00ACE2E5, 00ACE302

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 3f06c317d414488da217314f0576030eeae553fc8b653249f6797fd653a7a33b
Instruction ID: 0951936a016ff3ccf52fb20f2fb460e6c6e25b35a06aeb124f0ed6375bbfb124
Opcode Fuzzy Hash: 3f06c317d414488da217314f0576030eeae553fc8b653249f6797fd653a7a33b
Instruction Fuzzy Hash: B6513A71A0C20296CB19F718CA42BBD3BA4AB40740F754D9EF0D7873A9FF358C959A46

Function 00ABE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00ABE1B1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: ba43ec0ae1e56c848e588d7bb3828d5977ba36d50afde594c48824eb588a9e7e
Instruction ID: 9a6222cd3d8cbfdeeee66695a2cdecff7aeae3941563a8362b014628a3fd1683
Opcode Fuzzy Hash: ba43ec0ae1e56c848e588d7bb3828d5977ba36d50afde594c48824eb588a9e7e
Instruction Fuzzy Hash: BC51353550428ADFDF15EFA8C0816FA7BB8EF26310F244065F9919B2E1DB349D42CBA0

Function 00ABF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00ABF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00ABF2BB

Strings

@, xrefs: 00ABF2AF

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: e48f51c1c8e83644c522e88857d93a400ff60e87cca254ac797d1bb7b4f92d1f
Instruction ID: 7a44677deacfad1bf89c0fcebeefe454daa6035caae625874e02bcd1e6df3843
Opcode Fuzzy Hash: e48f51c1c8e83644c522e88857d93a400ff60e87cca254ac797d1bb7b4f92d1f
Instruction Fuzzy Hash: 355134714087449FE320AF14DD86BAFBBF8FB85710F81885DF199421A5EB708529CB66

Function 00B25745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00B257E0
_wcslen.LIBCMT ref: 00B257EC

Strings

CALLARGARRAY, xrefs: 00B257E6, 00B257EB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 3dc591f714f6e9ae0e541303745a38a9ea77629b2f1522a8273b336619a3d542
Instruction ID: 375bc85d92a00d12b43923cf3bc1a1b419d27738e0c5035382be02ab5b261ed6
Opcode Fuzzy Hash: 3dc591f714f6e9ae0e541303745a38a9ea77629b2f1522a8273b336619a3d542
Instruction Fuzzy Hash: BB41B331E001199FCB14DFA8D9819FEBBF9FF59320F1040A9E509AB291EB749D81CB90

Function 00B1D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B1D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00B1D13A

Strings

|, xrefs: 00B1D10B

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: b71c253b25b857e117a65a547f31953e55ba1bb17e11412346f0cc940e15b714
Instruction ID: d76ca67f1c17f29550907ca2a8947d009a8d6640d7fc0ac1fa8d1a0c6ecd2d96
Opcode Fuzzy Hash: b71c253b25b857e117a65a547f31953e55ba1bb17e11412346f0cc940e15b714
Instruction Fuzzy Hash: ED312C72D00219ABCF15EFA4CD85AEEBFB9FF09340F500059F815B61A1DB35AA56CB50

Function 00B3356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00B33621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B3365C

Strings

static, xrefs: 00B335BC

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: c8e1cf686da276855b4f9aeb11c34b6d918f002e52f2679b7282c1593c632cd4
Instruction ID: bf73af9397943c3af09fedb5a8c14771149a7f2ea8737ac7b016bdefaab204ea
Opcode Fuzzy Hash: c8e1cf686da276855b4f9aeb11c34b6d918f002e52f2679b7282c1593c632cd4
Instruction Fuzzy Hash: 93319E71110604AEDB109F68DC81EFB73E9FF98B20F219619F8A5D7290DB30AD91C760

Function 00B34537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00B3461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B34634

Strings

', xrefs: 00B3458E

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 220b115f6e9895c718e3357e5ac561c74430c4f732dbf91779dd0b6602392304
Instruction ID: b44a47e0b78a1ccd07b497d0e4871f2626c4ffdcd7f151c0d10d7dba36af7889
Opcode Fuzzy Hash: 220b115f6e9895c718e3357e5ac561c74430c4f732dbf91779dd0b6602392304
Instruction Fuzzy Hash: 84312574A0020A9FDF14CFA9C981BDABBF5FF19300F2144AAE904AB381D770A941CF90

Function 00B331EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B3327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B33287

Strings

Combobox, xrefs: 00B33249

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 6b131e91a87b177d2ae4ab5194d9af040100fc31d7944fc69da634915dc3262d
Instruction ID: ae116f3da42401ae605f9b6bf53252b0191ca3605b672505cbd35c291d707bdc
Opcode Fuzzy Hash: 6b131e91a87b177d2ae4ab5194d9af040100fc31d7944fc69da634915dc3262d
Instruction Fuzzy Hash: 7B11C8713002087FFF219F54DC81EBB37EAEB54764F204264F51897290D671DD518760

Function 00B33710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00AA600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AA604C
Part of subcall function 00AA600E: GetStockObject.GDI32(00000011), ref: 00AA6060
Part of subcall function 00AA600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AA606A

GetWindowRect.USER32(00000000,?), ref: 00B3377A
GetSysColor.USER32(00000012), ref: 00B33794

Strings

static, xrefs: 00B33757

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: d7f797c82d9a16e65198638aaa90e84c02fa7c21abcc81520a674d8c9e67b3e9
Instruction ID: 2ae8dc0e7bb6453815c0d6eb7027c02bac08b637a7eb02813ee0fe598d4e764b
Opcode Fuzzy Hash: d7f797c82d9a16e65198638aaa90e84c02fa7c21abcc81520a674d8c9e67b3e9
Instruction Fuzzy Hash: 9F1126B2610209AFDF00DFA8CC46EEA7BF8EB08714F114954F955E3250EB39E8619B60

Function 00B1CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00B1CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00B1CDA6

Strings

<local>, xrefs: 00B1CD66

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: b831366131b4f3542494ad7700b3a5f5c62020a808a7458020471f074fd8a930
Instruction ID: d8f6ebe54d571403eb9c7e6ee8aefe5f77eb39008ecb18bf861fe9e18336c103
Opcode Fuzzy Hash: b831366131b4f3542494ad7700b3a5f5c62020a808a7458020471f074fd8a930
Instruction Fuzzy Hash: E2110671281631BAD7344B669C84EE7BEECEF127A4F9042B6B11993090D7709980D6F0

Function 00B33429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00B334AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00B334BA

Strings

edit, xrefs: 00B3348F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 9da34ccaa1c854225daf13f4069869f775259d27ce15cdf60f501441d71b57a9
Instruction ID: 3e4d8b5bf286bb0f17690089dcbacb80bbb67416f0c9995b220b520e5bf307a9
Opcode Fuzzy Hash: 9da34ccaa1c854225daf13f4069869f775259d27ce15cdf60f501441d71b57a9
Instruction Fuzzy Hash: 6F118F71100208ABEB124F64DC85AAB3BEAEB15B74F604764F965A72E0C771DC919B60

Function 00B06C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00B06CB6
_wcslen.LIBCMT ref: 00B06CC2

Strings

STOP, xrefs: 00B06CBC, 00B06CC1

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: a56f0eb495b09813a7bff5fbb19e9fd6242c7e8512e0c7775faf64c4457f3655
Instruction ID: f4ecf05cea2b1c3766c23eab6a0d7470449604d4b8f27bbf92dcf7b736d7d2cf
Opcode Fuzzy Hash: a56f0eb495b09813a7bff5fbb19e9fd6242c7e8512e0c7775faf64c4457f3655
Instruction Fuzzy Hash: FF01C032A0052A8BEB21AFBDDD819BF7BE5EA65710B100679E862971D0EB31D960C650

Function 00B01CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Part of subcall function 00B03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B03CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B01D4C

Strings

ListBox, xrefs: 00B01D16
ComboBox, xrefs: 00B01CEB

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 51fc3a52a658282b8d1e3bd74ab812f4460764cbbb61607628d640e7193297ad
Instruction ID: e5ef1873a167699f0ca0865b3e132cd28558856ffcfcc16ce396a3bf8dd1b544
Opcode Fuzzy Hash: 51fc3a52a658282b8d1e3bd74ab812f4460764cbbb61607628d640e7193297ad
Instruction Fuzzy Hash: C201B571601218ABCB18EFA4CD558FF7BE8EB46350B140A99F822672D1EA3459088660

Function 00B01BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Part of subcall function 00B03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B03CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00B01C46

Strings

ListBox, xrefs: 00B01C10
ComboBox, xrefs: 00B01BE5

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 8a07e5314a6092dbfded1ea49c36f625ef99bebac431a49c8a98a49db7a5ced3
Instruction ID: d38bdbdc74cca1e322ea372c2a2a0688551e608d7c55a85df07b8c39f2b9ea7f
Opcode Fuzzy Hash: 8a07e5314a6092dbfded1ea49c36f625ef99bebac431a49c8a98a49db7a5ced3
Instruction Fuzzy Hash: 5B01F7716801086BDB28EB94CA529FF7BE8DB16340F140499B406772C1EE24DE4886B1

Function 00B01C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Part of subcall function 00B03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B03CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00B01CC8

Strings

ListBox, xrefs: 00B01C94
ComboBox, xrefs: 00B01C69

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: fd4a2eb8273e92664683eb0ad60a5d4e5f89002f6611dabd5e472a8a80324e60
Instruction ID: ffd989195f0dac9a87e528556594b18fb59b74584fa5279a1ffaf539ebff1831
Opcode Fuzzy Hash: fd4a2eb8273e92664683eb0ad60a5d4e5f89002f6611dabd5e472a8a80324e60
Instruction Fuzzy Hash: 4701DB7164011867DB28EB94CB55AFF7BECDB12380F140455B801772C1EE24DF18C671

Function 00B01D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA9CB3: _wcslen.LIBCMT ref: 00AA9CBD

Part of subcall function 00B03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B03CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00B01DD3

Strings

ListBox, xrefs: 00B01DA0
ComboBox, xrefs: 00B01D75

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 8941de8a62a14f8a1a17c1ec61a8bd9102ab36698a3b5326332aa9aa12965513
Instruction ID: 53c4985bd6329f27dcc578924fd1f3a936136342a5f3f97db317b14462ab300e
Opcode Fuzzy Hash: 8941de8a62a14f8a1a17c1ec61a8bd9102ab36698a3b5326332aa9aa12965513
Instruction Fuzzy Hash: 9AF0F971A4161466D718EBA4CD92AFF7BECEB02350F040D95F422632C1DF6459088260

Function 00B2747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B27493
_wcslen.LIBCMT ref: 00B274B9

Strings

3, 3, 16, 1, xrefs: 00B27483

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 64314b9cc58334d9193530f0bea0d788aa0526c1d9b3f552f53439bc798498a6
Instruction ID: ef47896783fac19fde9a2a6ec60e751b5d77d92f49251f8e146aaaa2c97f76d2
Opcode Fuzzy Hash: 64314b9cc58334d9193530f0bea0d788aa0526c1d9b3f552f53439bc798498a6
Instruction Fuzzy Hash: 78E02B066542301092313279BDC1EBF56C9CFC9750710186FF999C236AEEA48D9293AC

Function 00B00B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00B00B23

Strings

Error allocating memory., xrefs: 00B00B1C
AutoIt, xrefs: 00B00B17

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 92dcc01d8d757b677076cfeb443b972e490ebe1c8cdc8c7b32fb1a821f18cde8
Instruction ID: a0b164f5bd323f98a5c75aae5ce9e17fde5a9b9e418c363d421d6581e0058fd4
Opcode Fuzzy Hash: 92dcc01d8d757b677076cfeb443b972e490ebe1c8cdc8c7b32fb1a821f18cde8
Instruction Fuzzy Hash: E4E0D8322443182AD21036947D03FC97FC8CF05B11F24046AFB58654D38BE1645007E9

Function 00AC0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00ABF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00AC0D71,?,?,?,00AA100A), ref: 00ABF7CE

IsDebuggerPresent.KERNEL32(?,?,?,00AA100A), ref: 00AC0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00AA100A), ref: 00AC0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00AC0D7F

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 48614ac4fab4c8af7e4c8f747f8ce5ce72b2fd10219c93358ce3838a1f8d437a
Instruction ID: 7e7074e66c8a27b06820b227f7237b4adf94d61ab1980ed2fe624ce322ede13d
Opcode Fuzzy Hash: 48614ac4fab4c8af7e4c8f747f8ce5ce72b2fd10219c93358ce3838a1f8d437a
Instruction Fuzzy Hash: F3E06D702003118BD3619FBCD904B567BE4AB00740F11496DE887D7661EFB4E4848BA1

Function 00B13017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00B1302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00B13044

Strings

aut, xrefs: 00B13038

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 88d1f87cff392d4d0d3b1bf1f5d99104bb84361694049390f1fd79b18db159ae
Instruction ID: d0f77de379d5532870f631cfd3f167c996d42a227e90dec48ff3a68bc35dfb95
Opcode Fuzzy Hash: 88d1f87cff392d4d0d3b1bf1f5d99104bb84361694049390f1fd79b18db159ae
Instruction Fuzzy Hash: 20D05E7254032867DA20A7E4AC0EFCB3F6CDB04750F0002A1BA55E30A1DEB49984CBD0

Function 00B32322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B3232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00B3233F

Part of subcall function 00B0E97B: Sleep.KERNEL32 ref: 00B0E9F3

Strings

Shell_TrayWnd, xrefs: 00B32325

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 0152af608e82e6fd7f61ad0c01f78029c2b3363cc4bd39c58aa33c3710cc21d9
Instruction ID: 2e773cf9b9ef47f4c363aaadf8e5b1fb74028b31592195ee84950eef5967d599
Opcode Fuzzy Hash: 0152af608e82e6fd7f61ad0c01f78029c2b3363cc4bd39c58aa33c3710cc21d9
Instruction Fuzzy Hash: AED0C936394310B6E664A7B09C0FFDA7E54AB10B10F1149567655BB1E0C9B4A8018B54

Function 00B32356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B3236C
PostMessageW.USER32(00000000), ref: 00B32373

Part of subcall function 00B0E97B: Sleep.KERNEL32 ref: 00B0E9F3

Strings

Shell_TrayWnd, xrefs: 00B32365

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 8f4483355796799d138f42632cf68eb3dff381adf1ec375ffab2ab329058ceb7
Instruction ID: 35ea3d2dc20da3d2ae143acfca3cc77d5f9c1fc5195e6362cfe33caa0b04ef20
Opcode Fuzzy Hash: 8f4483355796799d138f42632cf68eb3dff381adf1ec375ffab2ab329058ceb7
Instruction Fuzzy Hash: 2BD0C9323813107AE664A7B09C0FFCA7A54AB15B10F5149567655BB1E0C9B4A8018B54

Function 00ADBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00ADBE93
GetLastError.KERNEL32 ref: 00ADBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00ADBEFC

Memory Dump Source

Source File: 00000000.00000002.2144106435.0000000000AA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000000.00000002.2144062640.0000000000AA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144227467.0000000000B62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144333169.0000000000B6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2144379923.0000000000B74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aa0000_6eftz6UKDm.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 2a395a0463644f934f0975004d823af3bea72314187d1ad47d2fb3ac1eeaec5e
Instruction ID: 74ada38d48943c55b244f7ecbd0d1c7d5c07e81a884ff70a84d94336dd8cffe5
Opcode Fuzzy Hash: 2a395a0463644f934f0975004d823af3bea72314187d1ad47d2fb3ac1eeaec5e
Instruction Fuzzy Hash: 5C41C435610246EFCB21CFA5CD44BAA7BA5AF45310F26416AF95A9B3A1DB30DD00DB70

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6eftz6UKDm.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_fe196fc7-e3cf-4702-88c8-75667b87b689.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_fe196fc7-e3cf-4702-88c8-75667b87b689.json.tmp

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\jumpListCache\pV+3TL7Nu3EP5juvr_gPjg==.ico

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Local\Temp\tmpaddon

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HI9RRLU0LNABEM630DA0.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N4R6BRXWQ9IEQYC18WRN.temp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4 (copy)

Windows Analysis Report
6eftz6UKDm.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre