Edit tour

Windows Analysis Report
rpDOUhuBC5.exe

Overview

General Information

Sample name:	rpDOUhuBC5.exe renamed because original name is a hash value
Original sample name:	1f856d82c95fcef4439c2c9d442e44f4.exe
Analysis ID:	1581594
MD5:	1f856d82c95fcef4439c2c9d442e44f4
SHA1:	cb7fabe82a409e77c3d0d422117de414c08ce485
SHA256:	bc1a85c3048089f8730fe0c0c995fbede05597a6706be54c541add28cfe1d9af
Tags:	exeuser-abuse_ch
Infos:

Detection

Credential Flusher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Credential Flusher

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Connects to many different domains

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

rpDOUhuBC5.exe (PID: 3976 cmdline: "C:\Users\user\Desktop\rpDOUhuBC5.exe" MD5: 1F856D82C95FCEF4439C2C9D442E44F4)

taskkill.exe (PID: 2220 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6036 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5368 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2096 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1460 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7012 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6488 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5128 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4156 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccd16ed0-4054-4436-b362-dc6f5d23b61d} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a5db6e510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7888 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4088 -parentBuildID 20230927232528 -prefsHandle 3872 -prefMapHandle 3944 -prefsLen 26322 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb856fbc-54fb-4491-a5b4-616ae0b029ea} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a7168cb10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2732 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4996 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4992 -prefMapHandle 4968 -prefsLen 33093 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4751dff7-103a-4a3a-83fa-63f5327aa984} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a777a9710 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: rpDOUhuBC5.exe PID: 3976	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rpDOUhuBC5.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: rpDOUhuBC5.exe	ReversingLabs: Detection: 42%
Source: rpDOUhuBC5.exe	Virustotal: Detection: 27%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.4% probability

Machine Learning detection for sample

Source: rpDOUhuBC5.exe

Joe Sandbox ML: detected

Source: rpDOUhuBC5.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49924 version: TLS 1.2

Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.18.dr
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 00000012.00000003.2494493527.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 00000012.00000003.2495296928.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 00000012.00000003.2494493527.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 00000012.00000003.2491214347.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.18.dr
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 00000012.00000003.2495296928.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 00000012.00000003.2491214347.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0080DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	1_2_0080DBBE
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007DC2A2 FindFirstFileExW,	1_2_007DC2A2
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_008168EE FindFirstFileW,FindClose,	1_2_008168EE
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0081698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	1_2_0081698F
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0080D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0080D076
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0080D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0080D3A9
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00819642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00819642
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0081979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0081979D
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00819B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00819B2B
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00815C97 FindFirstFileW,FindNextFileW,FindClose,	1_2_00815C97

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 219MB

Source: unknown

Network traffic detected: DNS query count 31

Source: Joe Sandbox View	IP Address: 34.149.100.209 34.149.100.209
Source: Joe Sandbox View	IP Address: 151.101.129.91 151.101.129.91
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View	IP Address: 34.160.144.191 34.160.144.191

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0081CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

1_2_0081CE44

Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000012.00000003.2486953190.0000020A6E43C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2448880112.0000020A6EEE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.2301043912.0000020A79410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.2459308038.0000020A70E89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78CB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2324751198.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2440401313.0000020A78E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/8 equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2440401313.0000020A78E52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.2466477456.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431507460.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2452968433.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78CB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2324751198.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2440401313.0000020A78E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2440401313.0000020A78E52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D60A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D60A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D60A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D60A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB880C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D60A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB880C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D60A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB880C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.2459308038.0000020A70E89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://6edd4cbe-8a9f-4158-beca-90f5feba9c8c/injections/js/bug1842437-www.youtube.com-performance-now-precision.js equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.2466477456.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2467427061.0000020A78C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2309010335.0000020A78D3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000012.00000003.2467427061.0000020A78C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431741812.0000020A78C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2481280309.0000020A77653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
Source: firefox.exe, 00000012.00000003.2466477456.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431507460.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2452968433.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: firefox.exe, 00000012.00000003.2440947491.0000020A777A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2470570743.0000020A777A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2453912639.0000020A777A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2477352482.0000020A71ACE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2313220191.0000020A777A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 00000012.00000003.2445514137.0000020A6D758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 00000012.00000003.2449313983.0000020A6D758000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: firefox.exe, 00000012.00000003.2445514137.0000020A6D758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: firefox.exe, 00000012.00000003.2449313983.0000020A6D758000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: firefox.exe, 00000012.00000003.2449313983.0000020A6D758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 00000012.00000003.2451484824.0000020A79494000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2458680531.0000020A7164A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2430647745.0000020A79491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2466612893.0000020A78EBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2335284460.0000020A78E73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2452968433.0000020A78EBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431588951.0000020A78EBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2457706532.0000020A75EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2451528736.0000020A79491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000012.00000003.2473325527.0000020A7639A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000012.00000003.2335284460.0000020A78ECD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000012.00000003.2461131122.0000020A7046F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431077476.0000020A7940F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000012.00000003.2404612600.0000020A766C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2311178376.0000020A766C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000012.00000003.2304384500.0000020A719EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2459127630.0000020A70E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2428470851.0000020A6DFA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2406258379.0000020A6E4B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2403552922.0000020A78DA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2410306016.0000020A6E4B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2340272776.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2324526502.0000020A6EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2346346483.0000020A71895000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2395114152.0000020A71589000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2342261218.0000020A6EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2338321683.0000020A71895000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2478016249.0000020A704B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2335879130.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2411078653.0000020A78D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2303259858.0000020A79432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2346346483.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2447111884.0000020A6EECE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2303978709.0000020A78EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2337257621.0000020A71895000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2415991762.0000020A6EDE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000012.00000003.2445514137.0000020A6D758000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000012.00000003.2449313983.0000020A6D758000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 00000012.00000003.2449313983.0000020A6D758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 00000012.00000003.2484124580.0000020A71330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000012.00000003.2440947491.0000020A777BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2463274551.0000020A6FBF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2470279601.0000020A777BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2463069231.0000020A70147000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2313220191.0000020A777BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: mozilla-temp-41.18.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2459445118.0000020A70E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2477919664.0000020A70E69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2459445118.0000020A70E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2477919664.0000020A70E69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000012.00000003.2314496747.0000020A7674B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 00000012.00000003.2262317122.0000020A6DB53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261887126.0000020A6DB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261310402.0000020A6D900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2262142978.0000020A6DB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000012.00000003.2459867068.0000020A70E1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000012.00000003.2475514197.0000020A75E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001C.00000002.4047013315.0000022CB845A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.googl
Source: firefox.exe, 00000012.00000003.2320215441.0000020A71AF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2395750551.0000020A6F297000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2396220636.0000020A6F22B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2337160620.0000020A6F211000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2414845505.0000020A6F297000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2333322081.0000020A6F29F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2334808878.0000020A6F211000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2334060201.0000020A6F228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000012.00000003.2298010283.0000020A766B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2323849945.0000020A6E51F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2481280309.0000020A77653000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
Source: firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2481280309.0000020A77653000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
Source: firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2481280309.0000020A77653000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
Source: firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2481280309.0000020A77653000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
Source: firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2481280309.0000020A77653000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
Source: firefox.exe, 00000012.00000003.2323849945.0000020A6E51F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4040738/cookie_autodelete-3.8.2.xpi
Source: firefox.exe, 00000012.00000003.2298010283.0000020A766B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4128570/languagetool-7.1.13.xpi
Source: firefox.exe, 00000012.00000003.2298010283.0000020A766B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2323849945.0000020A6E51F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpi
Source: firefox.exe, 00000012.00000003.2298010283.0000020A766B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4134489/enhancer_for_youtube-2.0.119.1.xpi
Source: firefox.exe, 00000012.00000003.2323849945.0000020A6E51F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpi
Source: firefox.exe, 00000012.00000003.2298010283.0000020A766B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2323849945.0000020A6E51F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed
Source: firefox.exe, 00000012.00000003.2298010283.0000020A766B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/700/700308-64.png?modified=4bc8e79f
Source: firefox.exe, 00000012.00000003.2298010283.0000020A766B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/708/708770-64.png?modified=4f881970
Source: firefox.exe, 00000012.00000003.2323849945.0000020A6E51F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed
Source: firefox.exe, 00000012.00000003.2323849945.0000020A6E51F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956
Source: firefox.exe, 00000012.00000003.2440401313.0000020A78E52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads-us.rd.linksynergy.com/as.php
Source: firefox.exe, 00000012.00000003.2468356195.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2432875556.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2301043912.0000020A79410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2482241628.0000020A761C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000012.00000003.2478879853.0000020A7028A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2440947491.0000020A777A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2470570743.0000020A777A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2453912639.0000020A777A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7760B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2477352482.0000020A71ACE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000014.00000002.4049477961.0000020660FCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D6EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4052014983.0000022CB8A05000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: firefox.exe, 00000014.00000002.4049477961.0000020660FCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D6EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4052014983.0000022CB8A05000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 00000012.00000003.2452249604.0000020A79F80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000012.00000003.2385394411.0000020A6F372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1170143
Source: firefox.exe, 00000012.00000003.2382058159.0000020A6F371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2385394411.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 00000012.00000003.2382058159.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2385394411.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 00000012.00000003.2385394411.0000020A6F372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F345000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2386360448.0000020A6F32B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 00000012.00000003.2385394411.0000020A6F372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F345000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 00000012.00000003.2382058159.0000020A6F371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2385394411.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 00000012.00000003.2476398183.0000020A75E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000012.00000003.2476398183.0000020A75E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000012.00000003.2476398183.0000020A75E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000012.00000003.2476398183.0000020A75E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000012.00000003.2382058159.0000020A6F345000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2384692597.0000020A6F37E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2385394411.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 00000012.00000003.2312439364.0000020A78EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: firefox.exe, 00000012.00000003.2382058159.0000020A6F371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2385394411.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 00000012.00000003.2385394411.0000020A6F372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=793869
Source: firefox.exe, 00000012.00000003.2385394411.0000020A6F372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F345000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2386360448.0000020A6F32B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 00000012.00000003.2385394411.0000020A6F372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F345000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000012.00000003.2262317122.0000020A6DB53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261887126.0000020A6DB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261310402.0000020A6D900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2262142978.0000020A6DB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000012.00000003.2462583631.0000020A701D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000012.00000003.2471938937.0000020A767A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000014.00000002.4049477961.0000020660FCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D6EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4052014983.0000022CB8A05000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: firefox.exe, 00000014.00000002.4049477961.0000020660FCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D6EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4052014983.0000022CB8A05000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000012.00000003.2457612775.0000020A75EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000012.00000003.2456625515.0000020A76131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000012.00000003.2457568097.0000020A75EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarning
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000012.00000003.2411078653.0000020A78D94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2303623244.0000020A78ED3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000012.00000003.2487151709.0000020A6DCCA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2262317122.0000020A6DB53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261887126.0000020A6DB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261310402.0000020A6D900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2321632502.0000020A6E4FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2262142978.0000020A6DB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2391764150.0000020A6DCB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2406163495.0000020A6E4FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000012.00000003.2335284460.0000020A78EE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001C.00000002.4048723645.0000022CB8813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000012.00000003.2296314749.0000020A7661C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000012.00000003.2296314749.0000020A7661C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000012.00000003.2296314749.0000020A7661C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001C.00000002.4048723645.0000022CB8813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D6C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB88C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D6C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB88C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D62F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB8830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D6C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB88C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000012.00000003.2457753374.0000020A75EB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D6C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB88C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EFED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000012.00000003.2340272776.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2335879130.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2346346483.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2396603997.0000020A718B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2394112497.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000012.00000003.2340272776.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2335879130.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2346346483.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2396603997.0000020A718B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2394112497.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000012.00000003.2261887126.0000020A6DB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261310402.0000020A6D900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2262142978.0000020A6DB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000012.00000003.2438598288.0000020A7A367000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: firefox.exe, 00000012.00000003.2476398183.0000020A75E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000012.00000003.2476398183.0000020A75E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 00000012.00000003.2476398183.0000020A75E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000012.00000003.2386932673.0000020A6F33A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2332237691.0000020A6F260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2341976181.0000020A6F228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2339782085.0000020A6F228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2328710533.0000020A6F260000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2411688562.0000020A6F33E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2347914301.0000020A6F265000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2334060201.0000020A6F228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456297642.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 00000012.00000003.2452921671.0000020A79454000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2430948155.0000020A79451000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456297642.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456297642.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456297642.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456297642.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 00000012.00000003.2457706532.0000020A75EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: prefs-1.js.18.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001C.00000002.4048723645.0000022CB88F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000012.00000003.2451027878.0000020A79F5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2434685347.0000020A771CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/54b02805-0921-411e-96ec-3001f
Source: firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2474238914.0000020A762A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000012.00000003.2459867068.0000020A70E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000012.00000003.2459867068.0000020A70E21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D686000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB888E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000012.00000003.2465506458.0000020A79489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2503569517.0000020A79489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2430818120.0000020A79489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2440028625.0000020A79489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 00000012.00000003.2471938937.0000020A767A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000012.00000003.2477352482.0000020A71ACE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000012.00000003.2453912639.0000020A7772E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000012.00000003.2477352482.0000020A71ACE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000012.00000003.2477352482.0000020A71ACE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2482830699.0000020A71994000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000012.00000003.2262142978.0000020A6DB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000012.00000003.2411078653.0000020A78D94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2303623244.0000020A78ED3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000012.00000003.2313220191.0000020A777A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000012.00000003.2313220191.0000020A777A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000012.00000003.2467427061.0000020A78C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431741812.0000020A78C76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000012.00000003.2325934868.0000020A6E3F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000012.00000003.2325934868.0000020A6E3F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A761B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000012.00000003.2464246221.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D612000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB8813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001C.00000002.4048723645.0000022CB8813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/Error:
Source: firefox.exe, 00000012.00000003.2464246221.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2471938937.0000020A767B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71982000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2482830699.0000020A7197B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D6C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB88F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000012.00000003.2468356195.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2432875556.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2301043912.0000020A79410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000012.00000003.2468356195.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2432875556.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2301043912.0000020A79410000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: places.sqlite-wal.18.dr	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000012.00000003.2296314749.0000020A7661C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000012.00000003.2296314749.0000020A7661C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000012.00000003.2479606617.0000020A70273000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000012.00000003.2451618198.0000020A771E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2434685347.0000020A771E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 00000012.00000003.2451618198.0000020A771E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441937175.0000020A771E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2434685347.0000020A771E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2471444188.0000020A771E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2453912639.0000020A77746000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431741812.0000020A78C59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2466833943.0000020A78C6C000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.18.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 00000012.00000003.2391238279.0000020A7039C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2395580331.0000020A7039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000012.00000003.2458876684.0000020A70EDA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2477675234.0000020A70EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2466833943.0000020A78C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: places.sqlite-wal.18.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000012.00000003.2466612893.0000020A78EBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2335284460.0000020A78E73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2452968433.0000020A78EBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431588951.0000020A78EBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000014.00000002.4049477961.0000020660FCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D6EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4052014983.0000022CB8A05000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2466656839.0000020A78CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: gmpopenh264.dll.tmp.18.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000012.00000003.2482241628.0000020A761C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2293255784.0000020A7605C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2293655559.0000020A7606F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000012.00000003.2262317122.0000020A6DB53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261887126.0000020A6DB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261310402.0000020A6D900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2262142978.0000020A6DB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000012.00000003.2319597913.0000020A762F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78CF5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2466656839.0000020A78CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 00000012.00000003.2314496747.0000020A767B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2471938937.0000020A767DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2482598731.0000020A719B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2457847153.0000020A719B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2304384500.0000020A719B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2314496747.0000020A76798000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2471938937.0000020A767B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2314496747.0000020A767DE000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000012.00000003.2473379371.0000020A76354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2466833943.0000020A78C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 00000012.00000003.2296314749.0000020A7661C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/anything/?
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2466833943.0000020A78C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: firefox.exe, 00000012.00000003.2451618198.0000020A771E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2434685347.0000020A771E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: firefox.exe, 00000012.00000003.2451618198.0000020A771E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2434685347.0000020A771E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431741812.0000020A78C59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2466833943.0000020A78C6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2453912639.0000020A7772E000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.18.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000012.00000003.2298010283.0000020A766B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2323849945.0000020A6E51F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2481280309.0000020A77653000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D6C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB88F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001C.00000002.4048723645.0000022CB88F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/3
Source: firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000012.00000003.2461131122.0000020A70458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000012.00000003.2431741812.0000020A78C76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000012.00000003.2466477456.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2431507460.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2452968433.0000020A78ECC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2335284460.0000020A78ECD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sling.com/
Source: firefox.exe, 00000014.00000002.4049477961.0000020660FCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D6EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4052014983.0000022CB8A05000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.18.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 00000012.00000003.2486824736.0000020A6E566000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2448880112.0000020A6EEE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: firefox.exe, 00000012.00000003.2304676909.0000020A71969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2483271323.0000020A71969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000016.00000002.4048115489.0000016F1D60A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB880C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000012.00000003.2466656839.0000020A78CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000012.00000003.2461131122.0000020A7041B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: recovery.jsonlz4.tmp.18.dr	String found in binary or memory: https://youtube.com/account?=
Source: firefox.exe, 00000016.00000002.4052048844.0000016F1D7D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://ac
Source: firefox.exe, 0000001C.00000002.4048392432.0000022CB87D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://acY
Source: firefox.exe, 0000001C.00000002.4047013315.0000022CB845A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.googlG
Source: firefox.exe, 00000012.00000003.2474299541.0000020A7629C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2387791521.0000020A6ED63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2387791521.0000020A6ED6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2414845505.0000020A6F297000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2333322081.0000020A6F29F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4047689413.0000020660C2A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4048389032.0000020660DA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4047626102.0000016F1D3DA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4052048844.0000016F1D7D4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4047013315.0000022CB845A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048392432.0000022CB87D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000010.00000002.2241581240.00000141FEFBA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000002.2250342316.000001BD5110A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001C.00000002.4047013315.0000022CB845A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdA
Source: firefox.exe, 00000014.00000002.4047689413.0000020660C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdM
Source: firefox.exe, 00000014.00000002.4047689413.0000020660C20000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4048389032.0000020660DA4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4047626102.0000016F1D3D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4052048844.0000016F1D7D4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4047013315.0000022CB8450000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048392432.0000022CB87D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001C.00000002.4047013315.0000022CB8450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdU
Source: firefox.exe, 00000014.00000002.4047689413.0000020660C2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdY
Source: rpDOUhuBC5.exe, 00000001.00000003.2281362426.000000000175A000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2280272665.000000000175A000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2285558409.000000000175A000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000002.2292263172.000000000175A000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2280759692.000000000175A000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2277070970.0000000001757000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2286769435.000000000175A000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2279868551.000000000175A000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2277333970.0000000001757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdb
Source: firefox.exe, 00000016.00000002.4047626102.0000016F1D3DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdf
Source: firefox.exe, 00000016.00000002.4047626102.0000016F1D3D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdr

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.91:443 -> 192.168.2.6:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49924 version: TLS 1.2

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0081EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

1_2_0081EAFF

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0081ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

1_2_0081ED6A

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

1_2_0081EAFF

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0080AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

1_2_0080AA57

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_00839576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

1_2_00839576

System Summary

Binary is likely a compiled AutoIt script file

Source: rpDOUhuBC5.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: rpDOUhuBC5.exe, 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_907ede8d-5
Source: rpDOUhuBC5.exe, 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1700ebb8-8
Source: rpDOUhuBC5.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4fabc191-7
Source: rpDOUhuBC5.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_43f42c81-c

Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000016F1D712937 NtQuerySystemInformation,		22_2_0000016F1D712937
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000016F1D7957B2 NtQuerySystemInformation,		22_2_0000016F1D7957B2

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0080D5EB: CreateFileW,DeviceIoControl,CloseHandle,

1_2_0080D5EB

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_00801201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

1_2_00801201

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0080E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

1_2_0080E8F6

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007A8060	1_2_007A8060
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00812046	1_2_00812046
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00808298	1_2_00808298
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007DE4FF	1_2_007DE4FF
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007D676B	1_2_007D676B
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00834873	1_2_00834873
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007ACAF0	1_2_007ACAF0
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007CCAA0	1_2_007CCAA0
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007BCC39	1_2_007BCC39
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007D6DD9	1_2_007D6DD9
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007BB119	1_2_007BB119
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007A91C0	1_2_007A91C0
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007C1394	1_2_007C1394
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007C781B	1_2_007C781B
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007B997D	1_2_007B997D
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007A7920	1_2_007A7920
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007C7A4A	1_2_007C7A4A
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007C7CA7	1_2_007C7CA7
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007D9EEE	1_2_007D9EEE
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0082BE44	1_2_0082BE44
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000016F1D712937	22_2_0000016F1D712937
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000016F1D7957B2	22_2_0000016F1D7957B2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000016F1D795EDC	22_2_0000016F1D795EDC
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 22_2_0000016F1D7957F2	22_2_0000016F1D7957F2

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: String function: 007BF9F2 appears 40 times
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: String function: 007C0A30 appears 46 times
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: String function: 007A9CB3 appears 31 times

Source: rpDOUhuBC5.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal80.troj.evad.winEXE@34/38@71/12

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_008137B5 GetLastError,FormatMessageW,

1_2_008137B5

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_008010BF AdjustTokenPrivileges,CloseHandle,		1_2_008010BF
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_008016C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		1_2_008016C3

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_008151CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

1_2_008151CD

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0080D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

1_2_0080D4DC

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0081648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

1_2_0081648E

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007A42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

1_2_007A42A2

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Mozilla\Firefox\SkeletonUILock-c388d246

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3728:120:WilError_03

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File created: C:\Users\user\AppData\Local\Temp\firefox

Jump to behavior

Source: rpDOUhuBC5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456198908.0000020A776C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);

Source: rpDOUhuBC5.exe	ReversingLabs: Detection: 42%
Source: rpDOUhuBC5.exe	Virustotal: Detection: 27%

Source: unknown	Process created: C:\Users\user\Desktop\rpDOUhuBC5.exe "C:\Users\user\Desktop\rpDOUhuBC5.exe"
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccd16ed0-4054-4436-b362-dc6f5d23b61d} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a5db6e510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4088 -parentBuildID 20230927232528 -prefsHandle 3872 -prefMapHandle 3944 -prefsLen 26322 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb856fbc-54fb-4491-a5b4-616ae0b029ea} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a7168cb10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4996 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4992 -prefMapHandle 4968 -prefsLen 33093 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4751dff7-103a-4a3a-83fa-63f5327aa984} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a777a9710 utility
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccd16ed0-4054-4436-b362-dc6f5d23b61d} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a5db6e510 socket	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4088 -parentBuildID 20230927232528 -prefsHandle 3872 -prefMapHandle 3944 -prefsLen 26322 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb856fbc-54fb-4491-a5b4-616ae0b029ea} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a7168cb10 rdd	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4996 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4992 -prefMapHandle 4968 -prefsLen 33093 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4751dff7-103a-4a3a-83fa-63f5327aa984} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a777a9710 utility	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: rpDOUhuBC5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rpDOUhuBC5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rpDOUhuBC5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rpDOUhuBC5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rpDOUhuBC5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rpDOUhuBC5.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: rpDOUhuBC5.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.18.dr
Source:	Binary string: NapiNSP.pdbUGP source: firefox.exe, 00000012.00000003.2494493527.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 00000012.00000003.2495296928.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 00000012.00000003.2494493527.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 00000012.00000003.2491214347.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.18.dr
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 00000012.00000003.2495296928.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 00000012.00000003.2491214347.0000020A6D7B2000.00000004.00000020.00020000.00000000.sdmp

Source: rpDOUhuBC5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: rpDOUhuBC5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: rpDOUhuBC5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: rpDOUhuBC5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: rpDOUhuBC5.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_007A42DE

Source: gmpopenh264.dll.tmp.18.dr

Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007C0A76 push ecx; ret

1_2_007C0A89

Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)			Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007BF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		1_2_007BF98E
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00831C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		1_2_00831C41

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_1-97157

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 22_2_0000016F1D712937 rdtsc

22_2_0000016F1D712937

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

API coverage: 3.8 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0080DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	1_2_0080DBBE
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007DC2A2 FindFirstFileExW,	1_2_007DC2A2
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_008168EE FindFirstFileW,FindClose,	1_2_008168EE
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0081698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	1_2_0081698F
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0080D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0080D076
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0080D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_0080D3A9
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00819642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00819642
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_0081979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0081979D
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00819B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	1_2_00819B2B
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00815C97 FindFirstFileW,FindNextFileW,FindClose,	1_2_00815C97

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_007A42DE

Source: firefox.exe, 00000016.00000002.4052306636.0000016F1DB70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: firefox.exe, 0000001C.00000002.4051845138.0000022CB8900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD^
Source: firefox.exe, 00000014.00000002.4053008117.0000020661200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS
Source: rpDOUhuBC5.exe, 00000001.00000003.2182842935.00000000016BC000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2186063791.00000000016BC000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2271229478.00000000016BC000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2183892162.00000000016BC000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000002.2291937916.00000000016BC000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2287690098.00000000016BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWt
Source: rpDOUhuBC5.exe, 00000001.00000003.2286991719.000000000168B000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2286066548.000000000168B000.00000004.00000020.00020000.00000000.sdmp, rpDOUhuBC5.exe, 00000001.00000003.2287690098.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4047689413.0000020660C2A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4047626102.0000016F1D3DA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4052306636.0000016F1DB70000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4047013315.0000022CB845A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000014.00000002.4053008117.0000020661200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: firefox.exe, 00000014.00000002.4052302603.0000020661117000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 00000016.00000002.4052306636.0000016F1DB70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllh
Source: firefox.exe, 00000016.00000002.4052306636.0000016F1DB70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli
Source: firefox.exe, 00000014.00000002.4053008117.0000020661200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

Code function: 22_2_0000016F1D712937 rdtsc

22_2_0000016F1D712937

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0081EAA2 BlockInput,

1_2_0081EAA2

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_007D2622

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_007A42DE

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007C4CE8 mov eax, dword ptr fs:[00000030h]

1_2_007C4CE8

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_00800B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

1_2_00800B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_007D2622
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007C083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_007C083F
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007C09D5 SetUnhandledExceptionFilter,	1_2_007C09D5
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_007C0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_007C0C21

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

1_2_00801201

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007E2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

1_2_007E2BA5

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_0080B226 SendInput,keybd_event,

1_2_0080B226

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_008222DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

1_2_008222DA

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

1_2_00800B62

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_00801663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

1_2_00801663

Source: rpDOUhuBC5.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: rpDOUhuBC5.exe	Binary or memory string: Shell_TrayWnd
Source: firefox.exe, 00000012.00000003.2448330800.0000020A78201000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hSoftware\Policies\Microsoft\Windows\PersonalizationNoChangingStartMenuBackgroundPersonalColors_BackgroundWilStaging_02RtlDisownModuleHeapAllocationRtlQueryFeatureConfigurationRtlRegisterFeatureConfigurationChangeNotificationRtlSubscribeWnfStateChangeNotificationRtlDllShutdownInProgressntdll.dllNtQueryWnfStateDataLocal\SM0:%d:%d:%hs_p0Local\SessionImmersiveColorPreferenceBEGINTHMthmfile\Sessions\%d\Windows\ThemeSectionMessageWindowendthemewndThemeApiConnectionRequest\ThemeApiPortwinsta0SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\PersonalizeAppsUseLightThemeSystemUsesLightThemedefaultshell\themes\uxtheme\render.cppCompositedWindow::WindowdeletedrcacheMDIClientSoftware\Microsoft\Windows\DWMColorPrevalenceSoftware\Microsoft\Windows\CurrentVersion\ImmersiveShellTabletModeMENUAccentColorSoftware\Microsoft\Windows\CurrentVersion\Explorer\AccentDefaultStartColorControl Panel\DesktopAutoColorizationAccentColorMenuStartColorMenuAutoColorSoftware\Microsoft\Windows\CurrentVersion\Themes\History\ColorsSoftware\Microsoft\Windows\CurrentVersion\Themes\HistoryAccentPaletteTab$Shell_TrayWndLocal\SessionImmersiveColorMutex

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007C0698 cpuid

1_2_007C0698

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007FD21C GetLocalTime,

1_2_007FD21C

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007FD27A GetUserNameW,

1_2_007FD27A

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007DB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

1_2_007DB952

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe

Code function: 1_2_007A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_007A42DE

Stealing of Sensitive Information

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: rpDOUhuBC5.exe PID: 3976, type: MEMORYSTR

Source: rpDOUhuBC5.exe	Binary or memory string: WIN_81
Source: rpDOUhuBC5.exe	Binary or memory string: WIN_XP
Source: rpDOUhuBC5.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: rpDOUhuBC5.exe	Binary or memory string: WIN_XPe
Source: rpDOUhuBC5.exe	Binary or memory string: WIN_VISTA
Source: rpDOUhuBC5.exe	Binary or memory string: WIN_7
Source: rpDOUhuBC5.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: rpDOUhuBC5.exe PID: 3976, type: MEMORYSTR

Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00821204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		1_2_00821204
Source: C:\Users\user\Desktop\rpDOUhuBC5.exe	Code function: 1_2_00821806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		1_2_00821806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	2 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Process Injection	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rpDOUhuBC5.exe	42%	ReversingLabs	Win32.Trojan.Amadey
rpDOUhuBC5.exe	28%	Virustotal		Browse
rpDOUhuBC5.exe	100%	Avira	TR/ATRAPS.Gen
rpDOUhuBC5.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
star-mini.c10r.facebook.com	157.240.196.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.65	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
services.addons.mozilla.org	151.101.129.91	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.78	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
youtube-ui.l.google.com	142.250.181.110	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.65.140	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000016.00000002.4048115489.0000016F1D6C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB88C3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://detectportal.firefox.com/	firefox.exe, 00000012.00000003.2473325527.0000020A7639A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
http://www.mozilla.com0	gmpopenh264.dll.tmp.18.dr	false	high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000016.00000002.4048115489.0000016F1D686000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB888E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	false	high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://www.leboncoin.fr/	firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://spocs.getpocket.com/spocs	firefox.exe, 00000012.00000003.2464246221.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2471938937.0000020A767B5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed	firefox.exe, 00000012.00000003.2323849945.0000020A6E51F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://shavar.services.mozilla.com	firefox.exe, 00000012.00000003.2313220191.0000020A777A2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000012.00000003.2262317122.0000020A6DB53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261887126.0000020A6DB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261310402.0000020A6D900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2262142978.0000020A6DB32000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000012.00000003.2468356195.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2432875556.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2301043912.0000020A79410000.00000004.00000800.00020000.00000000.sdmp	false	high
https://addons.mozilla.org/user-media/addon_icons/700/700308-64.png?modified=4bc8e79f	firefox.exe, 00000012.00000003.2298010283.0000020A766B3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 00000012.00000003.2441629128.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456297642.0000020A776AD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 00000012.00000003.2476398183.0000020A75E67000.00000004.00000800.00020000.00000000.sdmp	false	high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2466656839.0000020A78CF5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.msn.com	firefox.exe, 00000012.00000003.2461131122.0000020A70458000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000012.00000003.2261887126.0000020A6DB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2261310402.0000020A6D900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2262142978.0000020A6DB32000.00000004.00000800.00020000.00000000.sdmp	false	high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000012.00000003.2296314749.0000020A7661C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://youtube.com/	firefox.exe, 00000012.00000003.2461131122.0000020A7041B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://content-signature-2.cdn.mozilla.net/	firefox.exe, 00000012.00000003.2471938937.0000020A767A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://json-schema.org/draft/2020-12/schema/=	firefox.exe, 00000012.00000003.2324751198.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2464246221.0000020A6EF64000.00000004.00000800.00020000.00000000.sdmp	false	high
https://youtube.com/account?=https://ac	firefox.exe, 00000016.00000002.4052048844.0000016F1D7D0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://api.accounts.firefox.com/v1	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://youtube.com/account?=https://accounts.googlG	firefox.exe, 0000001C.00000002.4047013315.0000022CB845A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	prefs-1.js.18.dr	false	high
https://www.amazon.com/	firefox.exe, 00000012.00000003.2431741812.0000020A78C76000.00000004.00000800.00020000.00000000.sdmp	false	high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	false	high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://www.youtube.com/	firefox.exe, 00000016.00000002.4048115489.0000016F1D60A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB880C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	firefox.exe, 00000012.00000003.2382058159.0000020A6F371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2385394411.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://MD8.mozilla.org/1/m	firefox.exe, 00000012.00000003.2314496747.0000020A7674B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.bbc.co.uk/	firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://addons.mozilla.org/firefox/addon/to-google-translate/	firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2481280309.0000020A77653000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000016.00000002.4048115489.0000016F1D6C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB88C3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://127.0.0.1:	firefox.exe, 00000012.00000003.2440947491.0000020A777A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2470570743.0000020A777A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2453912639.0000020A777A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2477352482.0000020A71ACE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2313220191.0000020A777A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1266220	firefox.exe, 00000012.00000003.2385394411.0000020A6F372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F345000.00000004.00000800.00020000.00000000.sdmp	false	high
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000012.00000003.2411078653.0000020A78D94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2303623244.0000020A78ED3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bugzilla.mo	firefox.exe, 00000012.00000003.2452249604.0000020A79F80000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000012.00000003.2468356195.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2432875556.0000020A77FA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2301043912.0000020A79410000.00000004.00000800.00020000.00000000.sdmp	false	high
https://youtube.com/account?=	recovery.jsonlz4.tmp.18.dr	false	high
https://shavar.services.mozilla.com/	firefox.exe, 00000012.00000003.2313220191.0000020A777A2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	false	high
https://spocs.getpocket.com/	firefox.exe, 00000012.00000003.2464246221.0000020A6EF97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2458176445.0000020A716C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.4048115489.0000016F1D612000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048723645.0000022CB8813000.00000004.00000800.00020000.00000000.sdmp	false	high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://www.iqiyi.com/	firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.	places.sqlite-wal.18.dr	false	high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000012.00000003.2476398183.0000020A75E67000.00000004.00000800.00020000.00000000.sdmp	false	high
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1170143	firefox.exe, 00000012.00000003.2385394411.0000020A6F372000.00000004.00000800.00020000.00000000.sdmp	false	high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://monitor.firefox.com/about	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000012.00000003.2304384500.0000020A719EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2459127630.0000020A70E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2428470851.0000020A6DFA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2406258379.0000020A6E4B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2403552922.0000020A78DA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2410306016.0000020A6E4B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2340272776.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2324526502.0000020A6EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2346346483.0000020A71895000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2395114152.0000020A71589000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2342261218.0000020A6EDE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2338321683.0000020A71895000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2478016249.0000020A704B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2335879130.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2411078653.0000020A78D8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2303259858.0000020A79432000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2346346483.0000020A718B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2447111884.0000020A6EECE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2303978709.0000020A78EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2337257621.0000020A71895000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2415991762.0000020A6EDE7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.bellmedia.c	firefox.exe, 00000012.00000003.2459867068.0000020A70E1A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://youtube.com/	firefox.exe, 00000012.00000003.2319597913.0000020A762F5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://login.microsoftonline.com	firefox.exe, 00000012.00000003.2459867068.0000020A70E21000.00000004.00000800.00020000.00000000.sdmp	false	high
https://coverage.mozilla.org	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
http://crl.thawte.com/ThawteTimestampingCA.crl0	gmpopenh264.dll.tmp.18.dr	false	high
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 00000012.00000003.2296314749.0000020A7661C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	firefox.exe, 00000012.00000003.2319597913.0000020A762B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2459445118.0000020A70E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2477919664.0000020A70E69000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	firefox.exe, 00000012.00000003.2319597913.0000020A762B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2459445118.0000020A70E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2477919664.0000020A70E69000.00000004.00000800.00020000.00000000.sdmp	false	high
http://a9.com/-/spec/opensearch/1.1/	firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://blocked.cdn.mozilla.net/	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	false	high
https://json-schema.org/draft/2019-09/schema	firefox.exe, 00000012.00000003.2319597913.0000020A762B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2474238914.0000020A762A3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	firefox.exe, 00000012.00000003.2474928652.0000020A76186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456625515.0000020A76186000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000012.00000003.2335284460.0000020A78EE3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://profiler.firefox.com	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=793869	firefox.exe, 00000012.00000003.2385394411.0000020A6F372000.00000004.00000800.00020000.00000000.sdmp	false	high
https://identity.mozilla.com/apps/relay	firefox.exe, 00000012.00000003.2452921671.0000020A79454000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2430948155.0000020A79451000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mozilla.cloudflare-dns.com/dns-query	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 00000012.00000003.2458876684.0000020A70EDA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2477675234.0000020A70EDA000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	firefox.exe, 00000012.00000003.2382058159.0000020A6F345000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2384692597.0000020A6F37E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2382058159.0000020A6F371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2385394411.0000020A6F37B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/	firefox.exe, 00000012.00000003.2471334735.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2441629128.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2481280309.0000020A77653000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2456388440.0000020A7762C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000012.00000003.2457568097.0000020A75EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high
https://www.amazon.co.uk/	firefox.exe, 00000012.00000003.2474175178.0000020A762BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000012.00000003.2319597913.0000020A762CC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000014.00000002.4052087512.0000020661000000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.4051809186.0000016F1D750000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.4048224654.0000022CB8700000.00000002.10000000.00040000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
151.101.129.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581594
Start date and time:	2024-12-28 09:46:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rpDOUhuBC5.exe renamed because original name is a hash value
Original Sample Name:	1f856d82c95fcef4439c2c9d442e44f4.exe
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@34/38@71/12
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 95% Number of executed functions: 49 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.198.119.143, 2.16.164.105, 2.16.164.72, 44.232.159.99, 54.148.175.110, 52.40.120.141, 172.217.17.74, 142.250.181.138, 172.217.17.46, 88.221.134.155, 88.221.134.209, 20.190.147.12, 20.103.156.88, 2.16.158.27, 13.107.246.63, 2.16.158.33, 23.218.208.109, 52.149.20.212, 150.171.27.10, 2.16.158.185, 20.223.36.55
Excluded domains from analysis (whitelisted): ciscobinary.openh264.org, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, tse1.mm.bing.net, a17.rackcdn.com.mdc.edgesuite.net, g.bing.com, aus5.mozilla.org, a767.dspw65.akamai.net, arc.msn.com, a19.dscg10.akamai.net, wns.notify.trafficmanager.net, ocsp.digicert.com, redirector.gvt1.com, login.live.com, ocsp.edge.digicert.com, safebrowsing.googleapis.com, wu-b-net.trafficmanager.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, shavar.prod.mozaws.net, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, location.services.mozilla.com
Execution Graph export aborted for target firefox.exe, PID 5128 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.117.188.166	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
34.149.100.209	https://greensofttech1-my.sharepoint.com/:f:/g/personal/stella_huang_greensofttech1_onmicrosoft_com/EuOSopXBEUpFhaHAwqFRDM8BeWLY-Gsl0U9Az2fOy4x80A?e=GhPegT&xsdata=MDV8MDJ8TVB1Z2FAaHljaXRlLmNvbXxjMDM5NmJhZjcxOTM0YzBkMTc3ZDA4ZGQxMzcwNWQ3MnxmYzVjNjhmNjk3ZjM0ZWZlYjY4OWViNWMxMjM0ZjgyMXwwfDB8NjM4Njg4MDk1NTQ0NTA0NzA2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=SVpsejJNYUlwY213VjNreGxSNU1LaFJXcnpXS3pwWjhYR2k5ZUthLzlsMD0%3d	Get hash	malicious	HTMLPhisher	Browse
	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse
	ghostspider.7z	Get hash	malicious	Unknown	Browse
151.101.129.91	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	Pl8Tb06C8A.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
34.160.144.191	https://greensofttech1-my.sharepoint.com/:f:/g/personal/stella_huang_greensofttech1_onmicrosoft_com/EuOSopXBEUpFhaHAwqFRDM8BeWLY-Gsl0U9Az2fOy4x80A?e=GhPegT&xsdata=MDV8MDJ8TVB1Z2FAaHljaXRlLmNvbXxjMDM5NmJhZjcxOTM0YzBkMTc3ZDA4ZGQxMzcwNWQ3MnxmYzVjNjhmNjk3ZjM0ZWZlYjY4OWViNWMxMjM0ZjgyMXwwfDB8NjM4Njg4MDk1NTQ0NTA0NzA2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=SVpsejJNYUlwY213VjNreGxSNU1LaFJXcnpXS3pwWjhYR2k5ZUthLzlsMD0%3d	Get hash	malicious	HTMLPhisher	Browse
	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse	93.184.215.14
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse	93.184.215.14
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	ghostspider.7z	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	93.184.215.14
star-mini.c10r.facebook.com	https://greensofttech1-my.sharepoint.com/:f:/g/personal/stella_huang_greensofttech1_onmicrosoft_com/EuOSopXBEUpFhaHAwqFRDM8BeWLY-Gsl0U9Az2fOy4x80A?e=GhPegT&xsdata=MDV8MDJ8TVB1Z2FAaHljaXRlLmNvbXxjMDM5NmJhZjcxOTM0YzBkMTc3ZDA4ZGQxMzcwNWQ3MnxmYzVjNjhmNjk3ZjM0ZWZlYjY4OWViNWMxMjM0ZjgyMXwwfDB8NjM4Njg4MDk1NTQ0NTA0NzA2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=SVpsejJNYUlwY213VjNreGxSNU1LaFJXcnpXS3pwWjhYR2k5ZUthLzlsMD0%3d	Get hash	malicious	HTMLPhisher	Browse	157.240.252.35
	http://vanessa.nilsson@dmava.nj.gov	Get hash	malicious	Unknown	Browse	157.240.196.35
	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse	157.240.195.35
	https://fsharetv.co/	Get hash	malicious	Unknown	Browse	157.240.195.35
	http://plnbl.io/review/FSUQBEfTfzwH	Get hash	malicious	Unknown	Browse	157.240.195.35
	https://liladelman.com/rental/1218-west-side-road-block-island/	Get hash	malicious	Unknown	Browse	157.240.195.35
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse	157.240.196.35
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	157.240.196.35
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	157.240.196.35
twitter.com	https://greensofttech1-my.sharepoint.com/:f:/g/personal/stella_huang_greensofttech1_onmicrosoft_com/EuOSopXBEUpFhaHAwqFRDM8BeWLY-Gsl0U9Az2fOy4x80A?e=GhPegT&xsdata=MDV8MDJ8TVB1Z2FAaHljaXRlLmNvbXxjMDM5NmJhZjcxOTM0YzBkMTc3ZDA4ZGQxMzcwNWQ3MnxmYzVjNjhmNjk3ZjM0ZWZlYjY4OWViNWMxMjM0ZjgyMXwwfDB8NjM4Njg4MDk1NTQ0NTA0NzA2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=SVpsejJNYUlwY213VjNreGxSNU1LaFJXcnpXS3pwWjhYR2k5ZUthLzlsMD0%3d	Get hash	malicious	HTMLPhisher	Browse	104.244.42.193
	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse	104.244.42.65
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse	104.244.42.65
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
services.addons.mozilla.org	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse	151.101.193.91
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse	151.101.65.91
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	ghostspider.7z	Get hash	malicious	Unknown	Browse	151.101.65.91
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	151.101.129.91
	do.ps1	Get hash	malicious	Unknown	Browse	151.101.1.91

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://greensofttech1-my.sharepoint.com/:f:/g/personal/stella_huang_greensofttech1_onmicrosoft_com/EuOSopXBEUpFhaHAwqFRDM8BeWLY-Gsl0U9Az2fOy4x80A?e=GhPegT&xsdata=MDV8MDJ8TVB1Z2FAaHljaXRlLmNvbXxjMDM5NmJhZjcxOTM0YzBkMTc3ZDA4ZGQxMzcwNWQ3MnxmYzVjNjhmNjk3ZjM0ZWZlYjY4OWViNWMxMjM0ZjgyMXwwfDB8NjM4Njg4MDk1NTQ0NTA0NzA2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=SVpsejJNYUlwY213VjNreGxSNU1LaFJXcnpXS3pwWjhYR2k5ZUthLzlsMD0%3d	Get hash	malicious	HTMLPhisher	Browse	34.117.121.53
	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse	34.117.188.166
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	34.117.59.81
	https://property-management-portal.replit.app/%2520%2522https:/property-management-portal.replit.app/%2522	Get hash	malicious	Unknown	Browse	34.117.33.233
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	34.117.223.223
	https://email.equifaxbreachsettlement.com/c/eJwczbFugzAQANCvsccIzoaYwQMNWE1VEQoM2SxzPgRSCJS4pfn7qt2f9Lx2FDunOOn4KGQWZUopPmqCAb0Uie8hxR6VP6bocQBKMO4TJfikIQIZAwAIkFIdhB9SzAQJJdOk90cmI_r8mgb302_kcHxQCDea6R4OuMz8pscQ1gcTOQPDwOz7fpif60armzzSPdD25xiYjTzRzIQhXDwxUZzeTHN9iV5l137wTXdV-d5eKgXAZPR047L8B0GX5mrr5mKbvMtt3ZR1fi7sKW8KW5zbzrZlVfBvDb8BAAD__6sTT70	Get hash	malicious	HtmlDropper	Browse	34.67.241.53
ATGS-MMD-ASUS	https://haleborealis.com	Get hash	malicious	Unknown	Browse	34.160.81.203
	https://greensofttech1-my.sharepoint.com/:f:/g/personal/stella_huang_greensofttech1_onmicrosoft_com/EuOSopXBEUpFhaHAwqFRDM8BeWLY-Gsl0U9Az2fOy4x80A?e=GhPegT&xsdata=MDV8MDJ8TVB1Z2FAaHljaXRlLmNvbXxjMDM5NmJhZjcxOTM0YzBkMTc3ZDA4ZGQxMzcwNWQ3MnxmYzVjNjhmNjk3ZjM0ZWZlYjY4OWViNWMxMjM0ZjgyMXwwfDB8NjM4Njg4MDk1NTQ0NTA0NzA2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=SVpsejJNYUlwY213VjNreGxSNU1LaFJXcnpXS3pwWjhYR2k5ZUthLzlsMD0%3d	Get hash	malicious	HTMLPhisher	Browse	34.160.144.191
	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.3.189.217
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	51.97.11.221
	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse	34.160.144.191
	xd.mips.elf	Get hash	malicious	Mirai	Browse	48.226.14.3
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	48.82.97.179
	xd.x86.elf	Get hash	malicious	Mirai	Browse	34.56.199.147
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	57.42.114.35
FASTLYUS	https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0	Get hash	malicious	Unknown	Browse	151.101.1.229
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUMFBJSDkxQ0w3VVZMNFJFUlNDRVkyU05CUi4u	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	Electrum-bch-4.4.2-x86_64.AppImage.elf	Get hash	malicious	Unknown	Browse	185.199.111.133
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.199.109.133
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	185.199.108.133
	https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720	Get hash	malicious	Unknown	Browse	151.101.129.229
	grand-theft-auto-5-theme-1-installer_qb8W-j1.exe	Get hash	malicious	Unknown	Browse	151.101.2.133
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	185.199.110.133
ATGS-MMD-ASUS	https://haleborealis.com	Get hash	malicious	Unknown	Browse	34.160.81.203
	https://greensofttech1-my.sharepoint.com/:f:/g/personal/stella_huang_greensofttech1_onmicrosoft_com/EuOSopXBEUpFhaHAwqFRDM8BeWLY-Gsl0U9Az2fOy4x80A?e=GhPegT&xsdata=MDV8MDJ8TVB1Z2FAaHljaXRlLmNvbXxjMDM5NmJhZjcxOTM0YzBkMTc3ZDA4ZGQxMzcwNWQ3MnxmYzVjNjhmNjk3ZjM0ZWZlYjY4OWViNWMxMjM0ZjgyMXwwfDB8NjM4Njg4MDk1NTQ0NTA0NzA2fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=SVpsejJNYUlwY213VjNreGxSNU1LaFJXcnpXS3pwWjhYR2k5ZUthLzlsMD0%3d	Get hash	malicious	HTMLPhisher	Browse	34.160.144.191
	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	34.3.189.217
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	51.97.11.221
	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse	34.160.144.191
	xd.mips.elf	Get hash	malicious	Mirai	Browse	48.226.14.3
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	48.82.97.179
	xd.x86.elf	Get hash	malicious	Mirai	Browse	34.56.199.147
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	57.42.114.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	ReJIL-_Document_No._2500015903.msg	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	ghostspider.7z	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.129.91 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse
	nM0h824cc3.exe	Get hash	malicious	Credential Flusher	Browse
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse
	ghostspider.7z	Get hash	malicious	Unknown	Browse
	do.ps1	Get hash	malicious	Unknown	Browse
	https://walli.shanga.co/image/view/?id=1375	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_0aea9c95-3e48-41e6-b217-65ec04139348.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7946
Entropy (8bit):	5.178766448020323
Encrypted:	false
SSDEEP:	192:XBMXD/IcbhbVbTbfbRbObtbyEl7nwrNJA6unSrDtTkdxSof2g:XiEcNhnzFSJQrI1nSrDhkdxqg
MD5:	A14D50C4389640FA72249674BD183518
SHA1:	FEBFFDADDEEF12DBC5FCCBF6E2034C91472212EF
SHA-256:	66406C6BEF0D499BD34FD3B2C8448FBC7B5FB81EF9330B46F72C47E581961247
SHA-512:	A0D6D9364447FD5DFB69C5862C4D59104F75321D71D6563DFE8D6D1E963CF30B835CB136E1DB0B4F28380F98F1C193C40B597967707662DA91E110426F1B1651
Malicious:	false
Preview:	{"type":"uninstall","id":"0aea9c95-3e48-41e6-b217-65ec04139348","creationDate":"2024-12-28T10:22:15.028Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_0aea9c95-3e48-41e6-b217-65ec04139348.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7946
Entropy (8bit):	5.178766448020323
Encrypted:	false
SSDEEP:	192:XBMXD/IcbhbVbTbfbRbObtbyEl7nwrNJA6unSrDtTkdxSof2g:XiEcNhnzFSJQrI1nSrDhkdxqg
MD5:	A14D50C4389640FA72249674BD183518
SHA1:	FEBFFDADDEEF12DBC5FCCBF6E2034C91472212EF
SHA-256:	66406C6BEF0D499BD34FD3B2C8448FBC7B5FB81EF9330B46F72C47E581961247
SHA-512:	A0D6D9364447FD5DFB69C5862C4D59104F75321D71D6563DFE8D6D1E963CF30B835CB136E1DB0B4F28380F98F1C193C40B597967707662DA91E110426F1B1651
Malicious:	false
Preview:	{"type":"uninstall","id":"0aea9c95-3e48-41e6-b217-65ec04139348","creationDate":"2024-12-28T10:22:15.028Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3139047242871906
Encrypted:	false
SSDEEP:	48:pedxBCUgdwhzfedxBC6Bdw3FedxBiadw11:MQCIib
MD5:	8F33F58240C1250A92763E06CBFB4DEF
SHA1:	CD8D21B18DA5663E8EE8EF71DD231736CF53C2F5
SHA-256:	E17EA3550FB0BC8F31E07598136CEFE3BCC312B3132843038E428BA1C7B3EEE1
SHA-512:	28DEA9CE02E9D61922887084DAC7859137E4533EBCEE51FEE2C56A2AF8C0244A72376BBD456A186CD2706A95F9A6DC0AFAEA8E7B9E5C22F75FD8D5E0EF950331
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.........?,.Y..........S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.I.Y.E....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.Y.E............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.Y.E..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........P".......C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3139047242871906
Encrypted:	false
SSDEEP:	48:pedxBCUgdwhzfedxBC6Bdw3FedxBiadw11:MQCIib
MD5:	8F33F58240C1250A92763E06CBFB4DEF
SHA1:	CD8D21B18DA5663E8EE8EF71DD231736CF53C2F5
SHA-256:	E17EA3550FB0BC8F31E07598136CEFE3BCC312B3132843038E428BA1C7B3EEE1
SHA-512:	28DEA9CE02E9D61922887084DAC7859137E4533EBCEE51FEE2C56A2AF8C0244A72376BBD456A186CD2706A95F9A6DC0AFAEA8E7B9E5C22F75FD8D5E0EF950331
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.........?,.Y..........S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.I.Y.E....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.Y.E............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.Y.E..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........P".......C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7DFTD2462SS4IXM6N7VN.temp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	modified
Size (bytes):	5488
Entropy (8bit):	3.3139047242871906
Encrypted:	false
SSDEEP:	48:pedxBCUgdwhzfedxBC6Bdw3FedxBiadw11:MQCIib
MD5:	8F33F58240C1250A92763E06CBFB4DEF
SHA1:	CD8D21B18DA5663E8EE8EF71DD231736CF53C2F5
SHA-256:	E17EA3550FB0BC8F31E07598136CEFE3BCC312B3132843038E428BA1C7B3EEE1
SHA-512:	28DEA9CE02E9D61922887084DAC7859137E4533EBCEE51FEE2C56A2AF8C0244A72376BBD456A186CD2706A95F9A6DC0AFAEA8E7B9E5C22F75FD8D5E0EF950331
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.........?,.Y..........S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.I.Y.E....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.Y.E............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.Y.E..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........P".......C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PSXL6YZH95LMJ9T7QUXD.temp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	3.3139047242871906
Encrypted:	false
SSDEEP:	48:pedxBCUgdwhzfedxBC6Bdw3FedxBiadw11:MQCIib
MD5:	8F33F58240C1250A92763E06CBFB4DEF
SHA1:	CD8D21B18DA5663E8EE8EF71DD231736CF53C2F5
SHA-256:	E17EA3550FB0BC8F31E07598136CEFE3BCC312B3132843038E428BA1C7B3EEE1
SHA-512:	28DEA9CE02E9D61922887084DAC7859137E4533EBCEE51FEE2C56A2AF8C0244A72376BBD456A186CD2706A95F9A6DC0AFAEA8E7B9E5C22F75FD8D5E0EF950331
Malicious:	false
Preview:	...................................FL..................F.@.. ...p.........?,.Y..........S...........................P.O. .:i.....+00.../C:\.....................1.....EW.3..PROGRA~1..t......O.I.Y.E....B...............J.......j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....CW.X..MOZILL~1..P......CW}W.Y.E............................>.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.....b.2..S..<W,. .firefox.exe.H......CW}W.Y.E..............................f.i.r.e.f.o.x...e.x.e.......[...............-.......Z...........P".......C:\Program Files\Mozilla Firefox\firefox.exe....O.p.e.n. .a. .n.e.w. .b.r.o.w.s.e.r. .t.a.b.....-.n.e.w.-.t.a.b. .a.b.o.u.t.:.b.l.a.n.k.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.o.z.i.l.l.a. .F.i.r.e.f.o.x.\.f.i.r.e.f.o.x...e.x.e.........%ProgramFiles%\Mozilla Firefox\firefox.exe................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.931437844757259
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsL3ajWB8P:gXiNFS+OcUGOdwiOdwBjkYLOWB8P
MD5:	6F118B0AA394CD992FEB39520A959BBD
SHA1:	AA4422EB6397720BDA70B067293DE927BBEB67D2
SHA-256:	4C78D5691554F1845BD0E5BC233DF85ADB39E481D83D20D103BAF1D4F2F9D2C9
SHA-512:	9409EFD4565E902B0265E9D0A7CF0482546E439EBDDA6A528C70CC8DDB7459F28B41D501A251D8FDD0EA71E790A2FBCCFA476E100B38354BAA8AF035F5C46BB8
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.931437844757259
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsL3ajWB8P:gXiNFS+OcUGOdwiOdwBjkYLOWB8P
MD5:	6F118B0AA394CD992FEB39520A959BBD
SHA1:	AA4422EB6397720BDA70B067293DE927BBEB67D2
SHA-256:	4C78D5691554F1845BD0E5BC233DF85ADB39E481D83D20D103BAF1D4F2F9D2C9
SHA-512:	9409EFD4565E902B0265E9D0A7CF0482546E439EBDDA6A528C70CC8DDB7459F28B41D501A251D8FDD0EA71E790A2FBCCFA476E100B38354BAA8AF035F5C46BB8
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: cMTqzvmx9u.exe, Detection: malicious, Browse Filename: NetFxRepairTools.msi, Detection: malicious, Browse Filename: nM0h824cc3.exe, Detection: malicious, Browse Filename: nM0h824cc3.exe, Detection: malicious, Browse Filename: gTU8ed4669.exe, Detection: malicious, Browse Filename: gTU8ed4669.exe, Detection: malicious, Browse Filename: ghostspider.7z, Detection: malicious, Browse Filename: do.ps1, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.07323819165234684
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zkiC:DLhesh7Owd4+ji
MD5:	C2BC9426B748A76F28E6B1D28250FFBD
SHA1:	AD30AEB991A23296AF1BFBA78D3D74426A7FA29A
SHA-256:	3D9B7808ABCB765C0D1508DD02B1FD47B935EC08ACEBEB643186014992DC9564
SHA-512:	66B56B919D65F13B80309E8B783B2445187491E5FAD41EAF9C2B9A2E41BCD3EA62FA7799D4D1E809D89B11741261FAE2FABCDC95F353D379F4B40DDBC75C40B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.039751381258926154
Encrypted:	false
SSDEEP:	3:GHlhVoESt+WET6lhVoESt+WEL1ol8a9//Ylll4llqlyllel4lt:G7Vo7AWtVo7AW3L9XIwlio
MD5:	34684D13E8DD7D6A9B47A1EAA01AAC37
SHA1:	DFA5CD69F5B0E585803EDEDB84020AC46CE2BE2F
SHA-256:	DBB20D2A1AD3617B0FDE88DA39DDF937DE66C77C042B022BF0300179D97BA939
SHA-512:	6D25FA1E62DBA6D1CE72D245AA57D78A14900F637ED705F5BE6126085AB64E829F98104A4107796FAB36DA880F7B323D0DB98D667CCC1185F9EFC6A00F5F3FD7
Malicious:	false
Preview:	..-......................mH.[.7.9j^7......?..z6L..-......................mH.[.7.9j^7......?..z6L........................................................'...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	163992
Entropy (8bit):	0.09551959867157706
Encrypted:	false
SSDEEP:	24:KRZT276Lxs9YC4b5xsMldCCQE/TSKCrsCs81xsaye4gmwlm2iEg:FGs+zJKDC8XVye4UU
MD5:	1758E36BED6619FEC355F57B140FCCD7
SHA1:	F2B4627CFC72836CE9BF121E586F6E40EC5228C5
SHA-256:	0AB8AF554C3BF7E4E7A2534E3E5681401D5981F2AE4D45FEDB92011C5C3166DF
SHA-512:	71AB94B54EFE044E1A2DADDF50F3200C4D2332E921B7D38A48B88F3C7EB0925A65962B2B742A189931383C9C6A8EF60024BDE9C4ABA8420D56D9045D4EC45D29
Malicious:	false
Preview:	7....-..........9j^7.....%mL\0..........9j^7....x.(q.E.h................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.46713537495965
Encrypted:	false
SSDEEP:	192:InTFTRRUYbBp64LZNMGaXe6qU4o3zy+/3/7Ous5RYiNBw8dkSl:KKehFNMRnDyCOvdw30
MD5:	E31A7C4CCFBA50435DC3FFB6D624ABD3
SHA1:	82004EB34EF693F38E68DDBDB595E9D7DD0D6C76
SHA-256:	15F97108C22DE6CFB40D7E3674D0A81253D664F186E7ECCAE9260ACBDCF2889A
SHA-512:	844A4277A72D91B880F388B4C9A4B57B9B1898B70B84CC5DC88225E3F5201B9A308BDFB7D3D9BD33452CD3D290CF3CEF0A63212C3F34DA38F438FA23E26A83E4
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1735381304);..user_pref("app.update.lastUpdateTime.background-update-timer", 1735381304);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1735381304);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173538

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.46713537495965
Encrypted:	false
SSDEEP:	192:InTFTRRUYbBp64LZNMGaXe6qU4o3zy+/3/7Ous5RYiNBw8dkSl:KKehFNMRnDyCOvdw30
MD5:	E31A7C4CCFBA50435DC3FFB6D624ABD3
SHA1:	82004EB34EF693F38E68DDBDB595E9D7DD0D6C76
SHA-256:	15F97108C22DE6CFB40D7E3674D0A81253D664F186E7ECCAE9260ACBDCF2889A
SHA-512:	844A4277A72D91B880F388B4C9A4B57B9B1898B70B84CC5DC88225E3F5201B9A308BDFB7D3D9BD33452CD3D290CF3CEF0A63212C3F34DA38F438FA23E26A83E4
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1735381304);..user_pref("app.update.lastUpdateTime.background-update-timer", 1735381304);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1735381304);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173538

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	6.333238696736411
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSrLXnIgPm/pnxQwRlszT5sKLHo3eHVvwKXTJamhujJAxOOxmD6maoT:GUpOx2XenR6Lo3eNwCTJ4JeGbRhr
MD5:	B2E9BED0B21B257E1F0F18D6D9E0FEB1
SHA1:	9CD17791B415AF8BFFBC3C71139C08024CB373A9
SHA-256:	B0FF758F3BAC2050BA8CC7F7C04033CE295B129AA656F81C20AD8F814AD9B172
SHA-512:	997C71A7ADAD6EF0E05E3707C55B7FFFA0676A50DB3D7CEA8334191C4609237CCA251AA55F7B217DE0E92D2D4AB0991CD4D54E47CAD53A9ADE981CBF05975463
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{1ed446a8-8543-42ef-8425-cbfa7e77d9ba}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1735381324239,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...46f3a197-db49-410a-81b3-94975c835573","zD..1...Wm..l........j..:....1":{..iUpdate...40,"startTim..Q27406...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c3270bb6f2f7664428a48797f00afbef6fc","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....278490,"originA

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	6.333238696736411
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSrLXnIgPm/pnxQwRlszT5sKLHo3eHVvwKXTJamhujJAxOOxmD6maoT:GUpOx2XenR6Lo3eNwCTJ4JeGbRhr
MD5:	B2E9BED0B21B257E1F0F18D6D9E0FEB1
SHA1:	9CD17791B415AF8BFFBC3C71139C08024CB373A9
SHA-256:	B0FF758F3BAC2050BA8CC7F7C04033CE295B129AA656F81C20AD8F814AD9B172
SHA-512:	997C71A7ADAD6EF0E05E3707C55B7FFFA0676A50DB3D7CEA8334191C4609237CCA251AA55F7B217DE0E92D2D4AB0991CD4D54E47CAD53A9ADE981CBF05975463
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{1ed446a8-8543-42ef-8425-cbfa7e77d9ba}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1735381324239,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...46f3a197-db49-410a-81b3-94975c835573","zD..1...Wm..l........j..:....1":{..iUpdate...40,"startTim..Q27406...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c3270bb6f2f7664428a48797f00afbef6fc","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....278490,"originA

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	6.333238696736411
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSrLXnIgPm/pnxQwRlszT5sKLHo3eHVvwKXTJamhujJAxOOxmD6maoT:GUpOx2XenR6Lo3eNwCTJ4JeGbRhr
MD5:	B2E9BED0B21B257E1F0F18D6D9E0FEB1
SHA1:	9CD17791B415AF8BFFBC3C71139C08024CB373A9
SHA-256:	B0FF758F3BAC2050BA8CC7F7C04033CE295B129AA656F81C20AD8F814AD9B172
SHA-512:	997C71A7ADAD6EF0E05E3707C55B7FFFA0676A50DB3D7CEA8334191C4609237CCA251AA55F7B217DE0E92D2D4AB0991CD4D54E47CAD53A9ADE981CBF05975463
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{1ed446a8-8543-42ef-8425-cbfa7e77d9ba}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1735381324239,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...46f3a197-db49-410a-81b3-94975c835573","zD..1...Wm..l........j..:....1":{..iUpdate...40,"startTim..Q27406...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abfc0b67c202aaf415a5b7a51708a5c3270bb6f2f7664428a48797f00afbef6fc","path":"/","na..a"taarI\|.Recure...,`.Donly..eexpiry....278490,"originA

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 4, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.042811512334329
Encrypted:	false
SSDEEP:	24:JBkSldh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jkSWEUo9LXtR+JdkOnohYsl
MD5:	21235938025E2102017AC8C9748948A4
SHA1:	A1EED1C4588724A8396C95FC9923C0A33B360FF8
SHA-256:	E34B06B180E3F73DC8E441650BB7FE694A9D58E927412D6ED40B0852B784824E
SHA-512:	D334B419A2A75179C17D7F53BF65FCC132ADE03B21059F0007ACDBB08284A281D8CE1C1CC598E6A070024D0DAE158E2E9618E121342BE068E87A051FE33D6061
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.008698417913156
Encrypted:	false
SSDEEP:	48:YrSAYzHqUQZpExB1+anOdW6VhOGVpWJzzcsYMsku7f86SLAVL775FtsfAcbyJFde:yczCTEr5NfJzzcBvbw6Kkvrc2Rn27
MD5:	79BD19B86346A868F6F2C053AE8EBD16
SHA1:	C2129D5536D0184B340D661B379389D9DD735BFF
SHA-256:	E5D783CA0CADD02C78DE184116876A4ADBF52BC59BDBDD539E73D55E3AEB36B0
SHA-512:	0B19C59DF084A0B79649432ECAD8003420AF247DECAA440DDD5536A9F124B91B54DA1EBEAA3C004D36E9F548627BCB349C0097EAA0D6FAF9577225749CD7893C
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-12-28T10:21:35.348Z","profileAgeCreated":1696486829272,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.008698417913156
Encrypted:	false
SSDEEP:	48:YrSAYzHqUQZpExB1+anOdW6VhOGVpWJzzcsYMsku7f86SLAVL775FtsfAcbyJFde:yczCTEr5NfJzzcBvbw6Kkvrc2Rn27
MD5:	79BD19B86346A868F6F2C053AE8EBD16
SHA1:	C2129D5536D0184B340D661B379389D9DD735BFF
SHA-256:	E5D783CA0CADD02C78DE184116876A4ADBF52BC59BDBDD539E73D55E3AEB36B0
SHA-512:	0B19C59DF084A0B79649432ECAD8003420AF247DECAA440DDD5536A9F124B91B54DA1EBEAA3C004D36E9F548627BCB349C0097EAA0D6FAF9577225749CD7893C
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-12-28T10:21:35.348Z","profileAgeCreated":1696486829272,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.704095702702296
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rpDOUhuBC5.exe
File size:	970'752 bytes
MD5:	1f856d82c95fcef4439c2c9d442e44f4
SHA1:	cb7fabe82a409e77c3d0d422117de414c08ce485
SHA256:	bc1a85c3048089f8730fe0c0c995fbede05597a6706be54c541add28cfe1d9af
SHA512:	4e646bf7f8a1dabc5a56f2502024de0399ec8b42261cb84304fb8b16a55219363c9e9f1a2af507c7111ddf845895b029ab25f1766b7eca1ccf649e9c41db66fc
SSDEEP:	24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8aAPg:yTvC/MTQYxsWR7aAP
TLSH:	2F259E0273D1C062FF9B92334B5AF6515BBC69260123E62F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x676F2C35 [Fri Dec 27 22:37:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F28147C8D83h
jmp 00007F28147C868Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F28147C886Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F28147C883Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F28147CB42Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F28147CB478h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F28147CB461h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x16580	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xeb000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x16580	0x16600	d45159d884a3608e539e0b72a8b2ac27	False	0.7046853177374302	data	7.179470013468991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xeb000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4718	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4840	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4968	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c50	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d78	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5c20	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd64c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd6a30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8fd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda080	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4e8	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xda538	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xda634	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdabc8	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb254	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb6e4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbce0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc33c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc7a4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc8fc	0xd704	data			1.0004723493932126
RT_GROUP_ICON	0xea000	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xea078	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xea08c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xea0a0	0x14	data	English	Great Britain	1.25
RT_VERSION	0xea0b4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xea190	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 09:47:32.602533102 CET	49736	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:47:32.602582932 CET	443	49736	35.190.72.216	192.168.2.6
Dec 28, 2024 09:47:32.603269100 CET	49736	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:47:32.707673073 CET	49736	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:47:32.707704067 CET	443	49736	35.190.72.216	192.168.2.6
Dec 28, 2024 09:47:34.341547966 CET	443	49736	35.190.72.216	192.168.2.6
Dec 28, 2024 09:47:34.345923901 CET	49736	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:47:34.377383947 CET	49747	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:34.384206057 CET	49736	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:47:34.384237051 CET	443	49736	35.190.72.216	192.168.2.6
Dec 28, 2024 09:47:34.384371042 CET	49736	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:47:34.384495974 CET	443	49736	35.190.72.216	192.168.2.6
Dec 28, 2024 09:47:34.384563923 CET	49736	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:47:34.448044062 CET	49748	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:34.448081970 CET	443	49748	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:34.448191881 CET	49749	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:34.448227882 CET	443	49749	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:34.448246956 CET	49748	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:34.449718952 CET	49748	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:34.449733019 CET	443	49748	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:34.449884892 CET	49749	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:34.453912020 CET	49749	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:34.453928947 CET	443	49749	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:34.496881008 CET	80	49747	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:34.497060061 CET	49747	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:34.497277021 CET	49747	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:34.590536118 CET	49750	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:34.590574026 CET	443	49750	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:34.590822935 CET	49750	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:34.592308044 CET	49750	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:34.592324972 CET	443	49750	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:34.616731882 CET	80	49747	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:34.638453960 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:34.638468027 CET	443	49751	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:34.639030933 CET	49752	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:34.639071941 CET	443	49752	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:34.640785933 CET	49752	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:34.640804052 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:34.640846968 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:34.640857935 CET	443	49751	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:34.642640114 CET	49752	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:34.642652988 CET	443	49752	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:35.008929014 CET	49753	443	192.168.2.6	34.160.144.191
Dec 28, 2024 09:47:35.008970022 CET	443	49753	34.160.144.191	192.168.2.6
Dec 28, 2024 09:47:35.009159088 CET	49753	443	192.168.2.6	34.160.144.191
Dec 28, 2024 09:47:35.009336948 CET	49753	443	192.168.2.6	34.160.144.191
Dec 28, 2024 09:47:35.009351969 CET	443	49753	34.160.144.191	192.168.2.6
Dec 28, 2024 09:47:35.628537893 CET	80	49747	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:35.769236088 CET	49747	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:36.015980959 CET	443	49750	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:36.016058922 CET	49750	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:36.020433903 CET	49750	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:36.020448923 CET	443	49750	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:36.020513058 CET	49750	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:36.020654917 CET	443	49750	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:36.020710945 CET	49750	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:36.094497919 CET	443	49752	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:36.103348017 CET	443	49752	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:36.113498926 CET	49752	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:36.132649899 CET	443	49751	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:36.133196115 CET	49752	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:36.143352032 CET	443	49751	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:36.161659002 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:36.191059113 CET	443	49748	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.191788912 CET	443	49748	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.193754911 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:36.196365118 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:36.196374893 CET	443	49751	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:36.196398973 CET	443	49749	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.196788073 CET	443	49751	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:36.197400093 CET	443	49749	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.198173046 CET	49752	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:36.198188066 CET	443	49752	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:36.198256969 CET	49752	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:36.198520899 CET	443	49752	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:36.203332901 CET	443	49748	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.207278967 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:36.207333088 CET	443	49749	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.207357883 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:36.207521915 CET	443	49751	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:36.207925081 CET	49748	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.208830118 CET	49748	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.208834887 CET	49749	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.208976030 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:36.209811926 CET	49749	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.209887028 CET	49752	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:36.210275888 CET	49751	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:36.224996090 CET	49748	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.225018978 CET	443	49748	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.225084066 CET	49748	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.225217104 CET	443	49748	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.225703001 CET	49749	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.225718021 CET	443	49749	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.225810051 CET	49749	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.225938082 CET	49748	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.225966930 CET	443	49749	142.250.181.78	192.168.2.6
Dec 28, 2024 09:47:36.230405092 CET	49749	443	192.168.2.6	142.250.181.78
Dec 28, 2024 09:47:36.272911072 CET	443	49753	34.160.144.191	192.168.2.6
Dec 28, 2024 09:47:36.272986889 CET	49753	443	192.168.2.6	34.160.144.191
Dec 28, 2024 09:47:36.276113033 CET	49753	443	192.168.2.6	34.160.144.191
Dec 28, 2024 09:47:36.276122093 CET	443	49753	34.160.144.191	192.168.2.6
Dec 28, 2024 09:47:36.276571035 CET	443	49753	34.160.144.191	192.168.2.6
Dec 28, 2024 09:47:36.279000998 CET	49753	443	192.168.2.6	34.160.144.191
Dec 28, 2024 09:47:36.279073000 CET	49753	443	192.168.2.6	34.160.144.191
Dec 28, 2024 09:47:36.279198885 CET	443	49753	34.160.144.191	192.168.2.6
Dec 28, 2024 09:47:36.279453039 CET	49753	443	192.168.2.6	34.160.144.191
Dec 28, 2024 09:47:37.271115065 CET	49747	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:37.391014099 CET	80	49747	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:37.391077995 CET	49747	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:37.429270983 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:37.497164011 CET	49764	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:37.497221947 CET	443	49764	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:37.498323917 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:37.509196997 CET	49764	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:37.510590076 CET	49764	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:37.510606050 CET	443	49764	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:37.548779011 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:37.549566984 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:37.549755096 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:37.617945910 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:37.618084908 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:37.669231892 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:37.771759987 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:37.891283035 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:38.681643963 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:38.749285936 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:38.756865025 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:38.819787979 CET	443	49764	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:38.819804907 CET	443	49764	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:38.819864988 CET	49764	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:38.829324961 CET	49764	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:38.829335928 CET	443	49764	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:38.829407930 CET	49764	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:38.829569101 CET	443	49764	34.117.188.166	192.168.2.6
Dec 28, 2024 09:47:38.829615116 CET	49764	443	192.168.2.6	34.117.188.166
Dec 28, 2024 09:47:38.872706890 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:39.402115107 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:39.661897898 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:39.725291014 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:39.775305986 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:43.263052940 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:43.266438007 CET	49782	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:43.266494036 CET	443	49782	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:43.266568899 CET	49782	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:43.268517971 CET	49782	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:43.268537045 CET	443	49782	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:43.382581949 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:43.586777925 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:43.633371115 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:44.529275894 CET	443	49782	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:44.529361963 CET	49782	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:44.535135984 CET	49782	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:44.535145998 CET	443	49782	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:44.535238028 CET	49782	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:44.535301924 CET	443	49782	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:44.535370111 CET	49782	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:47.127899885 CET	49788	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:47.127938986 CET	443	49788	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:47.128053904 CET	49788	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:47.128185034 CET	49788	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:47.128199100 CET	443	49788	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:47.306041002 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:47.319804907 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:47.425582886 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:47.439270973 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:47.449984074 CET	49791	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:47.450021982 CET	443	49791	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:47.450560093 CET	49791	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:47.452136040 CET	49791	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:47.452152967 CET	443	49791	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:47.629571915 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:47.643465996 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:47.685869932 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:47.685869932 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:47.793868065 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:47.913480997 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:47.918982029 CET	49795	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:47.919039011 CET	443	49795	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:47.919123888 CET	49795	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:47.920597076 CET	49795	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:47.920609951 CET	443	49795	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:48.117507935 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:48.171766996 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:48.385693073 CET	443	49788	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:48.385766983 CET	49788	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:48.641799927 CET	49788	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:48.641814947 CET	443	49788	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:48.642210007 CET	443	49788	35.244.181.201	192.168.2.6
Dec 28, 2024 09:47:48.644365072 CET	49788	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:48.644435883 CET	49788	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:48.644543886 CET	49788	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:47:48.667685032 CET	443	49791	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:48.667759895 CET	49791	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:48.672229052 CET	49791	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:48.672235966 CET	443	49791	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:48.672323942 CET	49791	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:48.672399998 CET	443	49791	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:48.672472954 CET	49791	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:48.979403019 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:49.099050045 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:49.184036970 CET	443	49795	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:49.184125900 CET	49795	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:49.303734064 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:49.345766068 CET	49795	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:49.345794916 CET	443	49795	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:49.345875025 CET	49795	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:49.346082926 CET	443	49795	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:49.346295118 CET	49796	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:49.346337080 CET	443	49796	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:49.347155094 CET	49795	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:49.347230911 CET	49796	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:49.348619938 CET	49796	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:49.348634958 CET	443	49796	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:49.353085041 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:49.483525038 CET	49797	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:49.483558893 CET	443	49797	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:49.483683109 CET	49797	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:49.485171080 CET	49797	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:49.485184908 CET	443	49797	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:49.496411085 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:49.616056919 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:49.820967913 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:49.877130985 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:50.651770115 CET	443	49796	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:50.651849985 CET	49796	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:50.750219107 CET	443	49797	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:50.750305891 CET	49797	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.128914118 CET	49796	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:53.128947020 CET	443	49796	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:53.129013062 CET	49796	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:53.129237890 CET	443	49796	34.149.100.209	192.168.2.6
Dec 28, 2024 09:47:53.129431963 CET	49797	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.129462957 CET	443	49797	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:53.129491091 CET	49797	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.129698992 CET	443	49797	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:53.132817030 CET	49796	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:47:53.132826090 CET	49797	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.724349976 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:53.775837898 CET	49809	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.775877953 CET	443	49809	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:53.779418945 CET	49809	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.780869007 CET	49809	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.780886889 CET	443	49809	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:53.843852043 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:53.864396095 CET	49810	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:53.864439964 CET	443	49810	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:53.865183115 CET	49810	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:53.866750002 CET	49810	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:53.866766930 CET	443	49810	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:53.917001009 CET	49811	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.917056084 CET	443	49811	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:53.917090893 CET	49812	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.917133093 CET	443	49812	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:53.917169094 CET	49811	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.917320013 CET	49811	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.917335987 CET	443	49811	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:53.917417049 CET	49812	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.917489052 CET	49812	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:53.917505980 CET	443	49812	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:54.048139095 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:54.052798986 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:54.091453075 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:54.172271967 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:54.376282930 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:54.438105106 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:54.991481066 CET	443	49809	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:54.994452000 CET	49809	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.056844950 CET	49809	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.056865931 CET	443	49809	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.056956053 CET	49809	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.057218075 CET	443	49809	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.057271004 CET	49809	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.127954960 CET	443	49812	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.128546953 CET	49812	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.131319046 CET	49812	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.131328106 CET	443	49812	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.131589890 CET	443	49812	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.134202957 CET	49812	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.134289980 CET	49812	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.134371996 CET	443	49812	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.134462118 CET	49812	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.171015978 CET	443	49810	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:55.171161890 CET	49810	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:55.174309969 CET	443	49811	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.174385071 CET	49811	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.177078962 CET	49811	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.177088022 CET	443	49811	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.177330971 CET	443	49811	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.177654028 CET	49810	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:55.177669048 CET	443	49810	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:55.177737951 CET	49810	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:55.177850008 CET	443	49810	34.107.243.93	192.168.2.6
Dec 28, 2024 09:47:55.178200006 CET	49810	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:47:55.179723024 CET	49811	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.179800987 CET	49811	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.179867029 CET	443	49811	34.120.208.123	192.168.2.6
Dec 28, 2024 09:47:55.179970026 CET	49811	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:47:55.593967915 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:55.713489056 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:55.918442011 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:55.922461033 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:55.962455034 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:47:56.041951895 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:56.245796919 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:47:56.294718027 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:00.655384064 CET	49831	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:00.655424118 CET	443	49831	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:00.657978058 CET	49831	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:00.658129930 CET	49831	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:00.658143997 CET	443	49831	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:00.716064930 CET	49833	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:48:00.716128111 CET	443	49833	35.190.72.216	192.168.2.6
Dec 28, 2024 09:48:00.717060089 CET	49833	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:48:00.719566107 CET	49833	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:48:00.719577074 CET	443	49833	35.190.72.216	192.168.2.6
Dec 28, 2024 09:48:00.858506918 CET	49836	443	192.168.2.6	35.201.103.21
Dec 28, 2024 09:48:00.858549118 CET	443	49836	35.201.103.21	192.168.2.6
Dec 28, 2024 09:48:00.859097958 CET	49836	443	192.168.2.6	35.201.103.21
Dec 28, 2024 09:48:00.860445023 CET	49836	443	192.168.2.6	35.201.103.21
Dec 28, 2024 09:48:00.860465050 CET	443	49836	35.201.103.21	192.168.2.6
Dec 28, 2024 09:48:00.863020897 CET	49837	443	192.168.2.6	151.101.129.91
Dec 28, 2024 09:48:00.863063097 CET	443	49837	151.101.129.91	192.168.2.6
Dec 28, 2024 09:48:00.863488913 CET	49837	443	192.168.2.6	151.101.129.91
Dec 28, 2024 09:48:00.863596916 CET	49837	443	192.168.2.6	151.101.129.91
Dec 28, 2024 09:48:00.863610029 CET	443	49837	151.101.129.91	192.168.2.6
Dec 28, 2024 09:48:01.042785883 CET	49841	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:01.042834997 CET	443	49841	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:01.042898893 CET	49841	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:01.043029070 CET	49841	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:01.043041945 CET	443	49841	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:01.914760113 CET	443	49831	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:01.914853096 CET	49831	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:01.918464899 CET	49831	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:01.918474913 CET	443	49831	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:01.918862104 CET	443	49831	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:01.921514034 CET	49831	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:01.921626091 CET	49831	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:01.921681881 CET	443	49831	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:01.921823025 CET	49831	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:01.943355083 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:01.975295067 CET	443	49833	35.190.72.216	192.168.2.6
Dec 28, 2024 09:48:01.975394011 CET	49833	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:48:01.979080915 CET	49833	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:48:01.979101896 CET	443	49833	35.190.72.216	192.168.2.6
Dec 28, 2024 09:48:01.979190111 CET	49833	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:48:01.979273081 CET	443	49833	35.190.72.216	192.168.2.6
Dec 28, 2024 09:48:01.980166912 CET	49833	443	192.168.2.6	35.190.72.216
Dec 28, 2024 09:48:02.062952042 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:02.120120049 CET	443	49836	35.201.103.21	192.168.2.6
Dec 28, 2024 09:48:02.120219946 CET	49836	443	192.168.2.6	35.201.103.21
Dec 28, 2024 09:48:02.122798920 CET	443	49837	151.101.129.91	192.168.2.6
Dec 28, 2024 09:48:02.122896910 CET	49837	443	192.168.2.6	151.101.129.91
Dec 28, 2024 09:48:02.125761032 CET	49837	443	192.168.2.6	151.101.129.91
Dec 28, 2024 09:48:02.125771046 CET	443	49837	151.101.129.91	192.168.2.6
Dec 28, 2024 09:48:02.126017094 CET	443	49837	151.101.129.91	192.168.2.6
Dec 28, 2024 09:48:02.128853083 CET	49836	443	192.168.2.6	35.201.103.21
Dec 28, 2024 09:48:02.128870010 CET	443	49836	35.201.103.21	192.168.2.6
Dec 28, 2024 09:48:02.129019022 CET	49836	443	192.168.2.6	35.201.103.21
Dec 28, 2024 09:48:02.129071951 CET	443	49836	35.201.103.21	192.168.2.6
Dec 28, 2024 09:48:02.129515886 CET	49837	443	192.168.2.6	151.101.129.91
Dec 28, 2024 09:48:02.129566908 CET	49837	443	192.168.2.6	151.101.129.91
Dec 28, 2024 09:48:02.129674911 CET	443	49837	151.101.129.91	192.168.2.6
Dec 28, 2024 09:48:02.134263039 CET	49836	443	192.168.2.6	35.201.103.21
Dec 28, 2024 09:48:02.134285927 CET	49837	443	192.168.2.6	151.101.129.91
Dec 28, 2024 09:48:02.137985945 CET	49842	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.138025045 CET	443	49842	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.140084982 CET	49843	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.140114069 CET	443	49843	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.140718937 CET	49842	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.140872002 CET	49842	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.140875101 CET	49843	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.140883923 CET	443	49842	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.140991926 CET	49843	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.141002893 CET	443	49843	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.142781973 CET	49844	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.142818928 CET	443	49844	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.144823074 CET	49844	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.144973040 CET	49844	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.144989014 CET	443	49844	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.149754047 CET	49845	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:02.149781942 CET	443	49845	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:02.149882078 CET	49845	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:02.149996042 CET	49845	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:02.150012016 CET	443	49845	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:02.252785921 CET	443	49841	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.252872944 CET	49841	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.255997896 CET	49841	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.256006002 CET	443	49841	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.256264925 CET	443	49841	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.259110928 CET	49841	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.259233952 CET	49841	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.259279013 CET	443	49841	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:02.259408951 CET	49841	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:02.266875029 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:02.269875050 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:02.319192886 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:02.389333010 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:02.593204975 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:02.635682106 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:03.350714922 CET	443	49842	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.350810051 CET	49842	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.353959084 CET	49842	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.353976011 CET	443	49842	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.354226112 CET	443	49842	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.357268095 CET	49842	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.357382059 CET	49842	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.357438087 CET	443	49842	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.357559919 CET	49842	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.361567020 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:03.401434898 CET	443	49844	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.401536942 CET	49844	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.404628992 CET	49844	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.404640913 CET	443	49844	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.405004025 CET	443	49844	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.405606031 CET	443	49845	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:03.405692101 CET	49845	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:03.408577919 CET	49845	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:03.408591032 CET	443	49845	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:03.408971071 CET	443	49845	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:03.411432981 CET	49844	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.411660910 CET	49844	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.411739111 CET	443	49844	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.412017107 CET	49845	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:03.412066936 CET	49845	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:03.412224054 CET	49844	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.412256956 CET	443	49845	34.149.100.209	192.168.2.6
Dec 28, 2024 09:48:03.412525892 CET	49845	443	192.168.2.6	34.149.100.209
Dec 28, 2024 09:48:03.443730116 CET	443	49843	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.452104092 CET	49843	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.455364943 CET	49843	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.455388069 CET	443	49843	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.455703020 CET	443	49843	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.462615967 CET	49843	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.462724924 CET	49843	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.462829113 CET	443	49843	35.244.181.201	192.168.2.6
Dec 28, 2024 09:48:03.465651035 CET	49843	443	192.168.2.6	35.244.181.201
Dec 28, 2024 09:48:03.481070995 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:03.685420036 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:03.688587904 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:03.738928080 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:03.808206081 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:04.011917114 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:04.055422068 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:05.742561102 CET	49857	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:05.742618084 CET	443	49857	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:05.743359089 CET	49857	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:05.744961977 CET	49857	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:05.744993925 CET	443	49857	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:07.000924110 CET	443	49857	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:07.001003027 CET	49857	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:07.005772114 CET	49857	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:07.005779028 CET	443	49857	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:07.005903959 CET	49857	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:07.005958080 CET	443	49857	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:07.007499933 CET	49857	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:07.009629011 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:07.129117012 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:07.338013887 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:07.343785048 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:07.387392998 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:07.463278055 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:07.667272091 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:07.719538927 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:17.346991062 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:17.466552019 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:17.679266930 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:17.798758030 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:27.249449968 CET	49904	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:27.249476910 CET	443	49904	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:27.254403114 CET	49904	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:27.256128073 CET	49904	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:27.256139994 CET	443	49904	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:27.477117062 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:27.596554041 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:27.809257030 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:27.928715944 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:28.559276104 CET	443	49904	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:28.559597969 CET	49904	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:28.563581944 CET	49904	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:28.563590050 CET	443	49904	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:28.563746929 CET	49904	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:28.563797951 CET	443	49904	34.107.243.93	192.168.2.6
Dec 28, 2024 09:48:28.564728022 CET	49904	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:48:28.566797972 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:28.855007887 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:28.963392973 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:28.966725111 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:29.012820005 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:29.086205959 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:29.290007114 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:29.344954014 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:31.280782938 CET	49914	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.280821085 CET	443	49914	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.281052113 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.281096935 CET	443	49915	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.281364918 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.281399012 CET	443	49916	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.281500101 CET	49917	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.281527042 CET	443	49917	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.281626940 CET	49918	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.281637907 CET	443	49918	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.281753063 CET	49919	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.281764030 CET	443	49919	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.281991005 CET	49914	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282006979 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282006979 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282033920 CET	49918	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282041073 CET	49917	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282041073 CET	49919	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282170057 CET	49914	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282187939 CET	443	49914	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.282325029 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282341957 CET	443	49915	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.282387018 CET	49919	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282403946 CET	443	49919	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.282443047 CET	49918	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282455921 CET	443	49918	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.282502890 CET	49917	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282515049 CET	443	49917	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:31.282556057 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:31.282566071 CET	443	49916	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.494801998 CET	443	49914	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.495301962 CET	443	49919	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.496011972 CET	443	49917	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.496129990 CET	443	49915	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.497410059 CET	49914	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.497411013 CET	49919	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.497411013 CET	49917	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.498012066 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.500998020 CET	49914	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.501030922 CET	443	49914	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.501358986 CET	443	49914	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.503675938 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.503700972 CET	443	49915	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.503999949 CET	443	49915	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.505914927 CET	49919	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.505928040 CET	443	49919	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.506228924 CET	443	49919	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.508274078 CET	49917	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.508291006 CET	443	49917	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.508565903 CET	443	49917	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.513602018 CET	49914	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.513607025 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.513907909 CET	443	49915	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.513907909 CET	443	49914	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.513978004 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.513986111 CET	443	49915	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.514142036 CET	49919	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.514168024 CET	49914	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.514193058 CET	443	49914	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.514307976 CET	49919	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.514343023 CET	443	49919	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.514976978 CET	49924	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.515018940 CET	443	49924	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.515152931 CET	49925	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.515212059 CET	443	49925	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.515496969 CET	49917	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.515569925 CET	49917	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.515661955 CET	443	49917	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.518906116 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.518923998 CET	49919	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519253969 CET	49917	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519282103 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519292116 CET	49915	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519306898 CET	49919	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519357920 CET	49917	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519361019 CET	49924	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519552946 CET	49925	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519556046 CET	49924	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519566059 CET	443	49924	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.519639969 CET	49925	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.519658089 CET	443	49925	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.527523994 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:32.540414095 CET	443	49916	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.543490887 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.546916008 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.546927929 CET	443	49916	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.547171116 CET	443	49916	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.549179077 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.549349070 CET	443	49916	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.550384998 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.550395966 CET	443	49916	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.550599098 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.550614119 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.551702023 CET	49916	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.585748911 CET	443	49918	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.586016893 CET	49918	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.589189053 CET	49918	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.589201927 CET	443	49918	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.589535952 CET	443	49918	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.591926098 CET	49918	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.592066050 CET	49918	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.592118025 CET	443	49918	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.592895031 CET	49918	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.647726059 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:32.719338894 CET	443	49914	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:32.719408989 CET	49914	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:32.851736069 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:32.855868101 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:32.896591902 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:32.975380898 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:33.179131985 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:33.228821039 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:33.735019922 CET	443	49925	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:33.735110998 CET	49925	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.738733053 CET	49925	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.738740921 CET	443	49925	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:33.739023924 CET	443	49925	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:33.741789103 CET	49925	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.741942883 CET	49925	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.741991997 CET	443	49925	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:33.742989063 CET	49925	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.745457888 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:33.776218891 CET	443	49924	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:33.776321888 CET	49924	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.780029058 CET	49924	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.780040026 CET	443	49924	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:33.780307055 CET	443	49924	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:33.783354044 CET	49924	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.783541918 CET	49924	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.783557892 CET	443	49924	34.120.208.123	192.168.2.6
Dec 28, 2024 09:48:33.783744097 CET	49924	443	192.168.2.6	34.120.208.123
Dec 28, 2024 09:48:33.864964008 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:34.069024086 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:34.072592020 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:34.115879059 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:34.192152977 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:34.398262978 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:34.448050022 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:44.077481031 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:44.196973085 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:44.416239023 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:44.535943031 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:54.207336903 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:54.326770067 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:48:54.545972109 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:48:54.665455103 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:04.330924988 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:04.450373888 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:04.678642988 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:04.798508883 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:08.835025072 CET	50004	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:49:08.835059881 CET	443	50004	34.107.243.93	192.168.2.6
Dec 28, 2024 09:49:08.835400105 CET	50004	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:49:08.836931944 CET	50004	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:49:08.836947918 CET	443	50004	34.107.243.93	192.168.2.6
Dec 28, 2024 09:49:10.047620058 CET	443	50004	34.107.243.93	192.168.2.6
Dec 28, 2024 09:49:10.047811031 CET	50004	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:49:10.054228067 CET	50004	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:49:10.054239988 CET	443	50004	34.107.243.93	192.168.2.6
Dec 28, 2024 09:49:10.054330111 CET	50004	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:49:10.054586887 CET	443	50004	34.107.243.93	192.168.2.6
Dec 28, 2024 09:49:10.055279970 CET	50004	443	192.168.2.6	34.107.243.93
Dec 28, 2024 09:49:10.057132959 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:10.176573038 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:10.380680084 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:10.384355068 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:10.421102047 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:10.503793001 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:10.707654953 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:10.755820036 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:20.384650946 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:20.504816055 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:20.716811895 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:20.836618900 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:30.515450954 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:30.635035992 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:30.847682953 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:30.967165947 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:40.645745039 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:40.765336990 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:40.977904081 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:41.097457886 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:50.775732994 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:50.895613909 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:49:51.107805014 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:49:51.227370977 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:50:00.906137943 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:50:01.025743961 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:50:01.238270998 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:50:01.357914925 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:50:11.036138058 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:50:11.155719995 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:50:11.368298054 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:50:11.487862110 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:50:21.168829918 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:50:21.288412094 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:50:21.491803885 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:50:21.611624002 CET	80	49763	34.107.221.82	192.168.2.6
Dec 28, 2024 09:50:31.297372103 CET	49765	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:50:31.417251110 CET	80	49765	34.107.221.82	192.168.2.6
Dec 28, 2024 09:50:31.613866091 CET	49763	80	192.168.2.6	34.107.221.82
Dec 28, 2024 09:50:31.733603954 CET	80	49763	34.107.221.82	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 09:47:32.609343052 CET	56040	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:32.752172947 CET	53	56040	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:32.755913019 CET	53053	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:32.894933939 CET	53	53053	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:33.861370087 CET	49575	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:33.861660004 CET	53412	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.356372118 CET	60761	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.446687937 CET	50169	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.446765900 CET	53	53412	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:34.448329926 CET	57992	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.494563103 CET	63144	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.496226072 CET	53	60761	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:34.496872902 CET	57501	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.586607933 CET	53	50169	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:34.588443041 CET	53	57992	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:34.589373112 CET	51018	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.590675116 CET	53992	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.625412941 CET	59594	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.634243011 CET	53	63144	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:34.636368036 CET	53	57501	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:34.639815092 CET	49535	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.735549927 CET	62788	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.987386942 CET	53	51018	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:34.987410069 CET	53	53992	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:34.988312006 CET	57593	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:34.988749027 CET	58386	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:35.007191896 CET	53	49535	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:35.007797956 CET	57382	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:35.008053064 CET	53	59594	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:35.129343033 CET	53	58386	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:35.130496025 CET	57373	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:35.133609056 CET	53	57593	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:35.134193897 CET	53374	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:35.147476912 CET	53	57382	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:35.269670010 CET	53	57373	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:35.272926092 CET	53	53374	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:35.274105072 CET	61901	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:35.413563013 CET	53	61901	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:35.588752985 CET	53	50978	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:37.168031931 CET	58866	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:37.168493032 CET	60130	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:37.285729885 CET	62519	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:37.307964087 CET	53	60130	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:37.307977915 CET	53	58866	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:38.707947016 CET	59423	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:38.847347975 CET	53	59423	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:38.851304054 CET	64110	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:38.991388083 CET	53	64110	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:38.992898941 CET	62311	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:39.131988049 CET	53	62311	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:43.265688896 CET	60434	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:43.278795004 CET	49262	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:43.417561054 CET	53	49262	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:43.420133114 CET	49489	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:43.559528112 CET	53	49489	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:43.560291052 CET	57979	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:43.699292898 CET	53	57979	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:46.542351961 CET	63995	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:46.686743021 CET	53	63995	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:47.307774067 CET	49729	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:47.450171947 CET	49990	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:47.589548111 CET	53	49990	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:47.590600014 CET	57468	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:47.730098963 CET	53	57468	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:47.778116941 CET	65324	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:47.917686939 CET	53	65324	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:47.919176102 CET	64884	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:48.060659885 CET	53	64884	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:48.061459064 CET	50586	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:48.200911999 CET	53	50586	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:53.776813984 CET	62135	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:53.867381096 CET	55499	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:53.916094065 CET	53	62135	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:54.006748915 CET	53	55499	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:55.762748003 CET	50823	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:55.763088942 CET	49168	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:55.763154984 CET	58957	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:55.902100086 CET	53	50823	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:55.902765036 CET	53	58957	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:55.902937889 CET	49242	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:55.903476000 CET	54523	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:55.908586979 CET	53	49168	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:55.909424067 CET	59354	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.042766094 CET	53	49242	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.043117046 CET	53	54523	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.047816992 CET	57270	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.048132896 CET	55862	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.048751116 CET	53	59354	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.049200058 CET	50693	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.186885118 CET	53	57270	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.187602997 CET	53	55862	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.188388109 CET	57665	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.189100981 CET	61692	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.189141035 CET	53	50693	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.328516960 CET	53	57665	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.328789949 CET	53	61692	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.329729080 CET	59177	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.330343962 CET	60487	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.471021891 CET	53	60487	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.472045898 CET	58344	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.531339884 CET	53	59177	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.532320976 CET	64993	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:47:56.611408949 CET	53	58344	1.1.1.1	192.168.2.6
Dec 28, 2024 09:47:56.743957043 CET	53	64993	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:00.650528908 CET	49706	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:00.716953039 CET	59553	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:00.857470036 CET	53	59553	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:00.858932018 CET	50912	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:00.862272978 CET	53	49706	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:00.864043951 CET	60844	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:00.999496937 CET	53	50912	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:01.003556013 CET	61545	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:01.006673098 CET	53	60844	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:01.007239103 CET	64456	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:01.042566061 CET	54176	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:01.143413067 CET	53	61545	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:01.184313059 CET	53	54176	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:01.185065985 CET	58517	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:01.215434074 CET	53	64456	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:01.324135065 CET	53	58517	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:05.601059914 CET	61386	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:05.741489887 CET	53	61386	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:05.742939949 CET	53094	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:05.882282972 CET	53	53094	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:27.249320984 CET	52713	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:27.389106989 CET	53	52713	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:27.556150913 CET	49807	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:27.696166039 CET	53	49807	1.1.1.1	192.168.2.6
Dec 28, 2024 09:48:31.277678967 CET	55500	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:48:31.416812897 CET	53	55500	1.1.1.1	192.168.2.6
Dec 28, 2024 09:49:08.694514036 CET	64765	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:49:08.833854914 CET	53	64765	1.1.1.1	192.168.2.6
Dec 28, 2024 09:49:08.835282087 CET	61081	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:49:08.974658012 CET	53	61081	1.1.1.1	192.168.2.6
Dec 28, 2024 09:49:10.057368994 CET	58112	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:49:10.381822109 CET	49835	53	192.168.2.6	1.1.1.1
Dec 28, 2024 09:49:10.522099018 CET	53	49835	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 09:47:32.609343052 CET	192.168.2.6	1.1.1.1	0xe50a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:32.755913019 CET	192.168.2.6	1.1.1.1	0x606c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 28, 2024 09:47:33.861370087 CET	192.168.2.6	1.1.1.1	0x4eb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:33.861660004 CET	192.168.2.6	1.1.1.1	0xa368	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.356372118 CET	192.168.2.6	1.1.1.1	0xecf4	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.446687937 CET	192.168.2.6	1.1.1.1	0xebd9	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.448329926 CET	192.168.2.6	1.1.1.1	0x3fc4	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.494563103 CET	192.168.2.6	1.1.1.1	0x2049	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.496872902 CET	192.168.2.6	1.1.1.1	0xde49	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 28, 2024 09:47:34.589373112 CET	192.168.2.6	1.1.1.1	0x7d04	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 28, 2024 09:47:34.590675116 CET	192.168.2.6	1.1.1.1	0xfc48	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.625412941 CET	192.168.2.6	1.1.1.1	0x2762	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.639815092 CET	192.168.2.6	1.1.1.1	0x54d9	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.735549927 CET	192.168.2.6	1.1.1.1	0x865e	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.988312006 CET	192.168.2.6	1.1.1.1	0x2d66	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.988749027 CET	192.168.2.6	1.1.1.1	0xb97b	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:47:35.007797956 CET	192.168.2.6	1.1.1.1	0x9621	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 28, 2024 09:47:35.130496025 CET	192.168.2.6	1.1.1.1	0xe800	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:35.134193897 CET	192.168.2.6	1.1.1.1	0x923e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 28, 2024 09:47:35.274105072 CET	192.168.2.6	1.1.1.1	0x97da	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 28, 2024 09:47:37.168031931 CET	192.168.2.6	1.1.1.1	0x32c5	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:37.168493032 CET	192.168.2.6	1.1.1.1	0x3c3d	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:37.285729885 CET	192.168.2.6	1.1.1.1	0xeb4d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:38.707947016 CET	192.168.2.6	1.1.1.1	0x92a3	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:38.851304054 CET	192.168.2.6	1.1.1.1	0x6cb9	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:38.992898941 CET	192.168.2.6	1.1.1.1	0x459d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:47:43.265688896 CET	192.168.2.6	1.1.1.1	0x56b	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:43.278795004 CET	192.168.2.6	1.1.1.1	0xda86	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:43.420133114 CET	192.168.2.6	1.1.1.1	0x3eed	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:43.560291052 CET	192.168.2.6	1.1.1.1	0x17b9	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 28, 2024 09:47:46.542351961 CET	192.168.2.6	1.1.1.1	0x4171	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 28, 2024 09:47:47.307774067 CET	192.168.2.6	1.1.1.1	0x8fb6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:47.450171947 CET	192.168.2.6	1.1.1.1	0xb2a	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:47.590600014 CET	192.168.2.6	1.1.1.1	0xb79b	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:47:47.778116941 CET	192.168.2.6	1.1.1.1	0x414d	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:47.919176102 CET	192.168.2.6	1.1.1.1	0x4fe0	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:48.061459064 CET	192.168.2.6	1.1.1.1	0x81a0	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 28, 2024 09:47:53.776813984 CET	192.168.2.6	1.1.1.1	0x22c7	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:47:53.867381096 CET	192.168.2.6	1.1.1.1	0x1a02	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:47:55.762748003 CET	192.168.2.6	1.1.1.1	0x1394	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.763088942 CET	192.168.2.6	1.1.1.1	0x1391	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.763154984 CET	192.168.2.6	1.1.1.1	0x65c4	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902937889 CET	192.168.2.6	1.1.1.1	0x4173	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.903476000 CET	192.168.2.6	1.1.1.1	0x5052	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.909424067 CET	192.168.2.6	1.1.1.1	0xd633	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.047816992 CET	192.168.2.6	1.1.1.1	0x947d	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Dec 28, 2024 09:47:56.048132896 CET	192.168.2.6	1.1.1.1	0xd31d	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Dec 28, 2024 09:47:56.049200058 CET	192.168.2.6	1.1.1.1	0xf0de	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Dec 28, 2024 09:47:56.188388109 CET	192.168.2.6	1.1.1.1	0x177d	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.189100981 CET	192.168.2.6	1.1.1.1	0xb633	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.329729080 CET	192.168.2.6	1.1.1.1	0x6e5c	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.330343962 CET	192.168.2.6	1.1.1.1	0xd3db	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.472045898 CET	192.168.2.6	1.1.1.1	0xf95	Standard query (0)	twitter.com	28	IN (0x0001)	false
Dec 28, 2024 09:47:56.532320976 CET	192.168.2.6	1.1.1.1	0x4ca	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Dec 28, 2024 09:48:00.650528908 CET	192.168.2.6	1.1.1.1	0x9506	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:00.716953039 CET	192.168.2.6	1.1.1.1	0xbed1	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:00.858932018 CET	192.168.2.6	1.1.1.1	0xd444	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:00.864043951 CET	192.168.2.6	1.1.1.1	0x1849	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:01.003556013 CET	192.168.2.6	1.1.1.1	0xa0f0	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:48:01.007239103 CET	192.168.2.6	1.1.1.1	0x4209	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Dec 28, 2024 09:48:01.042566061 CET	192.168.2.6	1.1.1.1	0x26ca	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:01.185065985 CET	192.168.2.6	1.1.1.1	0xb9dc	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 28, 2024 09:48:05.601059914 CET	192.168.2.6	1.1.1.1	0x497e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:05.742939949 CET	192.168.2.6	1.1.1.1	0x95d4	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:48:27.249320984 CET	192.168.2.6	1.1.1.1	0x1bff	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:48:27.556150913 CET	192.168.2.6	1.1.1.1	0x97d8	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:31.277678967 CET	192.168.2.6	1.1.1.1	0xc553	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:49:08.694514036 CET	192.168.2.6	1.1.1.1	0x85ee	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:08.835282087 CET	192.168.2.6	1.1.1.1	0xa53c	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Dec 28, 2024 09:49:10.057368994 CET	192.168.2.6	1.1.1.1	0x6a68	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:10.381822109 CET	192.168.2.6	1.1.1.1	0x6130	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 09:47:18.128035069 CET	1.1.1.1	192.168.2.6	0xd1bb	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:18.128035069 CET	1.1.1.1	192.168.2.6	0xd1bb	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:32.590221882 CET	1.1.1.1	192.168.2.6	0xf790	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:32.752172947 CET	1.1.1.1	192.168.2.6	0xe50a	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.354407072 CET	1.1.1.1	192.168.2.6	0x4eb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:34.354407072 CET	1.1.1.1	192.168.2.6	0x4eb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.446765900 CET	1.1.1.1	192.168.2.6	0xa368	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.496226072 CET	1.1.1.1	192.168.2.6	0xecf4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.586607933 CET	1.1.1.1	192.168.2.6	0xebd9	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.588443041 CET	1.1.1.1	192.168.2.6	0x3fc4	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.626367092 CET	1.1.1.1	192.168.2.6	0x50e3	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:34.626367092 CET	1.1.1.1	192.168.2.6	0x50e3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.634243011 CET	1.1.1.1	192.168.2.6	0x2049	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:34.634243011 CET	1.1.1.1	192.168.2.6	0x2049	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:34.636368036 CET	1.1.1.1	192.168.2.6	0xde49	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 28, 2024 09:47:34.987386942 CET	1.1.1.1	192.168.2.6	0x7d04	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 28, 2024 09:47:34.987410069 CET	1.1.1.1	192.168.2.6	0xfc48	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:35.007191896 CET	1.1.1.1	192.168.2.6	0x54d9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:35.008053064 CET	1.1.1.1	192.168.2.6	0x2762	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:35.008053064 CET	1.1.1.1	192.168.2.6	0x2762	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:35.008053064 CET	1.1.1.1	192.168.2.6	0x2762	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:35.078234911 CET	1.1.1.1	192.168.2.6	0x865e	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:35.133609056 CET	1.1.1.1	192.168.2.6	0x2d66	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:35.269670010 CET	1.1.1.1	192.168.2.6	0xe800	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:35.413563013 CET	1.1.1.1	192.168.2.6	0x97da	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 28, 2024 09:47:37.307964087 CET	1.1.1.1	192.168.2.6	0x3c3d	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:37.307964087 CET	1.1.1.1	192.168.2.6	0x3c3d	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:37.307977915 CET	1.1.1.1	192.168.2.6	0x32c5	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:37.426971912 CET	1.1.1.1	192.168.2.6	0xeb4d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:37.426971912 CET	1.1.1.1	192.168.2.6	0xeb4d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:38.847347975 CET	1.1.1.1	192.168.2.6	0x92a3	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:38.991388083 CET	1.1.1.1	192.168.2.6	0x6cb9	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:43.406064034 CET	1.1.1.1	192.168.2.6	0x56b	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:43.406064034 CET	1.1.1.1	192.168.2.6	0x56b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:43.417561054 CET	1.1.1.1	192.168.2.6	0xda86	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:43.417561054 CET	1.1.1.1	192.168.2.6	0xda86	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:43.417561054 CET	1.1.1.1	192.168.2.6	0xda86	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:43.559528112 CET	1.1.1.1	192.168.2.6	0x3eed	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:47.126749992 CET	1.1.1.1	192.168.2.6	0xfbb0	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:47.126749992 CET	1.1.1.1	192.168.2.6	0xfbb0	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:47.446645021 CET	1.1.1.1	192.168.2.6	0x360	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:47.447715044 CET	1.1.1.1	192.168.2.6	0x8fb6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:47.447715044 CET	1.1.1.1	192.168.2.6	0x8fb6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:47.589548111 CET	1.1.1.1	192.168.2.6	0xb2a	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:47.917686939 CET	1.1.1.1	192.168.2.6	0x414d	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:47.917686939 CET	1.1.1.1	192.168.2.6	0x414d	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:48.060659885 CET	1.1.1.1	192.168.2.6	0x4fe0	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:49.482506037 CET	1.1.1.1	192.168.2.6	0xf97f	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		172.217.19.14	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902100086 CET	1.1.1.1	192.168.2.6	0x1394	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902765036 CET	1.1.1.1	192.168.2.6	0x65c4	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:55.902765036 CET	1.1.1.1	192.168.2.6	0x65c4	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:55.908586979 CET	1.1.1.1	192.168.2.6	0x1391	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:55.908586979 CET	1.1.1.1	192.168.2.6	0x1391	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.042766094 CET	1.1.1.1	192.168.2.6	0x4173	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.043117046 CET	1.1.1.1	192.168.2.6	0x5052	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.048751116 CET	1.1.1.1	192.168.2.6	0xd633	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.186885118 CET	1.1.1.1	192.168.2.6	0x947d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 28, 2024 09:47:56.186885118 CET	1.1.1.1	192.168.2.6	0x947d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 28, 2024 09:47:56.186885118 CET	1.1.1.1	192.168.2.6	0x947d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 28, 2024 09:47:56.186885118 CET	1.1.1.1	192.168.2.6	0x947d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Dec 28, 2024 09:47:56.187602997 CET	1.1.1.1	192.168.2.6	0xd31d	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Dec 28, 2024 09:47:56.189141035 CET	1.1.1.1	192.168.2.6	0xf0de	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Dec 28, 2024 09:47:56.328516960 CET	1.1.1.1	192.168.2.6	0x177d	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:47:56.328516960 CET	1.1.1.1	192.168.2.6	0x177d	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.328516960 CET	1.1.1.1	192.168.2.6	0x177d	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.328516960 CET	1.1.1.1	192.168.2.6	0x177d	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.328516960 CET	1.1.1.1	192.168.2.6	0x177d	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.328789949 CET	1.1.1.1	192.168.2.6	0xb633	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.471021891 CET	1.1.1.1	192.168.2.6	0xd3db	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.531339884 CET	1.1.1.1	192.168.2.6	0x6e5c	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.531339884 CET	1.1.1.1	192.168.2.6	0x6e5c	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.531339884 CET	1.1.1.1	192.168.2.6	0x6e5c	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:47:56.531339884 CET	1.1.1.1	192.168.2.6	0x6e5c	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:00.857470036 CET	1.1.1.1	192.168.2.6	0xbed1	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:48:00.857470036 CET	1.1.1.1	192.168.2.6	0xbed1	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:00.862272978 CET	1.1.1.1	192.168.2.6	0x9506	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:00.862272978 CET	1.1.1.1	192.168.2.6	0x9506	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:00.862272978 CET	1.1.1.1	192.168.2.6	0x9506	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:00.862272978 CET	1.1.1.1	192.168.2.6	0x9506	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:00.999496937 CET	1.1.1.1	192.168.2.6	0xd444	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:01.006673098 CET	1.1.1.1	192.168.2.6	0x1849	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:01.006673098 CET	1.1.1.1	192.168.2.6	0x1849	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:01.006673098 CET	1.1.1.1	192.168.2.6	0x1849	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:01.006673098 CET	1.1.1.1	192.168.2.6	0x1849	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:01.041532993 CET	1.1.1.1	192.168.2.6	0xc976	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:48:01.041532993 CET	1.1.1.1	192.168.2.6	0xc976	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:01.184313059 CET	1.1.1.1	192.168.2.6	0x26ca	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:01.215434074 CET	1.1.1.1	192.168.2.6	0x4209	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 28, 2024 09:48:01.215434074 CET	1.1.1.1	192.168.2.6	0x4209	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 28, 2024 09:48:01.215434074 CET	1.1.1.1	192.168.2.6	0x4209	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 28, 2024 09:48:01.215434074 CET	1.1.1.1	192.168.2.6	0x4209	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Dec 28, 2024 09:48:03.847109079 CET	1.1.1.1	192.168.2.6	0x1fa5	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:48:03.847109079 CET	1.1.1.1	192.168.2.6	0x1fa5	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:48:05.741489887 CET	1.1.1.1	192.168.2.6	0x497e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:27.696166039 CET	1.1.1.1	192.168.2.6	0x97d8	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:48:31.271353006 CET	1.1.1.1	192.168.2.6	0x6c77	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:08.833854914 CET	1.1.1.1	192.168.2.6	0x85ee	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:10.197446108 CET	1.1.1.1	192.168.2.6	0x6a68	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:49:10.197446108 CET	1.1.1.1	192.168.2.6	0x6a68	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:49:10.522099018 CET	1.1.1.1	192.168.2.6	0x6130	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

detectportal.firefox.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49747	34.107.221.82	80	5128	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 28, 2024 09:47:34.497277021 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:47:35.628537893 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 12:23:21 GMT Age: 73454 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49763	34.107.221.82	80	5128	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 28, 2024 09:47:37.549755096 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:47:38.681643963 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71513 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:47:39.402115107 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:47:39.725291014 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71514 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:47:47.306041002 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:47:47.629571915 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71522 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:47:47.793868065 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:47:48.117507935 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71522 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:47:49.496411085 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:47:49.820967913 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71524 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:47:54.052798986 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:47:54.376282930 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71529 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:47:55.922461033 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:47:56.245796919 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71531 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:48:02.269875050 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:48:02.593204975 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71537 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:48:03.688587904 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:48:04.011917114 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71538 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:48:07.343785048 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:48:07.667272091 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71542 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:48:17.679266930 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:48:27.809257030 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:48:28.966725111 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:48:29.290007114 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71564 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:48:32.855868101 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:48:33.179131985 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71568 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:48:34.072592020 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:48:34.398262978 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71569 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:48:44.416239023 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:48:54.545972109 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:04.678642988 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:10.384355068 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 28, 2024 09:49:10.707654953 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 27 Dec 2024 12:55:45 GMT Age: 71605 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 28, 2024 09:49:20.716811895 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:30.847682953 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:40.977904081 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:51.107805014 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:50:01.238270998 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49765	34.107.221.82	80	5128	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 28, 2024 09:47:37.771759987 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:47:38.749285936 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78474 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:47:43.263052940 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:47:43.586777925 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78479 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:47:47.319804907 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:47:47.643465996 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78483 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:47:48.979403019 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:47:49.303734064 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78485 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:47:53.724349976 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:47:54.048139095 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78489 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:47:55.593967915 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:47:55.918442011 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78491 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:48:01.943355083 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:48:02.266875029 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78498 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:48:03.361567020 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:48:03.685420036 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78499 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:48:07.009629011 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:48:07.338013887 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78503 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:48:17.346991062 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:48:27.477117062 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:48:28.566797972 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:48:28.963392973 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78524 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:48:32.527523994 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:48:32.851736069 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78528 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:48:33.745457888 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:48:34.069024086 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78529 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:48:44.077481031 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:48:54.207336903 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:04.330924988 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:10.057132959 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 28, 2024 09:49:10.380680084 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 27 Dec 2024 10:59:44 GMT Age: 78566 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 28, 2024 09:49:20.384650946 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:30.515450954 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:40.645745039 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:49:50.775732994 CET	6	OUT	Data Raw: 00 Data Ascii:
Dec 28, 2024 09:50:00.906137943 CET	6	OUT	Data Raw: 00 Data Ascii:

Target ID:	1
Start time:	03:47:21
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\rpDOUhuBC5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rpDOUhuBC5.exe"
Imagebase:	0x7a0000
File size:	970'752 bytes
MD5 hash:	1F856D82C95FCEF4439C2C9D442E44F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:47:23
Start date:	28/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:47:23
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:47:26
Start date:	28/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:47:26
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:47:26
Start date:	28/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:47:26
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:47:27
Start date:	28/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:47:27
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:47:27
Start date:	28/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x700000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:47:27
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:47:27
Start date:	28/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:47:28
Start date:	28/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:47:28
Start date:	28/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	03:47:29
Start date:	28/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccd16ed0-4054-4436-b362-dc6f5d23b61d} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a5db6e510 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	03:47:32
Start date:	28/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4088 -parentBuildID 20230927232528 -prefsHandle 3872 -prefMapHandle 3944 -prefsLen 26322 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb856fbc-54fb-4491-a5b4-616ae0b029ea} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a7168cb10 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	03:47:46
Start date:	28/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4996 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4992 -prefMapHandle 4968 -prefsLen 33093 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4751dff7-103a-4a3a-83fa-63f5327aa984} 5128 "\\.\pipe\gecko-crash-server-pipe.5128" 20a777a9710 utility
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	1748
Total number of Limit Nodes:	46

Executed Functions

Function 007A42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 007A430D

Part of subcall function 007A6B57: _wcslen.LIBCMT ref: 007A6B6A

GetCurrentProcess.KERNEL32(?,0083CB64,00000000,?,?), ref: 007A4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 007A4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 007A4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 007A4466
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 007A4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 007A447B
GetSystemInfo.KERNEL32(?,?,?), ref: 007A44A0

Strings

GetNativeSystemInfo, xrefs: 007A4460
|O, xrefs: 007E36F8
kernel32.dll, xrefs: 007A444F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: c68e494cf5910632e1bd0a849732c8ca700f18a87441c8325dfde28d1a96b05d
Instruction ID: 22a6f722ba089041416c762c905e9f2c6f4689ba207c4d70ff49362d826ab2bf
Opcode Fuzzy Hash: c68e494cf5910632e1bd0a849732c8ca700f18a87441c8325dfde28d1a96b05d
Instruction Fuzzy Hash: 98A1C46190E2C0CFCF11CB7D7C8D1967FA47BAA300B144999E08D97F6AD26DC588DB61

Function 007A42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,007A50AA,?,?,00000000,00000000), ref: 007A42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,007A50AA,?,?,00000000,00000000), ref: 007A42C9
LoadResource.KERNEL32(?,00000000,?,?,007A50AA,?,?,00000000,00000000,?,?,?,?,?,?,007A4F20), ref: 007E35BE
SizeofResource.KERNEL32(?,00000000,?,?,007A50AA,?,?,00000000,00000000,?,?,?,?,?,?,007A4F20), ref: 007E35D3
LockResource.KERNEL32(007A50AA,?,?,007A50AA,?,?,00000000,00000000,?,?,?,?,?,?,007A4F20,?), ref: 007E35E6

Strings

SCRIPT, xrefs: 007A42BF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 1cf015da5a4889761312bdeab779197318301cd9c739ab977c3284638d970e80
Instruction ID: 8eee2e876c0dde0f551d0d16bbb141f7bd69416d3e18d96dfb32b28631e0a06f
Opcode Fuzzy Hash: 1cf015da5a4889761312bdeab779197318301cd9c739ab977c3284638d970e80
Instruction Fuzzy Hash: 78118E72241700BFDB218B65DC48F277BB9FBC6B51F104669F412E6290DBB2DC008760

Function 007E2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 007A2B6B

Part of subcall function 007A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00871418,?,007A2E7F,?,?,?,00000000), ref: 007A3A78

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00862224), ref: 007E2C10
ShellExecuteW.SHELL32(00000000,?,?,00862224), ref: 007E2C17

Strings

runas, xrefs: 007E2C0B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: b80fb0bc31a6d4910d42168f3105804a5e2b51e0e21b8542cf3e38bbfb306fff
Instruction ID: dc4f3dc6a8149af9ce39b9e89a1a7c0179457fc739c33b099677a2f6cdad8aac
Opcode Fuzzy Hash: b80fb0bc31a6d4910d42168f3105804a5e2b51e0e21b8542cf3e38bbfb306fff
Instruction Fuzzy Hash: 3411E471208341DBCB04FF68D85E9AEBBA5FBD3340F04462DF156521A3DF2C894A8722

Function 0080D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0080D501
Process32FirstW.KERNEL32(00000000,?), ref: 0080D50F
Process32NextW.KERNEL32(00000000,?), ref: 0080D52F
CloseHandle.KERNEL32(00000000), ref: 0080D5DC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d57a685da4b176d847039096cab0deedad97521debd848852237bfc58d0bdc03
Instruction ID: 94ff8ea8ffd1d6ddaf76e3f81cfdfca1c9a4a0495aa8ee38afabb57017a2e66e
Opcode Fuzzy Hash: d57a685da4b176d847039096cab0deedad97521debd848852237bfc58d0bdc03
Instruction Fuzzy Hash: 31316D71108300DFD301EF54CC85AAFBBE8FFDA354F140A2DF581961A1EB65A945CB92

Function 0080DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,007E5222), ref: 0080DBCE
GetFileAttributesW.KERNEL32(?), ref: 0080DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0080DBEE
FindClose.KERNEL32(00000000), ref: 0080DBFA

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 6857530b04a5ee5df3479de6eb7a5f80c77c578c64f5cf8bfee76aa926147267
Instruction ID: f34dbdc3f05d28001ab55f118a6cafed31242038c393d7cfa987bd0d14f7344a
Opcode Fuzzy Hash: 6857530b04a5ee5df3479de6eb7a5f80c77c578c64f5cf8bfee76aa926147267
Instruction Fuzzy Hash: FAF0A031810A2457D2206BB8AC0D8AB3B6CFF81334B104B02F836D22E0EBB059548A95

Function 007FD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 007FD220

Strings

X64, xrefs: 007FD2A8
%.3d, xrefs: 007FD22B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: efebc8781675ca5988d9a77d0355ab2d1494334d1a0412b9fe5ecdbe1a5e931b
Instruction ID: ba939ab3ad80b9e74fb52ed8dd12827751161193ebe39bca16ee921fc8b9bcce
Opcode Fuzzy Hash: efebc8781675ca5988d9a77d0355ab2d1494334d1a0412b9fe5ecdbe1a5e931b
Instruction Fuzzy Hash: D6D012A180810CE9CB6097E0CD499FAB37DFB08301F508452FA06E1240E62CCD0867A1

Function 007C4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(007D28E9,?,007C4CBE,007D28E9,008688B8,0000000C,007C4E15,007D28E9,00000002,00000000,?,007D28E9), ref: 007C4D09
TerminateProcess.KERNEL32(00000000,?,007C4CBE,007D28E9,008688B8,0000000C,007C4E15,007D28E9,00000002,00000000,?,007D28E9), ref: 007C4D10
ExitProcess.KERNEL32 ref: 007C4D22

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 99e30aa919752c1015d11a69ff1d25e04bec706d3d3a492d10b7a8e31d29a99f
Instruction ID: 70cc0171f710b2477058648a40ef019510c405bc39dfbae56c431a13d1e0d505
Opcode Fuzzy Hash: 99e30aa919752c1015d11a69ff1d25e04bec706d3d3a492d10b7a8e31d29a99f
Instruction Fuzzy Hash: 97E0B631100548ABCF11BF64DD1AF983B79FB81791B10481CFD06AA222CB39DD52DB80

Function 007FD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 007FD28C

Strings

X64, xrefs: 007FD2A8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 2c4415622d03051763afb761f08cd3172213c86c0548e509dc1c3b7f8de6e3c5
Instruction ID: 7b8e7a03cfa566ad35328f5b913ee24bbb4c34e6fa682b643fe29df30a22af0d
Opcode Fuzzy Hash: 2c4415622d03051763afb761f08cd3172213c86c0548e509dc1c3b7f8de6e3c5
Instruction Fuzzy Hash: DAD0C9B480111DEACBA4DB90DC88DD9B37CBB14315F100551F106A2100D77499488F10

Function 0082AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0082B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0082B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0082B1D4
_wcslen.LIBCMT ref: 0082B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0082B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0082B236
_wcslen.LIBCMT ref: 0082B332

Part of subcall function 008105A7: GetStdHandle.KERNEL32(000000F6), ref: 008105C6

_wcslen.LIBCMT ref: 0082B34B
_wcslen.LIBCMT ref: 0082B366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0082B3B6
GetLastError.KERNEL32(00000000), ref: 0082B407
CloseHandle.KERNEL32(?), ref: 0082B439
CloseHandle.KERNEL32(00000000), ref: 0082B44A
CloseHandle.KERNEL32(00000000), ref: 0082B45C
CloseHandle.KERNEL32(00000000), ref: 0082B46E
CloseHandle.KERNEL32(?), ref: 0082B4E3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 1dd0e73ba6c38402373193cf47258e9641a66e10ca08ea110276a36594d7996b
Instruction ID: 367603ae3934709bc1d6413a22482f4de980bdb3cdc50e27ecf8bc494999659f
Opcode Fuzzy Hash: 1dd0e73ba6c38402373193cf47258e9641a66e10ca08ea110276a36594d7996b
Instruction Fuzzy Hash: B7F18731609210DFC714EF24D895B6ABBE5FF85314F18895DF8999B2A2CB34EC80CB52

Function 007AD730 Relevance: 21.6, APIs: 14, Instructions: 631sleepsynchronizationtimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 007AD807
timeGetTime.WINMM ref: 007ADA07
Sleep.KERNEL32(0000000A), ref: 007ADBB1
Sleep.KERNEL32(0000000A), ref: 007F2B76
GetExitCodeProcess.KERNEL32(?,?), ref: 007F2C11
WaitForSingleObject.KERNEL32(?,00000000), ref: 007F2C29
CloseHandle.KERNEL32(?), ref: 007F2C3D
Sleep.KERNEL32(?,CCCCCCCC,00000000), ref: 007F2CA9

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Sleep$CloseCodeExitHandleInputObjectProcessSingleStateTimeWaittime
String ID:
API String ID: 388478766-0
Opcode ID: a260575c939958a66ce3a0ffd3bba50684dcf9eb5721bab14e5cc5d25100aba7
Instruction ID: ce5ec376968f38842c59c8cb7f07468cf8ba2cf2f766302c6caf62d83bb6f588
Opcode Fuzzy Hash: a260575c939958a66ce3a0ffd3bba50684dcf9eb5721bab14e5cc5d25100aba7
Instruction Fuzzy Hash: 1842DF70604245DFD738CF24C848BBAB7A0FF86304F548619E996877A2D778EC85CB92

Function 007A2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007A2D07
RegisterClassExW.USER32(00000030), ref: 007A2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007A2D42
InitCommonControlsEx.COMCTL32(?), ref: 007A2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007A2D6F
LoadIconW.USER32(000000A9), ref: 007A2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007A2D94

Strings

AutoIt v3 GUI, xrefs: 007A2D23
TaskbarCreated, xrefs: 007A2D37
0, xrefs: 007A2CE9
+, xrefs: 007A2CF0

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 1313dd30678654e194ebf0abd29a133b7096a252d521df7d25595cc9fb3d4b66
Instruction ID: 4cf6e2020e8f1ff21bc31e595d513d7d264715d287244a64a4389924d86d3574
Opcode Fuzzy Hash: 1313dd30678654e194ebf0abd29a133b7096a252d521df7d25595cc9fb3d4b66
Instruction Fuzzy Hash: 5E21E4B5911218AFDF00DFA8E84DBDDBFB4FB48700F00851AEA15B62A0D7B585848F90

Function 007E065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E039A: CreateFileW.KERNEL32(00000000,00000000,?,007E0704,?,?,00000000,?,007E0704,00000000,0000000C), ref: 007E03B7

GetLastError.KERNEL32 ref: 007E076F
__dosmaperr.LIBCMT ref: 007E0776
GetFileType.KERNEL32(00000000), ref: 007E0782
GetLastError.KERNEL32 ref: 007E078C
__dosmaperr.LIBCMT ref: 007E0795
CloseHandle.KERNEL32(00000000), ref: 007E07B5
CloseHandle.KERNEL32(?), ref: 007E08FF
GetLastError.KERNEL32 ref: 007E0931
__dosmaperr.LIBCMT ref: 007E0938

Strings

H, xrefs: 007E08BD

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 10f4f6682c5a83e4fd3ec2a171f54e217f8557ca2430e8287d6d7bc7bc5b4cd9
Instruction ID: ef9a950528bf7398866e75d33785a739a6eb94ad8349962438ee2b24f39bf60e
Opcode Fuzzy Hash: 10f4f6682c5a83e4fd3ec2a171f54e217f8557ca2430e8287d6d7bc7bc5b4cd9
Instruction Fuzzy Hash: 1DA14732A011848FDF19AF68D855BAD3BB0AB4A320F14015DF815EF3E1CB799C92CB91

Function 007A344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00871418,?,007A2E7F,?,?,?,00000000), ref: 007A3A78

Part of subcall function 007A3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 007A3379

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 007A356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 007E318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007E31CE
RegCloseKey.ADVAPI32(?), ref: 007E3210
_wcslen.LIBCMT ref: 007E3277
_wcslen.LIBCMT ref: 007E3286

Strings

\Include\, xrefs: 007A3527
Software\AutoIt v3\AutoIt, xrefs: 007A3560
\, xrefs: 007E328C
Include, xrefs: 007E3184, 007E31C5

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 820aefdc4ec402c196e538ea36aa3fc83d97e061f555b54b0c7d0f55b7f36524
Instruction ID: 1fcf6d7d6260f42317392ca566ea60bde1c193c7480b6318ada29de43f498f71
Opcode Fuzzy Hash: 820aefdc4ec402c196e538ea36aa3fc83d97e061f555b54b0c7d0f55b7f36524
Instruction Fuzzy Hash: 99718E714053009EC304EF65DC8996BBBE8FF99340F40492EF589972B4DB78DA88CB62

Function 007A2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007A2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 007A2B9D
LoadIconW.USER32(00000063), ref: 007A2BB3
LoadIconW.USER32(000000A4), ref: 007A2BC5
LoadIconW.USER32(000000A2), ref: 007A2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007A2BEF
RegisterClassExW.USER32(?), ref: 007A2C40

Part of subcall function 007A2CD4: GetSysColorBrush.USER32(0000000F), ref: 007A2D07
Part of subcall function 007A2CD4: RegisterClassExW.USER32(00000030), ref: 007A2D31
Part of subcall function 007A2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007A2D42
Part of subcall function 007A2CD4: InitCommonControlsEx.COMCTL32(?), ref: 007A2D5F
Part of subcall function 007A2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007A2D6F
Part of subcall function 007A2CD4: LoadIconW.USER32(000000A9), ref: 007A2D85
Part of subcall function 007A2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007A2D94

Strings

0, xrefs: 007A2C0F
#, xrefs: 007A2C16
AutoIt v3, xrefs: 007A2C2F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: cca03fc17e1fc3ff252de6c2536e5e3b2b79ca873a3d301791ff5301ae1c16ab
Instruction ID: 9bc57bbed030622186f432b1e1cd4f0b709d1b7c9b10e69d6b6d20eac24df3b6
Opcode Fuzzy Hash: cca03fc17e1fc3ff252de6c2536e5e3b2b79ca873a3d301791ff5301ae1c16ab
Instruction Fuzzy Hash: 40211A75E00318ABDF10DFA9EC5DB997FB4FB48B50F00441AE508A6BA4D7B98584CF90

Function 007A3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,007A316A,?,?), ref: 007A31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,007A316A,?,?), ref: 007A3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007A3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,007A316A,?,?), ref: 007A3232
CreatePopupMenu.USER32 ref: 007A3246
PostQuitMessage.USER32(00000000), ref: 007A3267

Strings

TaskbarCreated, xrefs: 007A322D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: d05d1d23b6af6140a5313bb48d60b118a65429a8f8e3184bee5a95194935bcc7
Instruction ID: 58e71f377386badfd09fb8cfb0293fec2d8efe5f7fadb72fd73c75f406eed1de
Opcode Fuzzy Hash: d05d1d23b6af6140a5313bb48d60b118a65429a8f8e3184bee5a95194935bcc7
Instruction Fuzzy Hash: 1A41DF31240208AADF145F7CDC4EB793A59FBC7340F044725FA0AD66E6CB6DCA8197A2

Function 007A1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 007A1459
CoUninitialize.COMBASE ref: 007A14F8
UnregisterHotKey.USER32(?), ref: 007A16DD
DestroyWindow.USER32(?), ref: 007E24B9
FreeLibrary.KERNEL32(?), ref: 007E251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 007E254B

Strings

close all, xrefs: 007A1454

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: aed180106cb4f33d166b63033964ac48ff218a0b7df85982b6e327f316b3be4f
Instruction ID: a6c97debb1b1a10bcaba1b18c94c17bb1e24d1d7c35a114d4aabad720077208f
Opcode Fuzzy Hash: aed180106cb4f33d166b63033964ac48ff218a0b7df85982b6e327f316b3be4f
Instruction Fuzzy Hash: 9FD1A131702252CFDB19EF15C999B29F7A4BF4A700F54429DE44AAB252DB38ED22CF50

Function 0080DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 0080DE42
gethostname.WS2_32(?,00000100), ref: 0080DE5C
gethostbyname.WS2_32(?), ref: 0080DE69
inet_ntoa.WSOCK32(?), ref: 0080DEAB
_strcat.LIBCMT ref: 0080DEB9
WSACleanup.WSOCK32 ref: 0080DEDE

Strings

0.0.0.0, xrefs: 0080DE87

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: e2f3dde76dccdf2f3b95fe9cb95f77c11431a9e391bd3107f6cd5997de3e0eae
Instruction ID: 8c0c1620cf92d824db66bfca412f91bc59b7802ca3273c3f18d13a5f6ba53cb6
Opcode Fuzzy Hash: e2f3dde76dccdf2f3b95fe9cb95f77c11431a9e391bd3107f6cd5997de3e0eae
Instruction Fuzzy Hash: 5411E472904218ABCB60ABA4DC0AEEE77ACFF51711F00056DF445EA0D1EF759A818BA0

Function 007A2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007A2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007A2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,007A1CAD,?), ref: 007A2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,007A1CAD,?), ref: 007A2CCF

Strings

edit, xrefs: 007A2CAC
AutoIt v3, xrefs: 007A2C89, 007A2C8E, 007A2C8F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: a5e88b4bf0d765004a4f0fc0b6a05004d3d0a2ca0062867c534a8f900f88d185
Instruction ID: 0a478c22144d1610315ffed1fb26514299a190bf893298e57f81ad79972af18b
Opcode Fuzzy Hash: a5e88b4bf0d765004a4f0fc0b6a05004d3d0a2ca0062867c534a8f900f88d185
Instruction Fuzzy Hash: 41F03A755403907AEB30072BAC4DF773EBDF7C6F50F01005AF908A2AA4C2694880DBB0

Function 007A3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,007A3B0F,SwapMouseButtons,00000004,?), ref: 007A3B40
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,007A3B0F,SwapMouseButtons,00000004,?), ref: 007A3B61
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,007A3B0F,SwapMouseButtons,00000004,?), ref: 007A3B83

Strings

Control Panel\Mouse, xrefs: 007A3B3E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 44ae6768991cf695ed6710e2e70f090124195ef69c55d3f721bc53da0ba081ca
Instruction ID: 8de3168e9115777d534177d8bec1541f3b2827c896315dc205d5983cc66e996a
Opcode Fuzzy Hash: 44ae6768991cf695ed6710e2e70f090124195ef69c55d3f721bc53da0ba081ca
Instruction Fuzzy Hash: 2C112AB5511208FFDB208FA5DC85AAEB7B9EF85745B104959B805E7110E3359E409B60

Function 007FD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 007FD3BF
FreeLibrary.KERNEL32 ref: 007FD3E5

Strings

GetSystemWow64DirectoryW, xrefs: 007FD3B9
X64, xrefs: 007FD2A8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 17605521fdf91300856827d1a03d4bd296c5eca26c493d2da34d31f5d6433652
Instruction ID: 6bbbedeb07ed34b0fb6d8f916e8fb3bbbb1bb1113ef0bf1f443049c73224db48
Opcode Fuzzy Hash: 17605521fdf91300856827d1a03d4bd296c5eca26c493d2da34d31f5d6433652
Instruction Fuzzy Hash: DDF05572805A29DBE77112108C04A7E3312FF12B20F558654E312F2398E76CCC44A7C3

Function 007ADFD0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 007F32B7

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 5b039c3fcf0fa2a62eaf51ad9dbeb3d1dd588afbb42780787373a794948042d4
Instruction ID: 8edee0c301eca6f0e5aa1bab4cb13844ddd48524c9f7d15154ad3b4e9aa7bdfb
Opcode Fuzzy Hash: 5b039c3fcf0fa2a62eaf51ad9dbeb3d1dd588afbb42780787373a794948042d4
Instruction Fuzzy Hash: 63C29E71E00215CFCB24CF58C884AADB7B1FF9A310F248669E955AB391D379ED81CB91

Function 007AEC40 Relevance: 5.7, APIs: 3, Instructions: 1195COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 007AFE66

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 6d1681c94a15f77a50dd3c7442957c38e7a95f9c0ce23a7b384234b285a380da
Instruction ID: a2be227e720a084a78d9858cfd852b94e3c6e190b5d7c317c4b3b020933e1f1e
Opcode Fuzzy Hash: 6d1681c94a15f77a50dd3c7442957c38e7a95f9c0ce23a7b384234b285a380da
Instruction Fuzzy Hash: 5FB27A74608340CFDB24CF58C494A2AB7E1FBDA314F248A6DE9998B351D779EC41CB92

Function 007A3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 007E33A2

Part of subcall function 007A6B57: _wcslen.LIBCMT ref: 007A6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 007A3A04

Strings

Line: , xrefs: 007E33EB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: c1a8511fd624ed321f88b725f43ca05dec4b23216a4a0617b8af05e5ad401033
Instruction ID: 63483a0d7953cc652bc5fe816662420e6658dce226cdd2903b798349dd78cf4f
Opcode Fuzzy Hash: c1a8511fd624ed321f88b725f43ca05dec4b23216a4a0617b8af05e5ad401033
Instruction Fuzzy Hash: 6331C471408300AAC721EF24DC4EFDBB7D8AB86714F004A1EF59993591DB7C9649C7D2

Function 007BFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 007C0668

Part of subcall function 007C32A4: RaiseException.KERNEL32(?,?,?,007C068A,?,00871444,?,?,?,?,?,?,007C068A,007A1129,00868738,007A1129), ref: 007C3304

__CxxThrowException@8.LIBVCRUNTIME ref: 007C0685

Strings

Unknown exception, xrefs: 007C0692

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: f3063c66005acc671abc4f6ee1c2bb7ea7de96f51cb5d1f5314b572d62e8ed69
Instruction ID: 155c6f793082377fe920aaf2b2a2325066cc5d57043fb23287d719ebea5d31a0
Opcode Fuzzy Hash: f3063c66005acc671abc4f6ee1c2bb7ea7de96f51cb5d1f5314b572d62e8ed69
Instruction Fuzzy Hash: DAF0C23490020DF78F04BAA4EC5EF9E7B6CAE40710B60853DF928D6592EF79DA25C6C0

Function 007A10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 007A1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 007A1BF4
Part of subcall function 007A1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 007A1BFC
Part of subcall function 007A1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 007A1C07
Part of subcall function 007A1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 007A1C12
Part of subcall function 007A1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 007A1C1A
Part of subcall function 007A1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 007A1C22

Part of subcall function 007A1B4A: RegisterWindowMessageW.USER32(00000004,?,007A12C4), ref: 007A1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007A136A
OleInitialize.OLE32 ref: 007A1388
CloseHandle.KERNEL32(00000000,00000000), ref: 007E24AB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: d751ea64554f5574ff9e5bb16bc8b5ab8cfa94e7fa70834f2e4102c1389b4832
Instruction ID: ac51da005989f5b4e9238843cbba517f3c1cccedc517a6fa6139127d21a18c76
Opcode Fuzzy Hash: d751ea64554f5574ff9e5bb16bc8b5ab8cfa94e7fa70834f2e4102c1389b4832
Instruction Fuzzy Hash: E071CEB49212008ECF88DFBDAC4E6553AE5FBC9344758822AD51ED7A69EB34C4C4CF46

Function 0080C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 007A3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0080C259
KillTimer.USER32(?,00000001,?,?), ref: 0080C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0080C270

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: b13cce6813b308b7293ef8edc439e873dc072742d032510058085f737186a67b
Instruction ID: b9787f0a6d388afef9416b9082e431ae21328b9180ab9252d9f2592c46c80a30
Opcode Fuzzy Hash: b13cce6813b308b7293ef8edc439e873dc072742d032510058085f737186a67b
Instruction Fuzzy Hash: 45318470904344AFEB629F648C59BEBBBECFB46308F00049EE59AA7281C7745A85CB51

Function 007D86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,007D85CC,?,00868CC8,0000000C), ref: 007D8704
GetLastError.KERNEL32(?,007D85CC,?,00868CC8,0000000C), ref: 007D870E
__dosmaperr.LIBCMT ref: 007D8739

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: b83e66092f4a0560106ab4d750e3152aaf83c178a3e6a66076526bb46dd1df6c
Instruction ID: c81c6fb5478d131bc8bc1a6a42994fbe614c64269f38ab79f63566ce886ec2b8
Opcode Fuzzy Hash: b83e66092f4a0560106ab4d750e3152aaf83c178a3e6a66076526bb46dd1df6c
Instruction Fuzzy Hash: 6801B13360526067D6A46734684DB7E6B799B81778F39011FF8089B3D3DEBCCC818252

Function 007ADB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 007ADB7B
DispatchMessageW.USER32(?), ref: 007ADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007ADB9F
Sleep.KERNEL32(0000000A), ref: 007ADBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 007F1CC9

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 430e9cff4faef5107160ed63f9b50ae585f10fac52dd95b8a753982e7b3cb106
Instruction ID: ec4982b369aac0e987dcfdf2e1db43f219669462b40528cbc7cedf53e19f715f
Opcode Fuzzy Hash: 430e9cff4faef5107160ed63f9b50ae585f10fac52dd95b8a753982e7b3cb106
Instruction Fuzzy Hash: 63F05E70604344DBEB30CBA4CC49FEA73A8FB85310F504A28E65AD34C0DB389488CB26

Function 007B1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 007B17F6

Strings

CALL, xrefs: 007B17C6

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 83a79fba210e3af2180dae7aee10698814a05f41ae7831e12ae0ccf357a5741d
Instruction ID: ef3317868e33eb2f8884dd5d99bc19a6d5517725e85780243b79a75b1eed6e12
Opcode Fuzzy Hash: 83a79fba210e3af2180dae7aee10698814a05f41ae7831e12ae0ccf357a5741d
Instruction Fuzzy Hash: 9722BB70608241DFC714DF14C8A4BAABBF1BF85314FA4892DF5968B362D739E851CB92

Function 007B01E0 Relevance: 3.6, APIs: 2, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910477122e8eca810a349095bd5bcdaeed29f0d191a1ded1db6afeeb18615225
Instruction ID: de9233162730eb0e6cf3930ab2eed234cd1b9934b83bff33ad4886da2be60472
Opcode Fuzzy Hash: 910477122e8eca810a349095bd5bcdaeed29f0d191a1ded1db6afeeb18615225
Instruction Fuzzy Hash: A632AD70A00609DFCB24DF54C899BFEB7B1BF05310F148569EA15AB2A1D739ED84CB91

Function 007A2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 007E2C8C

Part of subcall function 007A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007A3A97,?,?,007A2E7F,?,?,?,00000000), ref: 007A3AC2

Part of subcall function 007A2DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 007A2DC4

Strings

X, xrefs: 007E2C5A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 05a28622dd3b005bdf591e12860d826c072e29c1359ac6c907243d8a4536f8b7
Instruction ID: 0a9f4ba2fd56d5868d685c854b33c9e35a29400bbba7a131ecf9a33460ee182d
Opcode Fuzzy Hash: 05a28622dd3b005bdf591e12860d826c072e29c1359ac6c907243d8a4536f8b7
Instruction Fuzzy Hash: CA219671A002989BDB05DF98C849BDE7BFCAF89304F104059E505E7241DBBC5A898FA1

Function 007FD363 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 007FD375

Strings

X64, xrefs: 007FD2A8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ComputerName
String ID: X64
API String ID: 3545744682-893830106
Opcode ID: f2915684c6a32630a350e0af93f4b220039a9e977d4d22cb6271355f03ceaafc
Instruction ID: 5bdb4fc33be65b6885aafc26582d114002ee0faca1c6fa4bc62ab79faf6f5a05
Opcode Fuzzy Hash: f2915684c6a32630a350e0af93f4b220039a9e977d4d22cb6271355f03ceaafc
Instruction Fuzzy Hash: 6FD0C9B580512CEACBA0DB80DC88DE9B37DBB04311F504551F102A2200D77899489B51

Function 007A3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 007A3908

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: f7e272bfc199c100de36842a0f7dcaa3616cdf0d39b5c9ccf02435033022cdf5
Instruction ID: 35fe5a5652bc0082eb1764403731aaf76fa6927a4ee95de80773b68a3beb9191
Opcode Fuzzy Hash: f7e272bfc199c100de36842a0f7dcaa3616cdf0d39b5c9ccf02435033022cdf5
Instruction Fuzzy Hash: EA31A770504301DFD720DF24D889797BBE4FB8A708F000A2EF59997750D779AA44CB52

Function 007BF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 007BF661

Part of subcall function 007AD730: GetInputState.USER32 ref: 007AD807

Sleep.KERNEL32(00000000), ref: 007FF2DE

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: e0a9112e26f50f84146039af3dc0b7190c8b0a70776a1ae238bac7e875082f4f
Instruction ID: ec3df24d48d8a3097707a09ebd76a462e699eed58209f67cd87a7d0a3b627afb
Opcode Fuzzy Hash: e0a9112e26f50f84146039af3dc0b7190c8b0a70776a1ae238bac7e875082f4f
Instruction Fuzzy Hash: 26F08C312402059FD314EF69D859B6AB7E9FF8A760F00412AE85AD7362DB70A800CB91

Function 007AB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 007ABB4E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 24291e6da69cb6df60b42d622f5ade76f9c32d7960cd98763e2e1aad25f5b723
Instruction ID: 921d5fafe8fb53a2f4a4733bd67498834f2c2529358fa6b018c6ca373fd3889b
Opcode Fuzzy Hash: 24291e6da69cb6df60b42d622f5ade76f9c32d7960cd98763e2e1aad25f5b723
Instruction Fuzzy Hash: 75327D75A00209DFDB24CF54C898ABAB7B5FF86310F148159EA05AB362D77CED81CB91

Function 007A4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 007A4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,007A4EDD,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4E9C
Part of subcall function 007A4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 007A4EAE
Part of subcall function 007A4E90: FreeLibrary.KERNEL32(00000000,?,?,007A4EDD,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4EFD

Part of subcall function 007A4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,007E3CDE,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4E62
Part of subcall function 007A4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 007A4E74
Part of subcall function 007A4E59: FreeLibrary.KERNEL32(00000000,?,?,007E3CDE,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4E87

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 111c4789664c5231cfde1b656afae2340670f1aaba5923e2a4039722bc6df0e8
Instruction ID: 3717411273595761561bb06ddc589faca53ca6181619efc8832a5aa56abd7ed5
Opcode Fuzzy Hash: 111c4789664c5231cfde1b656afae2340670f1aaba5923e2a4039722bc6df0e8
Instruction Fuzzy Hash: 98112332600205EECB14BB60DC0AFAD77A5AFC5B10F20852DF452B71D1EEBAAE049750

Function 007D8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 007D8440

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: bf2005599694ae65408fa69c20e07a3be2a78928855f8ec0463af4adac42b1f7
Instruction ID: 140a10d607ce4a9fffbc7e1e4f484200b6ff96536d8ca219474f200176e783e1
Opcode Fuzzy Hash: bf2005599694ae65408fa69c20e07a3be2a78928855f8ec0463af4adac42b1f7
Instruction Fuzzy Hash: 1111187590410AEFCB05DF58E945A9A7BF5FF48314F14405AF808AB312DB31EA11CBA5

Function 007D5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007D4C7D: RtlAllocateHeap.NTDLL(00000008,007A1129,00000000,?,007D2E29,00000001,00000364,?,?,?,007CF2DE,007D3863,00871444,?,007BFDF5,?), ref: 007D4CBE

_free.LIBCMT ref: 007D506C

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: d39d31269e25386d6e57f3dc02a368d1cdda34b5198f11028eedeaa4e9139b67
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 11014972204704ABE3318F65D885A5AFBFCFB89370F25061EE184973C0EA34A806C7B4

Function 007CE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: a344db9678d3094b5e8676c861d3c9017622f85d2b78eab87c4b50970dec8bef
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 5BF0A932521A14D7D6313A759C09F5A33AD9F62335F10072EF525A22D2DB7CE80295A6

Function 007D4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,007A1129,00000000,?,007D2E29,00000001,00000364,?,?,?,007CF2DE,007D3863,00871444,?,007BFDF5,?), ref: 007D4CBE

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c1a9e28fdac362634e1935bcec8b7bdf3d7a56a5228b68261724d9c93cb475c8
Instruction ID: d51f49a5be7f9a6b737ac428f0422a57840dd22a04e1b0e9a5e3bf245460205a
Opcode Fuzzy Hash: c1a9e28fdac362634e1935bcec8b7bdf3d7a56a5228b68261724d9c93cb475c8
Instruction Fuzzy Hash: F9F0E932622224A7DF315F62DC0DF5A3BA9BF517A1B19411BF81DAA381CB7CD80196F0

Function 007D3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00871444,?,007BFDF5,?,?,007AA976,00000010,00871440,007A13FC,?,007A13C6,?,007A1129), ref: 007D3852

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 352480b7317a0039ddfd38c1d70cf97e546fe80059602d4a4fff214bcfc4391a
Instruction ID: bc5ea5d3cef2b31a6136890f075e4c2cdc88195c44f3ddf77dc3eba936b265b6
Opcode Fuzzy Hash: 352480b7317a0039ddfd38c1d70cf97e546fe80059602d4a4fff214bcfc4391a
Instruction Fuzzy Hash: A3E065321012249AE62126669C09F9A376AAB427B0F19012BBC1596791DB5DDD01A2F2

Function 007A4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4F6D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4167905b9a48e53dbf262867ba0c574d3a70fbeaf07c0d37103a5b3b0f7cbaee
Instruction ID: 3fd6e468c882fe30f62f52bd2e72a049420d58c0b0f10445d68485d8acb6bf90
Opcode Fuzzy Hash: 4167905b9a48e53dbf262867ba0c574d3a70fbeaf07c0d37103a5b3b0f7cbaee
Instruction Fuzzy Hash: 3CF0A071005341CFCB348F20D490C12B7E0BF813193289A7EE1DA82610C7BA9844DF01

Function 00832A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00832A66

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 05d1cb6e459373f3f7171700303982f9c72aa5a30e278bc679198421c1d63ce2
Instruction ID: 3774ed20549fb45b798661a5d009a6407b5403b9598b486e01a583955541013b
Opcode Fuzzy Hash: 05d1cb6e459373f3f7171700303982f9c72aa5a30e278bc679198421c1d63ce2
Instruction Fuzzy Hash: BCE0867635012AABC754EB34EC909FE775CFF90795F10453AFD16D2180EB30999586E0

Function 007A30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 007A314E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: caa7fd17ca68cc5f207722296aeb9ab33fcb0b42611be01ced6b8a3e849d154d
Instruction ID: 33bb9b07864a03993d016e30ad97cf41d460dffb04e424bb5d793ed7a86d5a70
Opcode Fuzzy Hash: caa7fd17ca68cc5f207722296aeb9ab33fcb0b42611be01ced6b8a3e849d154d
Instruction Fuzzy Hash: 59F037709143589FEB529F28DC4E7D57BBCB701708F0001E9A54C96696DB7897C8CF51

Function 007A2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 007A2DC4

Part of subcall function 007A6B57: _wcslen.LIBCMT ref: 007A6B6A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 484ad47219987d2c7dfcdd430e4d33a5a9ecab295fb31d00331ec7e7649508a6
Instruction ID: 955790c739092961b880e7d07d06e4922eb571d02d8206ad674262583ee35fb0
Opcode Fuzzy Hash: 484ad47219987d2c7dfcdd430e4d33a5a9ecab295fb31d00331ec7e7649508a6
Instruction Fuzzy Hash: 7FE0CD726011245BC71192589C0AFDA77DDDFC8790F040171FD09E7248DA74AD808690

Function 007A2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007A3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007A3908

Part of subcall function 007AD730: GetInputState.USER32 ref: 007AD807

SetCurrentDirectoryW.KERNEL32(?), ref: 007A2B6B

Part of subcall function 007A30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 007A314E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: c800af2226e150b7fcb4ba9744bbecdf9f4cac89013a4a38f908bc9e7c258475
Instruction ID: 855a4d014fe0939056888e3c40e4d9b52526d5bf87c9b3dee27ede58083b8fc2
Opcode Fuzzy Hash: c800af2226e150b7fcb4ba9744bbecdf9f4cac89013a4a38f908bc9e7c258475
Instruction Fuzzy Hash: 98E0862230424487CA08BF78A85E57DB75AEBD3351F40573EF14B93163DE2D89594362

Function 0080DF27 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 0080DF40

Part of subcall function 007A6B57: _wcslen.LIBCMT ref: 007A6B6A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FolderPath_wcslen
String ID:
API String ID: 2987691875-0
Opcode ID: 5544bfa6965412b3755e37d53c4b13760fc3f42bc7c68fe6f787523764e04c03
Instruction ID: 8fc99fddb82c7f4fc2610b5a9bbb408708939b443b9c5755f80e1164284a5617
Opcode Fuzzy Hash: 5544bfa6965412b3755e37d53c4b13760fc3f42bc7c68fe6f787523764e04c03
Instruction Fuzzy Hash: 24D05EE2A002287BDF60A6749D0DDF73AACD780210F0006A0786ED3152E924DD4486B0

Function 007E039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,007E0704,?,?,00000000,?,007E0704,00000000,0000000C), ref: 007E03B7

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b0d8b647b69b778a22b5a9ceb5cceb92fa161325dd08ee0c0784d7d26b65c534
Instruction ID: bb532c3f0eeb3f48524a1f6d1b72d81308f723c0f8794401e95171e9a6b90568
Opcode Fuzzy Hash: b0d8b647b69b778a22b5a9ceb5cceb92fa161325dd08ee0c0784d7d26b65c534
Instruction Fuzzy Hash: EFD06C3204010DBBDF028F84DD06EDA3BAAFB88714F014000BE1866020C772E821AB90

Function 007A1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 007A1CBC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 5defe25ee0c117462d6a5a5d61ee56071fb8ec27daedd619ad054b639f4acbd6
Instruction ID: f7071d7a6e94811c2290ec34eed3107fbfbd8e60985dd17a8c7174483c269457
Opcode Fuzzy Hash: 5defe25ee0c117462d6a5a5d61ee56071fb8ec27daedd619ad054b639f4acbd6
Instruction Fuzzy Hash: 1AC09236280304EFF6148B94BC4EF107764B398B00F048401F64DA9AE7C3A2A8A0EB60

Non-executed Functions

Function 00839576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 007B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007B9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0083961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0083965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0083969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 008396C9
SendMessageW.USER32 ref: 008396F2
GetKeyState.USER32(00000011), ref: 0083978B
GetKeyState.USER32(00000009), ref: 00839798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 008397AE
GetKeyState.USER32(00000010), ref: 008397B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 008397E9
SendMessageW.USER32 ref: 00839810
SendMessageW.USER32(?,00001030,?,00837E95), ref: 00839918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0083992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00839941
SetCapture.USER32(?), ref: 0083994A
ClientToScreen.USER32(?,?), ref: 008399AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 008399BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 008399D6
ReleaseCapture.USER32 ref: 008399E1
GetCursorPos.USER32(?), ref: 00839A19
ScreenToClient.USER32(?,?), ref: 00839A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00839A80
SendMessageW.USER32 ref: 00839AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00839AEB
SendMessageW.USER32 ref: 00839B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00839B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00839B4A
GetCursorPos.USER32(?), ref: 00839B68
ScreenToClient.USER32(?,?), ref: 00839B75
GetParent.USER32(?), ref: 00839B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00839BFA
SendMessageW.USER32 ref: 00839C2B
ClientToScreen.USER32(?,?), ref: 00839C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00839CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00839CDE
SendMessageW.USER32 ref: 00839D01
ClientToScreen.USER32(?,?), ref: 00839D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00839D82

Part of subcall function 007B9944: GetWindowLongW.USER32(?,000000EB), ref: 007B9952

GetWindowLongW.USER32(?,000000F0), ref: 00839E05

Strings

@GUI_DRAGID, xrefs: 0083997D
F, xrefs: 00839D07

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: de1a0e14bf5fbc7bc506a3b897380f6ed100d7d068172c6b4097d2c6707fb430
Instruction ID: 89de8c61a4912d58c009def8682b7c6bf229ba6d8a7a2687bd971c8fa6bca5a2
Opcode Fuzzy Hash: de1a0e14bf5fbc7bc506a3b897380f6ed100d7d068172c6b4097d2c6707fb430
Instruction Fuzzy Hash: 23429031205201AFDB24CF68CC49BAABBE5FF99314F100A1DF699D72A1E7B1D851CB91

Function 00834873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 008348F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00834908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00834927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0083494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0083495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0083497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 008349AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 008349D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00834A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00834A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00834A7E
IsMenu.USER32(?), ref: 00834A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00834AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00834B20
GetWindowLongW.USER32(?,000000F0), ref: 00834B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00834BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00834C82
wsprintfW.USER32 ref: 00834CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00834CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00834CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00834D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00834D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00834D5A

Strings

%d/%02d/%02d, xrefs: 00834CA8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: bf252c68fdb2f72302f0334009ad0c244721d4a7e7bd99a8909fe483d1e3c1d4
Instruction ID: cdf803ac4511ee3ed6695f1b452c3bec7d1dc42bf37dc71e642c7aa1b2485102
Opcode Fuzzy Hash: bf252c68fdb2f72302f0334009ad0c244721d4a7e7bd99a8909fe483d1e3c1d4
Instruction Fuzzy Hash: 3012E071600218ABEB249F24CC49FAE7BF8FF85710F145529F516EA2E1DB78A941CB90

Function 007BF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 007BF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007FF474
IsIconic.USER32(00000000), ref: 007FF47D
ShowWindow.USER32(00000000,00000009), ref: 007FF48A
SetForegroundWindow.USER32(00000000), ref: 007FF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 007FF4AA
GetCurrentThreadId.KERNEL32 ref: 007FF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 007FF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 007FF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 007FF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 007FF4DE
SetForegroundWindow.USER32(00000000), ref: 007FF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 007FF4F6
keybd_event.USER32(00000012,00000000), ref: 007FF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 007FF50B
keybd_event.USER32(00000012,00000000), ref: 007FF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 007FF519
keybd_event.USER32(00000012,00000000), ref: 007FF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 007FF528
keybd_event.USER32(00000012,00000000), ref: 007FF52D
SetForegroundWindow.USER32(00000000), ref: 007FF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 007FF557

Strings

Shell_TrayWnd, xrefs: 007FF46F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 98b4827e227b4b2d69ac7c14204f2a4c7b6bac9a890e1d9563e2636cfb8fb788
Instruction ID: 7ec26c12c4ce6e44b6c191554d69f11580e230c3aee5f25f267db2270d15e841
Opcode Fuzzy Hash: 98b4827e227b4b2d69ac7c14204f2a4c7b6bac9a890e1d9563e2636cfb8fb788
Instruction Fuzzy Hash: 70311071A40218BAEB216BB55C4AFBF7E6CFB84B50F100465FA01F61D1DAB59910AB60

Function 00801201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 008016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0080170D
Part of subcall function 008016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0080173A
Part of subcall function 008016C3: GetLastError.KERNEL32 ref: 0080174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00801286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 008012A8
CloseHandle.KERNEL32(?), ref: 008012B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 008012D1
GetProcessWindowStation.USER32 ref: 008012EA
SetProcessWindowStation.USER32(00000000), ref: 008012F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00801310

Part of subcall function 008010BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,008011FC), ref: 008010D4
Part of subcall function 008010BF: CloseHandle.KERNEL32(?,?,008011FC), ref: 008010E9

Strings

winsta0, xrefs: 008012CC
default, xrefs: 0080130B
, xrefs: 0080125A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: ebbbbdee08a733ca2579b0f4dbb7bf2d246ed28331ed4776db0134b222d29a67
Instruction ID: 00c1c40c7be03e1d41073ae1eb64704e79d1d1094a71357b18e9c8389bf2e290
Opcode Fuzzy Hash: ebbbbdee08a733ca2579b0f4dbb7bf2d246ed28331ed4776db0134b222d29a67
Instruction Fuzzy Hash: 59818A72900209ABDF219FA8DC89FEE7BBAFF44714F144129F910F62A0D7758954CB25

Function 00800B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00801114
Part of subcall function 008010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00800B9B,?,?,?), ref: 00801120
Part of subcall function 008010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00800B9B,?,?,?), ref: 0080112F
Part of subcall function 008010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00800B9B,?,?,?), ref: 00801136
Part of subcall function 008010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0080114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00800BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00800C00
GetLengthSid.ADVAPI32(?), ref: 00800C17
GetAce.ADVAPI32(?,00000000,?), ref: 00800C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00800C6D
GetLengthSid.ADVAPI32(?), ref: 00800C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00800C8C
HeapAlloc.KERNEL32(00000000), ref: 00800C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00800CB4
CopySid.ADVAPI32(00000000), ref: 00800CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00800CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00800D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00800D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00800D45
HeapFree.KERNEL32(00000000), ref: 00800D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00800D55
HeapFree.KERNEL32(00000000), ref: 00800D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00800D65
HeapFree.KERNEL32(00000000), ref: 00800D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00800D78
HeapFree.KERNEL32(00000000), ref: 00800D7F

Part of subcall function 00801193: GetProcessHeap.KERNEL32(00000008,00800BB1,?,00000000,?,00800BB1,?), ref: 008011A1
Part of subcall function 00801193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00800BB1,?), ref: 008011A8
Part of subcall function 00801193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00800BB1,?), ref: 008011B7

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c34e4953ef100daac5e6da8d1042d64bc18f6eb0177f996dc2b68eda7d3f4f1d
Instruction ID: fd25206ff49c397f53c6d3867ca943d1f8982ef9869d083f92b61cf1fff1c3e5
Opcode Fuzzy Hash: c34e4953ef100daac5e6da8d1042d64bc18f6eb0177f996dc2b68eda7d3f4f1d
Instruction Fuzzy Hash: 4971587290020AABEF50DFA4DC49BAEBBB8FF44310F144615E914F6291D775AA05CFB0

Function 0081EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0083CC08), ref: 0081EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0081EB37
GetClipboardData.USER32(0000000D), ref: 0081EB43
CloseClipboard.USER32 ref: 0081EB4F
GlobalLock.KERNEL32(00000000), ref: 0081EB87
CloseClipboard.USER32 ref: 0081EB91
GlobalUnlock.KERNEL32(00000000), ref: 0081EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0081EBC9
GetClipboardData.USER32(00000001), ref: 0081EBD1
GlobalLock.KERNEL32(00000000), ref: 0081EBE2
GlobalUnlock.KERNEL32(00000000), ref: 0081EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0081EC38
GetClipboardData.USER32(0000000F), ref: 0081EC44
GlobalLock.KERNEL32(00000000), ref: 0081EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0081EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0081EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0081ECD2
GlobalUnlock.KERNEL32(00000000), ref: 0081ECF3
CountClipboardFormats.USER32 ref: 0081ED14
CloseClipboard.USER32 ref: 0081ED59

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 65f12a18580dee725c64fb72ea2aff408384ccf918f33d42c8ea4f0e0b5491ad
Instruction ID: 480b6cf43b8b55a0ac0448d19efbb0b4a67d692931af67f258ffdfbde7793a40
Opcode Fuzzy Hash: 65f12a18580dee725c64fb72ea2aff408384ccf918f33d42c8ea4f0e0b5491ad
Instruction Fuzzy Hash: 6161C0352082059FD300EF24D889FAAB7A8FFC5714F08491DF856E72A1DB75D985CBA2

Function 0081698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 008169BE
FindClose.KERNEL32(00000000), ref: 00816A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00816A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00816A75

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00816AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00816ADF

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00816B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00816B32
%03d, xrefs: 00816DA2
%4d, xrefs: 00816BB1
%02d, xrefs: 00816C00, 00816C0A, 00816C5A, 00816CAA, 00816CFA, 00816D4A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 2e5c6059971cbd9459106a9a575c88c5c5cabfad03d2f06c2994bbe21d9983a1
Instruction ID: 53948dc2835a2a4590e12919750cd6f4a64408a29fad4a71834d8b17b3986935
Opcode Fuzzy Hash: 2e5c6059971cbd9459106a9a575c88c5c5cabfad03d2f06c2994bbe21d9983a1
Instruction Fuzzy Hash: 75D13DB2508340AEC714EBA4CC85EABB7ECFF89704F044A1DF585D6191EB78DA44CB62

Function 00819642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00819663
GetFileAttributesW.KERNEL32(?), ref: 008196A1
SetFileAttributesW.KERNEL32(?,?), ref: 008196BB
FindNextFileW.KERNEL32(00000000,?), ref: 008196D3
FindClose.KERNEL32(00000000), ref: 008196DE
FindFirstFileW.KERNEL32(*.*,?), ref: 008196FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0081974A
SetCurrentDirectoryW.KERNEL32(00866B7C), ref: 00819768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00819772
FindClose.KERNEL32(00000000), ref: 0081977F
FindClose.KERNEL32(00000000), ref: 0081978F

Strings

*.*, xrefs: 008196F5

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 4ee487b2d5297e892cee5197e6d2ca155224d4368bb0a10df8e34a619153e193
Instruction ID: 5f28d62561666875c7091b51ef73c6b8a9e75f2b95e53c613dfe3e75688caaea
Opcode Fuzzy Hash: 4ee487b2d5297e892cee5197e6d2ca155224d4368bb0a10df8e34a619153e193
Instruction Fuzzy Hash: DF31D172501219AADB14AFB4EC18EDE77ACFF49320F104959F955E21E0EB35DE808B60

Function 0081979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 008197BE
FindNextFileW.KERNEL32(00000000,?), ref: 00819819
FindClose.KERNEL32(00000000), ref: 00819824
FindFirstFileW.KERNEL32(*.*,?), ref: 00819840
SetCurrentDirectoryW.KERNEL32(?), ref: 00819890
SetCurrentDirectoryW.KERNEL32(00866B7C), ref: 008198AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 008198B8
FindClose.KERNEL32(00000000), ref: 008198C5
FindClose.KERNEL32(00000000), ref: 008198D5

Part of subcall function 0080DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0080DB00

Strings

*.*, xrefs: 0081983B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 9188a9d528342f2e48c50e02849b80eedbaa4289d154e0dee1b2bd6be82e32c3
Instruction ID: 1639fd1ef86b75eb60eeabd17149752b3452614131428d085a37d3d546e7b85c
Opcode Fuzzy Hash: 9188a9d528342f2e48c50e02849b80eedbaa4289d154e0dee1b2bd6be82e32c3
Instruction Fuzzy Hash: 4231AF32500619AEDB10AFB4EC58ADE77ACFF46320F144569E994E21A0EB35DAC5CB60

Function 0082BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0082C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0082B6AE,?,?), ref: 0082C9B5
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082C9F1
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082CA68
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0082BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0082BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0082BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0082C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0082C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0082C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0082C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0082C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0082C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0082C382
RegCloseKey.ADVAPI32(00000000), ref: 0082C38F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 295863367bf13df7a07261cf45d31d958c4a9a1b7c43cdad419302edbfdea29d
Instruction ID: ffa08bbb832c480f738c63c1f97f33100af597837fcc10fd25181b7b43d3c19d
Opcode Fuzzy Hash: 295863367bf13df7a07261cf45d31d958c4a9a1b7c43cdad419302edbfdea29d
Instruction Fuzzy Hash: 6F023B71604210EFC714DF24D895A2ABBE5FF89318F18899DF84ADB2A2DB31EC45CB51

Function 0080D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007A3A97,?,?,007A2E7F,?,?,?,00000000), ref: 007A3AC2

Part of subcall function 0080E199: GetFileAttributesW.KERNEL32(?,0080CF95), ref: 0080E19A

FindFirstFileW.KERNEL32(?,?), ref: 0080D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0080D1DD
MoveFileW.KERNEL32(?,?), ref: 0080D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0080D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0080D237

Part of subcall function 0080D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0080D21C,?,?), ref: 0080D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0080D253
FindClose.KERNEL32(00000000), ref: 0080D264

Strings

\*.*, xrefs: 0080D0CD, 0080D0D6, 0080D0EB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 7bd6f2fedbe71be80c346350367fa11c844883767bb6ef2419d9c291dc9d1047
Instruction ID: a03c4c1fec92bb214db1311c38fbc0768f76d85e6190d6d912005c2e86452a8a
Opcode Fuzzy Hash: 7bd6f2fedbe71be80c346350367fa11c844883767bb6ef2419d9c291dc9d1047
Instruction Fuzzy Hash: 1861393180121DAACF45EBE0DE969EEB775FF96301F248165E402B7191EB34AF09CB61

Function 0081ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0081ED91
EmptyClipboard.USER32 ref: 0081ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0081EDAC
CloseClipboard.USER32 ref: 0081EEA3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: ad986d51a4899a78d46b5387013c3b9c953dd73a05f764df7cc977274ab28e27
Instruction ID: 0101ec206b86c99c2b275eccbbdb1f5952bdd2c8bb6b9b12e90048032894fe68
Opcode Fuzzy Hash: ad986d51a4899a78d46b5387013c3b9c953dd73a05f764df7cc977274ab28e27
Instruction Fuzzy Hash: 7F418C35204611AFD720DF29E889B5ABBE5FF84318F14C49DE8199B662C775EC81CB90

Function 0080E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 008016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0080170D
Part of subcall function 008016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0080173A
Part of subcall function 008016C3: GetLastError.KERNEL32 ref: 0080174A

ExitWindowsEx.USER32(?,00000000), ref: 0080E932

Strings

, xrefs: 0080E920
, xrefs: 0080E95C
@, xrefs: 0080E925
SeShutdownPrivilege, xrefs: 0080E902

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 9d6fcc1dd5f9b7677877bca1d2a0260b7a66f09e9b48855783e71506965500da
Instruction ID: 99bbd2eea4cc625a81eaf1cb598e4fae2a010ff5af37f3ca36a5fb3be7b286dc
Opcode Fuzzy Hash: 9d6fcc1dd5f9b7677877bca1d2a0260b7a66f09e9b48855783e71506965500da
Instruction Fuzzy Hash: AA01D673610215ABEBD426B89C8ABBB765CF714754F154D21FC12F21E1D6A15C408290

Function 00821204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00821276
WSAGetLastError.WSOCK32 ref: 00821283
bind.WSOCK32(00000000,?,00000010), ref: 008212BA
WSAGetLastError.WSOCK32 ref: 008212C5
closesocket.WSOCK32(00000000), ref: 008212F4
listen.WSOCK32(00000000,00000005), ref: 00821303
WSAGetLastError.WSOCK32 ref: 0082130D
closesocket.WSOCK32(00000000), ref: 0082133C

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 1f54b4db1b5aecde457be40dd110f130144c09e9109207d67e954e978e3b9131
Instruction ID: a42988a58e91f0a70aa71b0dc21d18c0732a30b892b0094390d7cccd15607229
Opcode Fuzzy Hash: 1f54b4db1b5aecde457be40dd110f130144c09e9109207d67e954e978e3b9131
Instruction Fuzzy Hash: A8416331600110DFDB10DF64D488B29B7E6FF96318F288598E8569F296C775ED81CBE1

Function 007DB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007DB9D4
_free.LIBCMT ref: 007DB9F8
_free.LIBCMT ref: 007DBB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00843700), ref: 007DBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0087121C,000000FF,00000000,0000003F,00000000,?,?), ref: 007DBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00871270,000000FF,?,0000003F,00000000,?), ref: 007DBC36
_free.LIBCMT ref: 007DBD4B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 231ad6250685e285c74d80f3cf4b1cad0c9c3b1979444e87a840cbf9de61e115
Instruction ID: 88c8b652fdae0a992faf16cb320d9b19c8ebd33386ab6a618206fdaea8a7509f
Opcode Fuzzy Hash: 231ad6250685e285c74d80f3cf4b1cad0c9c3b1979444e87a840cbf9de61e115
Instruction Fuzzy Hash: F7C12771A00244EFCB20DF688C59BAA7BB9FF81310F16419BE494D7356EB389E419B60

Function 0080D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007A3A97,?,?,007A2E7F,?,?,?,00000000), ref: 007A3AC2

Part of subcall function 0080E199: GetFileAttributesW.KERNEL32(?,0080CF95), ref: 0080E19A

FindFirstFileW.KERNEL32(?,?), ref: 0080D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0080D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0080D481
FindClose.KERNEL32(00000000), ref: 0080D498
FindClose.KERNEL32(00000000), ref: 0080D4A1

Strings

\*.*, xrefs: 0080D3F2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 1b9e51acaa26f590384a4c902f60376d0abad61430317c212f962c8c0db6e7b4
Instruction ID: d4bd1188a5fecd72d3708ec3d48165c582ec58b20f856d88da053a2cb30455c2
Opcode Fuzzy Hash: 1b9e51acaa26f590384a4c902f60376d0abad61430317c212f962c8c0db6e7b4
Instruction Fuzzy Hash: 29314B71008355ABC305EFA4D8968AFB7A8FED2314F444E1DF4D593191EB28AA09CB67

Function 007DE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 007DE645

Strings

1#QNAN, xrefs: 007DF84B
1#SNAN, xrefs: 007DF844
1#INF, xrefs: 007DF852
1#IND, xrefs: 007DF83D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3543fa69328b434ffc42c3fc07c21168e7422a93315fc3c8d1e2836a22387bec
Instruction ID: c0a5b1bdcff24416e14f99412ec01c9edc5b86f7ff1b30f639f98c589158fb2a
Opcode Fuzzy Hash: 3543fa69328b434ffc42c3fc07c21168e7422a93315fc3c8d1e2836a22387bec
Instruction Fuzzy Hash: AFC22971E046288FDB25DF289D447EAB7B5EB49314F1441EBD84EE7241E778AE818F40

Function 0081648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 008164DC
CoInitialize.OLE32(00000000), ref: 00816639
CoCreateInstance.OLE32(0083FCF8,00000000,00000001,0083FB68,?), ref: 00816650
CoUninitialize.OLE32 ref: 008168D4

Strings

.lnk, xrefs: 008164BA, 00816524, 008165E0

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 18db3dc29fe9a90adf4c8589e2948ff878909efd2ca2d9b934c581e87b51a798
Instruction ID: 079efa81f033a8b61343c8dba454ca18d363f6b875a06696996ae9c91a87d92e
Opcode Fuzzy Hash: 18db3dc29fe9a90adf4c8589e2948ff878909efd2ca2d9b934c581e87b51a798
Instruction Fuzzy Hash: DCD13871508201AFC304EF24C885AABB7E9FFD5704F04496DF595CB291EB74E945CBA2

Function 008222DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 008222E8

Part of subcall function 0081E4EC: GetWindowRect.USER32(?,?), ref: 0081E504

GetDesktopWindow.USER32 ref: 00822312
GetWindowRect.USER32(00000000), ref: 00822319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00822355
GetCursorPos.USER32(?), ref: 00822381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 008223DF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 5ae92a61393e38b929220a219b4f9d2cd5e8cdc4cc88c2d542ce0a5874934fda
Instruction ID: ee3cff0944cb7acd13e123c8bb0bef0bbb475cb2c66a632a6b5dcbc3c351b0e3
Opcode Fuzzy Hash: 5ae92a61393e38b929220a219b4f9d2cd5e8cdc4cc88c2d542ce0a5874934fda
Instruction Fuzzy Hash: B131BE72504315AFD720DF58D849B9BBBA9FFC8314F000A19F985E7291DB34EA49CB92

Function 00819B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00819B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00819C8B

Part of subcall function 00813874: GetInputState.USER32 ref: 008138CB
Part of subcall function 00813874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00813966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00819BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00819C75

Strings

*.*, xrefs: 00819B5D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: c838afbd12b6ffd4515c902ef140e33fd3af15bd32552285aebfb52fc2fff2a5
Instruction ID: 9a2acfe09662553a304512b02720566dd84433b535707d79361963557a3a893f
Opcode Fuzzy Hash: c838afbd12b6ffd4515c902ef140e33fd3af15bd32552285aebfb52fc2fff2a5
Instruction Fuzzy Hash: AD418F7190420AEFCF14DF64C899AEEBBB8FF45310F204155E845E2291EB349E94CFA0

Function 007B997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 007B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007B9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 007B9A4E
GetSysColor.USER32(0000000F), ref: 007B9B23
SetBkColor.GDI32(?,00000000), ref: 007B9B36

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: ef87dc80db49975f700b275f5ee6182bcc9398bbe45a1d6b8bee0998fa6a55fc
Instruction ID: 5bd1ef7074c641619b04e7998f0d75cb7487e7e7635477a53955e2e7adfc1c02
Opcode Fuzzy Hash: ef87dc80db49975f700b275f5ee6182bcc9398bbe45a1d6b8bee0998fa6a55fc
Instruction Fuzzy Hash: 8AA1E970118448BEE729AA3C8C9DFFB3A5DEB82340F158119F722D6B95CA2DDD41D272

Function 00821806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0082304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0082307A
Part of subcall function 0082304E: _wcslen.LIBCMT ref: 0082309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0082185D
WSAGetLastError.WSOCK32 ref: 00821884
bind.WSOCK32(00000000,?,00000010), ref: 008218DB
WSAGetLastError.WSOCK32 ref: 008218E6
closesocket.WSOCK32(00000000), ref: 00821915

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: fa83f96ffe51f9da0332743e2c950b05dc4afa3d89ef6756513c45b198e94cd2
Instruction ID: 238c886eb3ce6a5db8115e0ba99a85bc045add32e0704c25b6c51d9c007eb626
Opcode Fuzzy Hash: fa83f96ffe51f9da0332743e2c950b05dc4afa3d89ef6756513c45b198e94cd2
Instruction Fuzzy Hash: 4351B371A00210AFDB10AF24D88AF6A77E5EB85718F188558F905AF3C3C775AD81CBA1

Function 00831C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00831CC0
IsWindowEnabled.USER32 ref: 00831CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00831CDB
IsIconic.USER32 ref: 00831CE9
IsZoomed.USER32 ref: 00831CF7

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 0637d25f8c9a6e3ee092b30f98e46f03a247215ce7a0b369267b33678576b426
Instruction ID: 7dfa7cc10cf0dfb456f46b5c1b576248b4d569020f840f8f3b1097dea45ee873
Opcode Fuzzy Hash: 0637d25f8c9a6e3ee092b30f98e46f03a247215ce7a0b369267b33678576b426
Instruction Fuzzy Hash: E621D1317402109FDB208F2AC898B6A7BA5FFD5714F189468E84ADB351CB71EC42CBD0

Function 007A8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 007A843C
VUUU, xrefs: 007A83E8
ERCP, xrefs: 007A813C
VUUU, xrefs: 007E5DF0
VUUU, xrefs: 007A83FA

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: b48d5f7938f555b3732176af19d9a94cba079ce05407fd6126283c40ae445ef9
Instruction ID: 96336c54ea258402a8eeaacb3dbea99f40d4c5a812ae3113935063d5f87fce3d
Opcode Fuzzy Hash: b48d5f7938f555b3732176af19d9a94cba079ce05407fd6126283c40ae445ef9
Instruction Fuzzy Hash: F0A2A370E0125ACBDF64CF59C8407ADB7B1FF99314F2482AAD815AB285EB389D81CF51

Function 0080AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0080AAAC
SetKeyboardState.USER32(00000080), ref: 0080AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0080AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0080AB88

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: a5afb5da517c58accc39f3ebea650661871a02fb7d6f0f29ef4a1b5b6668ed90
Instruction ID: d4f748578d7b87518ea1b9c2a28ae240f35dc05fd15847ea242a8160fe92a954
Opcode Fuzzy Hash: a5afb5da517c58accc39f3ebea650661871a02fb7d6f0f29ef4a1b5b6668ed90
Instruction Fuzzy Hash: F631E531A40358AEFB798A68CC26BFA7BA6FB44320F44421AE585E61D1D3758981C762

Function 0081CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0081CE89
GetLastError.KERNEL32(?,00000000), ref: 0081CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0081CEFE

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 18565edbd643a870dd8ce44868e5d944bff66c59360436c681876802f31bc86a
Instruction ID: 9b7429602f97a2227d7a035bba4937d16729dc5261250dba79f0b4630ce583e6
Opcode Fuzzy Hash: 18565edbd643a870dd8ce44868e5d944bff66c59360436c681876802f31bc86a
Instruction Fuzzy Hash: 56218E715403059BDB209FA5C949BA7B7FCFF40358F10481EE546E2151EBB4ED858B64

Function 00808298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 008082AA

Strings

(, xrefs: 008082F0
|, xrefs: 008082DA

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: ae8c961fcd297e76a512ff446a03194dca007f2bf17856c77d7cd7699a75ca63
Instruction ID: 3c83ccb3bd066cba308a1fbe799cab5c4cb55766e3dea3cc87af6a0ffcf5037f
Opcode Fuzzy Hash: ae8c961fcd297e76a512ff446a03194dca007f2bf17856c77d7cd7699a75ca63
Instruction Fuzzy Hash: F6322474A00605DFCB68CF69C481A6AB7F0FF48710B15C56EE59ADB3A1EB70E981CB44

Function 00815C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00815CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00815D17
FindClose.KERNEL32(?), ref: 00815D5F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: ccb9d7dce3dbf8beed0bb559cc858db51577281decfeb6bd8c9bf077ec7668e8
Instruction ID: 440bc10283520356faa6684c4da1d6948ad2de3f7eb9b231c64c09f896458eca
Opcode Fuzzy Hash: ccb9d7dce3dbf8beed0bb559cc858db51577281decfeb6bd8c9bf077ec7668e8
Instruction Fuzzy Hash: A9517875604601DFC714CF28D498E96B7E8FF8A324F14856DE95ACB3A1CB34E984CB91

Function 007D2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 007D271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 007D2724
UnhandledExceptionFilter.KERNEL32(?), ref: 007D2731

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1a03aef022fc999722396023cd86fce8bb5bf948459c2717c8ea2cde1ff4177a
Instruction ID: c913ccc5684109c279b93f05785c176856bf1103a8f6c4a8dbbded8065cb140f
Opcode Fuzzy Hash: 1a03aef022fc999722396023cd86fce8bb5bf948459c2717c8ea2cde1ff4177a
Instruction Fuzzy Hash: C831C675901218EBCB21DF64DC88B9DBBB8BF18310F5041DAE41CA7261E7349F828F85

Function 008151CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008151DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00815238
SetErrorMode.KERNEL32(00000000), ref: 008152A1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: a4859bf5eaf779cf592c7e81411802b72b516dc31efc8e1c4aba0093c4eb616a
Instruction ID: 86ad29a64ded1dbfd97a43cf3027bcabbae4ed0d90140fcc9130aa58a4a8ac06
Opcode Fuzzy Hash: a4859bf5eaf779cf592c7e81411802b72b516dc31efc8e1c4aba0093c4eb616a
Instruction Fuzzy Hash: 44313E75A00518DFDB00DF54D888EADBBB5FF89314F088499E805AB3A2DB35E855CB91

Function 008016C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 007BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 007C0668
Part of subcall function 007BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 007C0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0080170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0080173A
GetLastError.KERNEL32 ref: 0080174A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 6f995c5f52408ab0adebca2bdcaaf7d26da75370a487f1a27a414021cfab1030
Instruction ID: 3451db6a4cd6f5357c18443cacc892a79792b98cad34978c601a625c94f3768d
Opcode Fuzzy Hash: 6f995c5f52408ab0adebca2bdcaaf7d26da75370a487f1a27a414021cfab1030
Instruction Fuzzy Hash: F11194B1514304AFDB189F54DC8AE6AB7F9FB44724B20852EE05697281EB70FC418B60

Function 0080D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0080D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0080D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0080D650

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: ea6d4db93c4b93b4ecf6d9fe3b7c3f97865a9a9fca5850b0af58511246cd4b46
Instruction ID: a7e09a5089b152a129d45f253c540d102b8115e5a5e8235c54c4ee777e914447
Opcode Fuzzy Hash: ea6d4db93c4b93b4ecf6d9fe3b7c3f97865a9a9fca5850b0af58511246cd4b46
Instruction Fuzzy Hash: AD117C71E01228BBDB108F949C44FAFBBBCFB45B50F108111F914E7290C2704A018BA1

Function 00801663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0080168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 008016A1
FreeSid.ADVAPI32(?), ref: 008016B1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 112f624118c8c1378b986d84c923a4eec584623a6842cfac09641ad920c12107
Instruction ID: 6fecdb9c6edeef8b369e82639bbafb80ccbd4b0818511d98bc6b916d1c7436e7
Opcode Fuzzy Hash: 112f624118c8c1378b986d84c923a4eec584623a6842cfac09641ad920c12107
Instruction Fuzzy Hash: 03F0F47195030DFBDF00DFE49D89AAEBBBCFB08704F504965E501E2181E774AA448B50

Function 007DC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 007DC36C

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 93eeb8cd0aae5e7f5477656815f3ac7467a2a92899586882455653789a63f7ed
Instruction ID: 24a3f5d839f1553e38fa8621fcf257f10b4da783666e816e2fecd61bbdf06ef1
Opcode Fuzzy Hash: 93eeb8cd0aae5e7f5477656815f3ac7467a2a92899586882455653789a63f7ed
Instruction Fuzzy Hash: 3841297650021AAFCB249FB9CC4DEBB7778FB84314F1042AAF905D7280E6749D41CB50

Function 007CCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 3ce3a9265e8a619f1d81198dfa80bddbe048621ad6f93bb174a674320908318b
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 7C022D72E002199BDF25CFA9C980BADBBF1EF48314F25816DD919E7380D735AD418B90

Function 008168EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00816918
FindClose.KERNEL32(00000000), ref: 00816961

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 93088b2b0a418cb75617cd969df2102cc82c86d64418e5aa4ccd0c9ee1573ee6
Instruction ID: db25bdac44bbc2c7f90622ceba7bcb1fe5f64088770f6a1f1aca9544de3fcfff
Opcode Fuzzy Hash: 93088b2b0a418cb75617cd969df2102cc82c86d64418e5aa4ccd0c9ee1573ee6
Instruction Fuzzy Hash: FC1190316042109FC710DF29D888A16BBE5FF85328F14C699E8A98F2A2D734EC45CB91

Function 008137B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00824891,?,?,00000035,?), ref: 008137E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00824891,?,?,00000035,?), ref: 008137F4

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: aec76dc7a3e0df514cb405221fe75a6c3d727c68b1785a648eac5b2ae76ead10
Instruction ID: df5fdf4290f994aba11cf0d940f5693d986cf172e89d072362bf3d03cf0026bd
Opcode Fuzzy Hash: aec76dc7a3e0df514cb405221fe75a6c3d727c68b1785a648eac5b2ae76ead10
Instruction Fuzzy Hash: 10F0E5B16053286AEB2017768C4DFEB3AAEFFC5761F000675F509E22C1D9609D44C7B0

Function 0080B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0080B25D
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 0080B270

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: a8f16c3118a93a8ea6eb2943fce7b18f265252ac81458f2141cccb61a7f93910
Instruction ID: 7bc1ed42ff110c45eca2752f9788087ec06d9f89be4fa983c6235a2b1b648e5a
Opcode Fuzzy Hash: a8f16c3118a93a8ea6eb2943fce7b18f265252ac81458f2141cccb61a7f93910
Instruction Fuzzy Hash: B1F0177190428EABDB059FA4C806BAE7BB4FF08309F00840AF965A61A2C37986119F94

Function 008010BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,008011FC), ref: 008010D4
CloseHandle.KERNEL32(?,?,008011FC), ref: 008010E9

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 5b7baf5a06db5ec5c730f5e617f4091626974f3ac041cac08869e1d6213653aa
Instruction ID: ff36d385e482a67fb5821d33e0b8b1a411975169a3cc67559e9d81e160d2b6b7
Opcode Fuzzy Hash: 5b7baf5a06db5ec5c730f5e617f4091626974f3ac041cac08869e1d6213653aa
Instruction Fuzzy Hash: 37E0BF72014A10EEEB252B51FC09FB777E9FB04720B14882DF5A5904B1DB66ACA0DB50

Function 007ACAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 007F0C40

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 52964c1c34eb81641e2c378b4461b2ad6f92125a0b28cc72ef7be8dc21dac04f
Instruction ID: 25e1e6620dbd5b4f4cbb92fa87ae384d2d1e74006b255ae629a39366f45339f3
Opcode Fuzzy Hash: 52964c1c34eb81641e2c378b4461b2ad6f92125a0b28cc72ef7be8dc21dac04f
Instruction Fuzzy Hash: 18329D70A00218EFCF15DF94C885AFDB7B5BF86304F144259E906AB392D739AE45CBA1

Function 007D676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,007D6766,?,?,00000008,?,?,007DFEFE,00000000), ref: 007D6998

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 8046c68c1948cb0d173faf9cfab85002e20096a3f295ec34a1c38d7a60162132
Instruction ID: 11cac8d085c5e5c2980c476d32e8384579dc9cef980a12bab3bf175531daf934
Opcode Fuzzy Hash: 8046c68c1948cb0d173faf9cfab85002e20096a3f295ec34a1c38d7a60162132
Instruction Fuzzy Hash: 9FB127716106099FD715CF28C48AB657BB0FF45364F25865AE8D9CF3A2C339E991CB40

Function 007BB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 007F851F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2b2df217029a70db938c473842e2fd06ac159179a838da99de7330e9bb3119d2
Instruction ID: 63f046b375b9739203e6dcac095d92028cb62b5a8804c174fa1e604ebffa5e8b
Opcode Fuzzy Hash: 2b2df217029a70db938c473842e2fd06ac159179a838da99de7330e9bb3119d2
Instruction Fuzzy Hash: C9125D759002299BCB64CF58C8807FEB7F5FF48710F14819AE949EB251EB789A81CB91

Function 0081EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0081EABD

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 01b555f33eb6fa3239270827781afca896ef22a1b525a625725399b1bfccbd87
Instruction ID: a074065b655dae1028457ba1e9665d98c87b2af03504c3bb3321d7053955ccff
Opcode Fuzzy Hash: 01b555f33eb6fa3239270827781afca896ef22a1b525a625725399b1bfccbd87
Instruction Fuzzy Hash: 54E01A32200214AFC710EF69D809E9AB7EDFFA9760F04841AFC4AD7251DA74A8808B91

Function 007C09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,007C03EE), ref: 007C09DA

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 48ae29b193c6014cc2456281f437e8128a70aa0192eacc4b00763c21bdb87285
Instruction ID: a0c548133a1754d58c95fb17838b0e8be89f2e18bb6217b5730156a7630ec501
Opcode Fuzzy Hash: 48ae29b193c6014cc2456281f437e8128a70aa0192eacc4b00763c21bdb87285
Instruction Fuzzy Hash:

Function 007C781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 007C798B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: a349f7066708532d8260f9d3238000e9a9cc3d2103b1c824e223ac27d0897630
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: B351897160C7059BDF3C8528889EFBE23D99B12340F18050DEA82DB282CE2DEE41DF52

Function 007D6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680daa201edaa774daa166ba4707891198fb1334be97fd7ee6e429615a746918
Instruction ID: 81750ac0158bd8caf8b4e77970b8ac0c8cdb345af9b761979b5f9d8885f8ee87
Opcode Fuzzy Hash: 680daa201edaa774daa166ba4707891198fb1334be97fd7ee6e429615a746918
Instruction Fuzzy Hash: C1322126D29F414DD7279634D822335A299BFB73C5F55C737F81AB5AA6EB28C4838100

Function 007BCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f505a52476004574bdd571bbdb52c0ac9b0f8db2851e9dde98d8e3c6eeb102c
Instruction ID: 47e4e85f0b5cc50ad05d57a6dfdc2aec34627415fde53a12ade49bf0ccd630f0
Opcode Fuzzy Hash: 8f505a52476004574bdd571bbdb52c0ac9b0f8db2851e9dde98d8e3c6eeb102c
Instruction Fuzzy Hash: FF324831A0410D8BDF2ACF28C6906BD7BA1EB45310F28D56AD64ACB391E73CDD81DB61

Function 007A7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9478070bfe3527ead40da52038c4c22e2d0bd9b975a1b201d9748f2fe42077d9
Instruction ID: ebe04872e69a4b14c25b2b15ea26a00c5d7cba83d36f24b94be1f514d406614d
Opcode Fuzzy Hash: 9478070bfe3527ead40da52038c4c22e2d0bd9b975a1b201d9748f2fe42077d9
Instruction Fuzzy Hash: 3822C3B0A00609DFDF14CF69D985AAEB3F6FF89304F104629E816A7291E739ED11CB50

Function 007A91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0478252fd44fc9e806005b630dbab967edf5a3a9cd695416b251e7e45af8e53
Instruction ID: f111c21bf1edaa1c819ab6b9828c5e7ad1b72321de2dcadccb717a267286d3d0
Opcode Fuzzy Hash: d0478252fd44fc9e806005b630dbab967edf5a3a9cd695416b251e7e45af8e53
Instruction Fuzzy Hash: 5002C6B0A01105EBDB04DF65D885BAEB7B1FF48300F118569E9169B391EB39EE20CB91

Function 007D9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053f38c0d07bfb0de83c07b89938a05ace7733822ca4eb04dd2c2af32e4d746f
Instruction ID: bbcf4554da4aade6636ecb38f5b48d810aa4ad42934feb6ae17575d59a3bec7a
Opcode Fuzzy Hash: 053f38c0d07bfb0de83c07b89938a05ace7733822ca4eb04dd2c2af32e4d746f
Instruction Fuzzy Hash: 9FB1F134D2AF414DC2239A399831336B65CBFBB6D5F91D71BFC1674E22EB2286838140

Function 007C7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e36b8765f4a21ee93cd114532d14a027efcd8e35f3db6690fd663334f4f289f
Instruction ID: 2bf92869bb722952dcfd77c65f1b0bcc6fa65fd60ebeafc42453c71a2c9dc081
Opcode Fuzzy Hash: 0e36b8765f4a21ee93cd114532d14a027efcd8e35f3db6690fd663334f4f289f
Instruction Fuzzy Hash: 9F6159B1208749A7DB3C9E2C8D95FBE2398DF41710F14491EE842DB281DE1DAE42CF66

Function 007C7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600d75bbfcbe9972aac6f307cd9c785854f0a9aa2e5c56e0a9b6ca15f6fba828
Instruction ID: 999cd826d03874b346c7d2ce3fd8ee7f1c50189c7ea38e021cec72f58de93f06
Opcode Fuzzy Hash: 600d75bbfcbe9972aac6f307cd9c785854f0a9aa2e5c56e0a9b6ca15f6fba828
Instruction Fuzzy Hash: A4616872708709A7DA3C5A284896FBF2398AF42740F10495EF943DB281DE1EED42CF56

Function 00812046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de33d19aec516f7fbdc69269f72a7e2144ea759fe8389c651eb1ea6405bb218
Instruction ID: a7fa3e1e114c9cd6e0809d23e47ff688cc983fd6e7bf1932a2d1c0b2b6d6877b
Opcode Fuzzy Hash: 4de33d19aec516f7fbdc69269f72a7e2144ea759fe8389c651eb1ea6405bb218
Instruction Fuzzy Hash: F721A8326206118BD728CF79C8266BA73E9FB64310F15862EE4A7C37D5DE39E944CB40

Function 00822ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00822B30
DeleteObject.GDI32(00000000), ref: 00822B43
DestroyWindow.USER32 ref: 00822B52
GetDesktopWindow.USER32 ref: 00822B6D
GetWindowRect.USER32(00000000), ref: 00822B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00822CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00822CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00822CF8
GetClientRect.USER32(00000000,?), ref: 00822D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00822D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00822D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00822D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00822D80
GlobalLock.KERNEL32(00000000), ref: 00822D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00822D98
GlobalUnlock.KERNEL32(00000000), ref: 00822DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00822DA8
GlobalFree.KERNEL32(00000000), ref: 00822DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00822DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0083FC38,00000000), ref: 00822DDB
GlobalFree.KERNEL32(00000000), ref: 00822DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00822E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00822E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00822E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0082303F

Strings

DISPLAY, xrefs: 00822EA2
static, xrefs: 00822D3A, 00822E91
, xrefs: 00822FC5
AutoIt v3, xrefs: 00822CF2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 1d3112fc4a0015372f36b733d6fd3ff1ea76d8b20e08914e45ac6aadf30e478e
Instruction ID: 1673f5963e43313968e21f777af3b425ba46bd66a296c64d6d7c2faeccf7120c
Opcode Fuzzy Hash: 1d3112fc4a0015372f36b733d6fd3ff1ea76d8b20e08914e45ac6aadf30e478e
Instruction Fuzzy Hash: 56026A71900218EFDB14DF68DC89EAE7BB9FB89310F048558F915AB2A1DB74ED41CB60

Function 008370D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0083712F
GetSysColorBrush.USER32(0000000F), ref: 00837160
GetSysColor.USER32(0000000F), ref: 0083716C
SetBkColor.GDI32(?,000000FF), ref: 00837186
SelectObject.GDI32(?,?), ref: 00837195
InflateRect.USER32(?,000000FF,000000FF), ref: 008371C0
GetSysColor.USER32(00000010), ref: 008371C8
CreateSolidBrush.GDI32(00000000), ref: 008371CF
FrameRect.USER32(?,?,00000000), ref: 008371DE
DeleteObject.GDI32(00000000), ref: 008371E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00837230
FillRect.USER32(?,?,?), ref: 00837262
GetWindowLongW.USER32(?,000000F0), ref: 00837284

Part of subcall function 008373E8: GetSysColor.USER32(00000012), ref: 00837421
Part of subcall function 008373E8: SetTextColor.GDI32(?,?), ref: 00837425
Part of subcall function 008373E8: GetSysColorBrush.USER32(0000000F), ref: 0083743B
Part of subcall function 008373E8: GetSysColor.USER32(0000000F), ref: 00837446
Part of subcall function 008373E8: GetSysColor.USER32(00000011), ref: 00837463
Part of subcall function 008373E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00837471
Part of subcall function 008373E8: SelectObject.GDI32(?,00000000), ref: 00837482
Part of subcall function 008373E8: SetBkColor.GDI32(?,00000000), ref: 0083748B
Part of subcall function 008373E8: SelectObject.GDI32(?,?), ref: 00837498
Part of subcall function 008373E8: InflateRect.USER32(?,000000FF,000000FF), ref: 008374B7
Part of subcall function 008373E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 008374CE
Part of subcall function 008373E8: GetWindowLongW.USER32(00000000,000000F0), ref: 008374DB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: fa40b98ab0a7d6f00cf4398141eb3b33e10e4b044b69031b0428cd27560527bc
Instruction ID: 32d13918df49c3231cf05ab3e932d69e42218c8175075bdba014c056152d14df
Opcode Fuzzy Hash: fa40b98ab0a7d6f00cf4398141eb3b33e10e4b044b69031b0428cd27560527bc
Instruction Fuzzy Hash: 3BA16F72008301AFDB119F64DC48E6B7BA9FBC9321F100E19F962E61E1D775E944DB91

Function 00822711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0082273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0082286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 008228A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 008228B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00822900
GetClientRect.USER32(00000000,?), ref: 0082290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00822955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00822964
GetStockObject.GDI32(00000011), ref: 00822974
SelectObject.GDI32(00000000,00000000), ref: 00822978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00822988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00822991
DeleteDC.GDI32(00000000), ref: 0082299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 008229C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 008229DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00822A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00822A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00822A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00822A77
GetStockObject.GDI32(00000011), ref: 00822A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00822A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00822A97

Strings

DISPLAY, xrefs: 0082295A
static, xrefs: 0082294F, 00822A71
msctls_progress32, xrefs: 00822A13
AutoIt v3, xrefs: 008228F8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: d7e2d47c880ff926043418a3ebcf4bc1a242b87ebb09201496a81db5fc6c8da9
Instruction ID: 5ae498f194a262704f136def27f25184a18bfb457e0caa3a2a9f091058690165
Opcode Fuzzy Hash: d7e2d47c880ff926043418a3ebcf4bc1a242b87ebb09201496a81db5fc6c8da9
Instruction Fuzzy Hash: 1FB14A71A00219AFEB14DF68DC8AEAE7BA9FB49710F008614F915E7691D774ED40CBA0

Function 00814ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00814AED
GetDriveTypeW.KERNEL32(?,0083CB68,?,\\.\,0083CC08), ref: 00814BCA
SetErrorMode.KERNEL32(00000000,0083CB68,?,\\.\,0083CC08), ref: 00814D36

Strings

SSD, xrefs: 00814C4A
RAID, xrefs: 00814CBB
SAS, xrefs: 00814CC9
Fibre, xrefs: 00814CAD
Network, xrefs: 00814C02
SATA, xrefs: 00814CD0
RAMDisk, xrefs: 00814BF4
Removable, xrefs: 00814C10, 00814C15
Fixed, xrefs: 00814C09
\\.\, xrefs: 00814B3F
Virtual, xrefs: 00814CE5
USB, xrefs: 00814CB4
iSCSI, xrefs: 00814CC2
MMC, xrefs: 00814CDE
FileBackedVirtual, xrefs: 00814CEC
CDROM, xrefs: 00814BFB
ATAPI, xrefs: 00814C91
PhysicalDrive, xrefs: 00814B76
ATA, xrefs: 00814C98
Unknown, xrefs: 00814BED, 00814C83
SCSI, xrefs: 00814C8A
1394, xrefs: 00814C9F
SSA, xrefs: 00814CA6

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f7adff8bb016d57c5b05b128d53e61ec3c7b9a178935330d90b4e2539c08a383
Instruction ID: b91fee73f3a0fea77c44a75e5cc2424f6e2875c825d076851385dda1f3731a90
Opcode Fuzzy Hash: f7adff8bb016d57c5b05b128d53e61ec3c7b9a178935330d90b4e2539c08a383
Instruction Fuzzy Hash: 8D61D330605149DBCB04DF64CA82DECB7A8FF86744B249115F816EB291EB3ADD91DB81

Function 008373E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00837421
SetTextColor.GDI32(?,?), ref: 00837425
GetSysColorBrush.USER32(0000000F), ref: 0083743B
GetSysColor.USER32(0000000F), ref: 00837446
CreateSolidBrush.GDI32(?), ref: 0083744B
GetSysColor.USER32(00000011), ref: 00837463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00837471
SelectObject.GDI32(?,00000000), ref: 00837482
SetBkColor.GDI32(?,00000000), ref: 0083748B
SelectObject.GDI32(?,?), ref: 00837498
InflateRect.USER32(?,000000FF,000000FF), ref: 008374B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 008374CE
GetWindowLongW.USER32(00000000,000000F0), ref: 008374DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0083752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00837554
InflateRect.USER32(?,000000FD,000000FD), ref: 00837572
DrawFocusRect.USER32(?,?), ref: 0083757D
GetSysColor.USER32(00000011), ref: 0083758E
SetTextColor.GDI32(?,00000000), ref: 00837596
DrawTextW.USER32(?,008370F5,000000FF,?,00000000), ref: 008375A8
SelectObject.GDI32(?,?), ref: 008375BF
DeleteObject.GDI32(?), ref: 008375CA
SelectObject.GDI32(?,?), ref: 008375D0
DeleteObject.GDI32(?), ref: 008375D5
SetTextColor.GDI32(?,?), ref: 008375DB
SetBkColor.GDI32(?,?), ref: 008375E5

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 78fc5ec5793bee185b3161953c796fbf20fd92b11ab0cfc5111521be17122f3e
Instruction ID: 32b05e7d703dee099e88edd28a0069222f6a6b141d7f7d2b3cb5df24b373bf9f
Opcode Fuzzy Hash: 78fc5ec5793bee185b3161953c796fbf20fd92b11ab0cfc5111521be17122f3e
Instruction Fuzzy Hash: D2617B72900218AFDF119FA4DC49EEEBFB9FB88320F104915F911BB2A1D775A940DB90

Function 00830FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00831128
GetDesktopWindow.USER32 ref: 0083113D
GetWindowRect.USER32(00000000), ref: 00831144
GetWindowLongW.USER32(?,000000F0), ref: 00831199
DestroyWindow.USER32(?), ref: 008311B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 008311ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0083120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0083121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00831232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00831245
IsWindowVisible.USER32(00000000), ref: 008312A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 008312BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 008312D0
GetWindowRect.USER32(00000000,?), ref: 008312E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0083130E
GetMonitorInfoW.USER32(00000000,?), ref: 00831328
CopyRect.USER32(?,?), ref: 0083133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 008313AA

Strings

tooltips_class32, xrefs: 008311E6
(, xrefs: 0083131B
0, xrefs: 008310D3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 6318f339b59fa94e494466b02a8e353a6d04f47aa73301ebf099c3ac9aa5a125
Instruction ID: 27dfb50a215d735f8941a388320fd77fb9fe614ff48c85da38180171b6b61466
Opcode Fuzzy Hash: 6318f339b59fa94e494466b02a8e353a6d04f47aa73301ebf099c3ac9aa5a125
Instruction Fuzzy Hash: 1CB17A71608341AFDB04DF64C889B6ABBE4FFC8740F008918F999EB261D735E844CB92

Function 00830241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008302E5
_wcslen.LIBCMT ref: 0083031F
_wcslen.LIBCMT ref: 00830389
_wcslen.LIBCMT ref: 008303F1
_wcslen.LIBCMT ref: 00830475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 008304C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00830504

Part of subcall function 007BF9F2: _wcslen.LIBCMT ref: 007BF9FD

Part of subcall function 0080223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00802258
Part of subcall function 0080223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0080228A

Strings

SELECTINVERT, xrefs: 0083057E
FINDITEM, xrefs: 00830627
GETTEXT, xrefs: 008303EC, 00830407
SELECT, xrefs: 00830548
GETSELECTED, xrefs: 008305E1
ISSELECTED, xrefs: 008304DD
SELECTALL, xrefs: 00830515
VIEWCHANGE, xrefs: 00830675
DESELECT, xrefs: 0083059C
SELECTCLEAR, xrefs: 0083052D
GETITEMCOUNT, xrefs: 00830316, 00830337
GETSUBITEMCOUNT, xrefs: 00830384, 0083039F
GETSELECTEDCOUNT, xrefs: 00830470, 0083048B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: f6a9db61a119f1edd8d51baffee24913ddd9b5cf45d4c3fc1278e74e58621b1a
Instruction ID: 22b8f288b78e1fa69114188d27db597df21f52eaf194e905d292846add89f4df
Opcode Fuzzy Hash: f6a9db61a119f1edd8d51baffee24913ddd9b5cf45d4c3fc1278e74e58621b1a
Instruction Fuzzy Hash: 84E18B312182059BC714DF24C96192AB3E6FFD8718F144A5CF896EB3A6DB34ED45CB82

Function 007B8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007B8968
GetSystemMetrics.USER32(00000007), ref: 007B8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007B899B
GetSystemMetrics.USER32(00000008), ref: 007B89A3
GetSystemMetrics.USER32(00000004), ref: 007B89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 007B89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 007B89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 007B8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 007B8A3C
GetClientRect.USER32(00000000,000000FF), ref: 007B8A5A
GetStockObject.GDI32(00000011), ref: 007B8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 007B8A81

Part of subcall function 007B912D: GetCursorPos.USER32(?), ref: 007B9141
Part of subcall function 007B912D: ScreenToClient.USER32(00000000,?), ref: 007B915E
Part of subcall function 007B912D: GetAsyncKeyState.USER32(00000001), ref: 007B9183
Part of subcall function 007B912D: GetAsyncKeyState.USER32(00000002), ref: 007B919D

SetTimer.USER32(00000000,00000000,00000028,007B90FC), ref: 007B8AA8

Strings

AutoIt v3 GUI, xrefs: 007B8A20

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 07f91df87db3bd8ccd172721b73605eb070f08aba41618374722527f9cf1ad3b
Instruction ID: 99608de9c6b64b7e658f0a6ec16447f21179b97d0398387a42b40fcb079f3581
Opcode Fuzzy Hash: 07f91df87db3bd8ccd172721b73605eb070f08aba41618374722527f9cf1ad3b
Instruction Fuzzy Hash: 14B12875A0020AEFDF14DFA8DC49BEA7BB5FB48314F104629FA15A7290DB78E841CB51

Function 00800D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00801114
Part of subcall function 008010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00800B9B,?,?,?), ref: 00801120
Part of subcall function 008010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00800B9B,?,?,?), ref: 0080112F
Part of subcall function 008010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00800B9B,?,?,?), ref: 00801136
Part of subcall function 008010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0080114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00800DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00800E29
GetLengthSid.ADVAPI32(?), ref: 00800E40
GetAce.ADVAPI32(?,00000000,?), ref: 00800E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00800E96
GetLengthSid.ADVAPI32(?), ref: 00800EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00800EB5
HeapAlloc.KERNEL32(00000000), ref: 00800EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00800EDD
CopySid.ADVAPI32(00000000), ref: 00800EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00800F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00800F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00800F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00800F6E
HeapFree.KERNEL32(00000000), ref: 00800F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00800F7E
HeapFree.KERNEL32(00000000), ref: 00800F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00800F8E
HeapFree.KERNEL32(00000000), ref: 00800F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00800FA1
HeapFree.KERNEL32(00000000), ref: 00800FA8

Part of subcall function 00801193: GetProcessHeap.KERNEL32(00000008,00800BB1,?,00000000,?,00800BB1,?), ref: 008011A1
Part of subcall function 00801193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00800BB1,?), ref: 008011A8
Part of subcall function 00801193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00800BB1,?), ref: 008011B7

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 4365bb86b256d493b67125946c6b3639af7133c0d147067371263476b446eb9b
Instruction ID: 2a3d5eba6e04185f9e2890bcbafbfb25507da02953d5af9266b62bba545db2c0
Opcode Fuzzy Hash: 4365bb86b256d493b67125946c6b3639af7133c0d147067371263476b446eb9b
Instruction Fuzzy Hash: 8771687290420AABDF609FA4DC48BAEBBB8FF45311F044625EA59F6191DB309A05DF60

Function 0082C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0082C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0083CC08,00000000,?,00000000,?,?), ref: 0082C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0082C5A4
_wcslen.LIBCMT ref: 0082C5F4
_wcslen.LIBCMT ref: 0082C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0082C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0082C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0082C84D
RegCloseKey.ADVAPI32(?), ref: 0082C881
RegCloseKey.ADVAPI32(00000000), ref: 0082C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0082C960

Strings

REG_EXPAND_SZ, xrefs: 0082C5CD
REG_DWORD, xrefs: 0082C804
REG_SZ, xrefs: 0082C644
REG_BINARY, xrefs: 0082C913
REG_MULTI_SZ, xrefs: 0082C6F5
REG_QWORD, xrefs: 0082C8C3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 136045334a8ffcd2af7d2622ed1058c557a1018981fcb4067d8544f15ef0a394
Instruction ID: 3251fdfa73693ad305c9a701ac741b8b0b38677e15f4bd69dd3853cd3444d171
Opcode Fuzzy Hash: 136045334a8ffcd2af7d2622ed1058c557a1018981fcb4067d8544f15ef0a394
Instruction Fuzzy Hash: 25125735604211EFCB18EF14D895A2AB7E5FF89714F04895CF88A9B3A2DB35ED41CB81

Function 0083091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008309C6
_wcslen.LIBCMT ref: 00830A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00830A54
_wcslen.LIBCMT ref: 00830A8A
_wcslen.LIBCMT ref: 00830B06
_wcslen.LIBCMT ref: 00830B81

Part of subcall function 007BF9F2: _wcslen.LIBCMT ref: 007BF9FD

Part of subcall function 00802BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00802BFA

Strings

GETITEMCOUNT, xrefs: 00830C1E
UNCHECK, xrefs: 00830D3E
EXISTS, xrefs: 00830B7C, 00830B97
COLLAPSE, xrefs: 00830B01, 00830B1C
EXPAND, xrefs: 00830BF8
CHECK, xrefs: 00830A85, 00830AA0
GETTEXT, xrefs: 00830C97
GETTOTALCOUNT, xrefs: 008309F2, 00830A17
SELECT, xrefs: 00830D11
ISCHECKED, xrefs: 00830CE1
GETSELECTED, xrefs: 00830C4E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 63293269f2119bd0d6f7cf4e6f6ca3791bb61eb43776957c918ee295db061c96
Instruction ID: 0e75567a241e42852221227805da6746722f25f9e76b0da830bc958a6b5ed741
Opcode Fuzzy Hash: 63293269f2119bd0d6f7cf4e6f6ca3791bb61eb43776957c918ee295db061c96
Instruction Fuzzy Hash: F8E156312082119FC714EF28C46092AB7E1FFD9718F158A5CE8969B3A2D735ED45CB82

Function 0082C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0082B6AE,?,?), ref: 0082C9B5
_wcslen.LIBCMT ref: 0082C9F1
_wcslen.LIBCMT ref: 0082CA68
_wcslen.LIBCMT ref: 0082CA9E
_wcslen.LIBCMT ref: 0082CAF9
_wcslen.LIBCMT ref: 0082CB2F
_wcslen.LIBCMT ref: 0082CB7F

Strings

HKCU, xrefs: 0082CBCE
HKEY_CLASSES_ROOT, xrefs: 0082CAF3, 0082CAF8
HKCC, xrefs: 0082CBAC
HKEY_LOCAL_MACHINE, xrefs: 0082CA62, 0082CA67
HKLM, xrefs: 0082CA98, 0082CA9D
HKEY_USERS, xrefs: 0082CBDF
HKCR, xrefs: 0082CB29, 0082CB2E
HKEY_CURRENT_USER, xrefs: 0082CBBD
HKU, xrefs: 0082CBF0
HKEY_CURRENT_CONFIG, xrefs: 0082CB79, 0082CB7E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 80f9d949e2ba7853d835a3357c8e4f160fa4b6ee2afd5cf1fe18242d32cde12f
Instruction ID: 02909750e756fcec2c9291de52c3d359eda32428fd66c9567a31b41bdc84437c
Opcode Fuzzy Hash: 80f9d949e2ba7853d835a3357c8e4f160fa4b6ee2afd5cf1fe18242d32cde12f
Instruction Fuzzy Hash: 3D71E47260453A8BCB20DE7CED51ABE3391FFA1764B250529F856E7284E635DDC4C3A0

Function 0083833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0083835A
_wcslen.LIBCMT ref: 0083836E
_wcslen.LIBCMT ref: 00838391
_wcslen.LIBCMT ref: 008383B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 008383F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00835BF2), ref: 0083844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00838487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 008384CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00838501
FreeLibrary.KERNEL32(?), ref: 0083850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0083851D
DestroyIcon.USER32(?,?,?,?,?,00835BF2), ref: 0083852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00838549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00838555

Strings

.icl, xrefs: 00838368
.exe, xrefs: 00838388
.dll, xrefs: 008383AB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: b24eb405d0cabdfaada15d8a4ac03f7dbb6c127ed68c020e5ea1ab31883fcd07
Instruction ID: fb6d5fd7aa7be9c600e63d33e05ad71f01ec4ba888e40964bca0dd6eaec6ffef
Opcode Fuzzy Hash: b24eb405d0cabdfaada15d8a4ac03f7dbb6c127ed68c020e5ea1ab31883fcd07
Instruction Fuzzy Hash: EE61AF72940319FEEB14DF64CC45BBE77A8FB88B11F104609F815E61D1DBB8A994CBA0

Function 007A7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#pragma compile, xrefs: 007A77D3
#cs, xrefs: 007A7873, 007A78C5
#ce, xrefs: 007A78ED
#comments-start, xrefs: 007A785F, 007A78B1
Cannot parse #include, xrefs: 007E5279
", xrefs: 007E5153
#OnAutoItStartRegister, xrefs: 007A7817
#include-once, xrefs: 007A782F
#requireadmin, xrefs: 007A77FF
#comments-end, xrefs: 007A78D9
Bad directive syntax error, xrefs: 007E519A
#include, xrefs: 007A7847
Unterminated group of comments, xrefs: 007E528C
', xrefs: 007E5169
#notrayicon, xrefs: 007A77E7

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 8ededa2ac647eb0ff3ce2cfbc23c61ec26ffe4bbfcedc4e1a45f945b5062dd22
Instruction ID: 5ad688a7ffda83757b2c02b0df33b06c13206d885b048082db4f1ae675f76b16
Opcode Fuzzy Hash: 8ededa2ac647eb0ff3ce2cfbc23c61ec26ffe4bbfcedc4e1a45f945b5062dd22
Instruction Fuzzy Hash: C981F971A04609FBDB24AF64DC46FAE7768FF96300F044128F914AA292EB7CD911D7E1

Function 00813E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00813EF8
_wcslen.LIBCMT ref: 00813F03
_wcslen.LIBCMT ref: 00813F5A
_wcslen.LIBCMT ref: 00813F98
GetDriveTypeW.KERNEL32(?), ref: 00813FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0081401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00814059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00814087

Strings

open , xrefs: 00813FE5
close cd wait, xrefs: 00814072
open, xrefs: 00813F54, 00813F59
close, xrefs: 00813EFE, 00813F18
type cdaudio alias cd wait, xrefs: 00814001
closed, xrefs: 00813F08, 00813F2D, 00813F46, 00813F7E, 00813F97
set cd door , xrefs: 00814028
wait, xrefs: 00814044

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: ffed861f654d425fb54fc2f6afc588f2901d78f42e094636dab5bceb7bea510b
Instruction ID: cce4685344f1b149ecd44fdb066793c438d07228f642dff60d29868acbd2a76a
Opcode Fuzzy Hash: ffed861f654d425fb54fc2f6afc588f2901d78f42e094636dab5bceb7bea510b
Instruction Fuzzy Hash: 8771F3726046119FC310DF24C8808AAB7F8FF99758F104A2DF596D7251EB35DD8ACB91

Function 00805A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00805A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00805A40
SetWindowTextW.USER32(?,?), ref: 00805A57
GetDlgItem.USER32(?,000003EA), ref: 00805A6C
SetWindowTextW.USER32(00000000,?), ref: 00805A72
GetDlgItem.USER32(?,000003E9), ref: 00805A82
SetWindowTextW.USER32(00000000,?), ref: 00805A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00805AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00805AC3
GetWindowRect.USER32(?,?), ref: 00805ACC
_wcslen.LIBCMT ref: 00805B33
SetWindowTextW.USER32(?,?), ref: 00805B6F
GetDesktopWindow.USER32 ref: 00805B75
GetWindowRect.USER32(00000000), ref: 00805B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00805BD3
GetClientRect.USER32(?,?), ref: 00805BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00805C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00805C2F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 68baee50d4610257de4902b172725f772c1bc63aecd4019bf61b99a9227493d4
Instruction ID: a1eb9e0093e584908e6e28fcbb554f7deb069105609c093e9705b25f6541a491
Opcode Fuzzy Hash: 68baee50d4610257de4902b172725f772c1bc63aecd4019bf61b99a9227493d4
Instruction Fuzzy Hash: A6713C31A00B09AFDB60DFA8CE96A6FBBF5FF48714F104918E542E25A0D775A944CF60

Function 0081FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0081FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0081FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0081FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0081FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0081FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0081FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0081FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0081FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0081FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0081FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0081FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0081FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0081FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0081FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0081FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0081FECC
GetCursorInfo.USER32(?), ref: 0081FEDC
GetLastError.KERNEL32 ref: 0081FF1E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 6bd6ced27afdaa58daf54f749f164bca95d757c6aceb88aabe7e9fa24c5456c2
Instruction ID: d3496bb85bf42900962cf32848e735a2743b4827d9bebb09b9b4a13f107678ee
Opcode Fuzzy Hash: 6bd6ced27afdaa58daf54f749f164bca95d757c6aceb88aabe7e9fa24c5456c2
Instruction Fuzzy Hash: C44152B0D08319AEDB109FBA8C8985EBFE8FF44354B54452AF11DE7281DB78A941CF91

Function 007C00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 007C00C6

Part of subcall function 007C00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0087070C,00000FA0,4090BB5B,?,?,?,?,007E23B3,000000FF), ref: 007C011C
Part of subcall function 007C00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,007E23B3,000000FF), ref: 007C0127
Part of subcall function 007C00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,007E23B3,000000FF), ref: 007C0138
Part of subcall function 007C00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 007C014E
Part of subcall function 007C00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 007C015C
Part of subcall function 007C00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 007C016A
Part of subcall function 007C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 007C0195
Part of subcall function 007C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 007C01A0

___scrt_fastfail.LIBCMT ref: 007C00E7

Part of subcall function 007C00A3: __onexit.LIBCMT ref: 007C00A9

Strings

kernel32.dll, xrefs: 007C0133
WakeAllConditionVariable, xrefs: 007C0162
InitializeConditionVariable, xrefs: 007C0148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 007C0122
SleepConditionVariableCS, xrefs: 007C0154

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: f3f8906da1bcc036b5cc1c21e736bbc11825eda22e352072e9e656917b0f8ce3
Instruction ID: a6856baf5acd750a312694457faeb64f79508f3b2a5d7f726579cbe18707ea08
Opcode Fuzzy Hash: f3f8906da1bcc036b5cc1c21e736bbc11825eda22e352072e9e656917b0f8ce3
Instruction Fuzzy Hash: 4021D732A45714EBD7115BA4AC0DF6E77E4FB84B51F04052DF915E2392DBBC9C408AD0

Function 008030F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0080318D
_wcslen.LIBCMT ref: 008031F8

Strings

NAME, xrefs: 00803335, 00803346
INSTANCE, xrefs: 00803453
TEXT, xrefs: 0080347C
CLASSNN, xrefs: 008031F3, 00803204
REGEXPCLASS, xrefs: 00803255, 00803266
CLASS, xrefs: 00803188, 008031A5

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: ff721b7032c343d9c0a5af93656864a193106ca76ab3030a99ae343675f4a153
Instruction ID: 66d19b5e88573320ec7cea33fe297e85834a34fd6fd4b804e9946fe6cda9bb7b
Opcode Fuzzy Hash: ff721b7032c343d9c0a5af93656864a193106ca76ab3030a99ae343675f4a153
Instruction Fuzzy Hash: 33E10632A00516EBCB689FA8CC95BEEBBB8FF54710F158119E456F7280DB34AE45C790

Function 008144C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0083CC08), ref: 00814527
_wcslen.LIBCMT ref: 0081453B
_wcslen.LIBCMT ref: 00814599
_wcslen.LIBCMT ref: 008145F4
_wcslen.LIBCMT ref: 0081463F
_wcslen.LIBCMT ref: 008146A7

Part of subcall function 007BF9F2: _wcslen.LIBCMT ref: 007BF9FD

GetDriveTypeW.KERNEL32(?,00866BF0,00000061), ref: 00814743

Strings

all, xrefs: 00814531, 00814536
fixed, xrefs: 00814635, 0081463A
cdrom, xrefs: 0081458F, 00814594
ramdisk, xrefs: 008146F1
removable, xrefs: 008145EA, 008145EF
unknown, xrefs: 00814708
network, xrefs: 0081469D, 008146A2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 15890074c87fd1e08fc54b7d4dbf3c46cfcffd89cdaa4d8d9562d622bfaf22f5
Instruction ID: 1a276dc792c9f8e2593c2fb41535af8a12776c2c3b3dc952b3ca8f7166f807f7
Opcode Fuzzy Hash: 15890074c87fd1e08fc54b7d4dbf3c46cfcffd89cdaa4d8d9562d622bfaf22f5
Instruction Fuzzy Hash: DDB103716083029FC710DF28C890AAAB7E9FFE6764F505A1DF596C7291E734D884CB92

Function 007A326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00871990), ref: 007E2F8D
GetMenuItemCount.USER32(00871990), ref: 007E303D
GetCursorPos.USER32(?), ref: 007E3081
SetForegroundWindow.USER32(00000000), ref: 007E308A
TrackPopupMenuEx.USER32(00871990,00000000,?,00000000,00000000,00000000), ref: 007E309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 007E30A9

Strings

0, xrefs: 007A327D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 13b694912ff5e4f9a2213ca3e94332c242d2d99ed6a611bbaf11d1fdc865f464
Instruction ID: 164a313a74850c07075c5a9d311edaf21ab5242b31bc68d97cc67dfa12db5a8b
Opcode Fuzzy Hash: 13b694912ff5e4f9a2213ca3e94332c242d2d99ed6a611bbaf11d1fdc865f464
Instruction Fuzzy Hash: 9D713A31641255BEFB218F29CC4DFAABF69FF49324F204216F514AA1E1C7B9AD50CB90

Function 00836CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00836DEB

Part of subcall function 007A6B57: _wcslen.LIBCMT ref: 007A6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00836E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00836E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00836E94
DestroyWindow.USER32(?), ref: 00836EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,007A0000,00000000), ref: 00836EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00836EFD
GetDesktopWindow.USER32 ref: 00836F16
GetWindowRect.USER32(00000000), ref: 00836F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00836F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00836F4D

Part of subcall function 007B9944: GetWindowLongW.USER32(?,000000EB), ref: 007B9952

Strings

tooltips_class32, xrefs: 00836E58, 00836EDD
0, xrefs: 00836D98

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 7e7f274a20acb23d4e9618134841eaacedf31e7ab7a35fdcbdb071f22123bead
Instruction ID: 32f626ba179517b4018f9f91b17710d481c6daaf7a5ea3a7b17b5b8ccb2aa64f
Opcode Fuzzy Hash: 7e7f274a20acb23d4e9618134841eaacedf31e7ab7a35fdcbdb071f22123bead
Instruction Fuzzy Hash: 94718A70104244AFDB21CF1CD848BAABBE9FBC9304F54491DFA99D7260EB70E956CB61

Function 0083911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007B9BB2

DragQueryPoint.SHELL32(?,?), ref: 00839147

Part of subcall function 00837674: ClientToScreen.USER32(?,?), ref: 0083769A
Part of subcall function 00837674: GetWindowRect.USER32(?,?), ref: 00837710
Part of subcall function 00837674: PtInRect.USER32(?,?,00838B89), ref: 00837720

SendMessageW.USER32(?,000000B0,?,?), ref: 008391B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 008391BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 008391DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00839225
SendMessageW.USER32(?,000000B0,?,?), ref: 0083923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00839255
SendMessageW.USER32(?,000000B1,?,?), ref: 00839277
DragFinish.SHELL32(?), ref: 0083927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00839371

Strings

@GUI_DRAGID, xrefs: 008392E9
@GUI_DRAGFILE, xrefs: 00839320
@GUI_DROPID, xrefs: 0083929E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 6373ef59b121f4e79c5d2068c6f09c968b928f64fddbd8f194f81364e7c14615
Instruction ID: 9015c89a8db69346d0ce98aac74eae0fbfc3788eca05a7ae60a3bbe4b2a05690
Opcode Fuzzy Hash: 6373ef59b121f4e79c5d2068c6f09c968b928f64fddbd8f194f81364e7c14615
Instruction Fuzzy Hash: 25615A71108301AFC701EF64DC89DABBBE8FFC9750F000A1DF695922A1DB749A49CB92

Function 0081C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0081C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0081C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0081C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0081C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0081C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0081C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0081C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0081C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0081C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0081C5F0
InternetCloseHandle.WININET(00000000), ref: 0081C5FB

Strings

, xrefs: 0081C575

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 623be831c51a939dde05dfacb3095624c7fab5bc7c3a49a2feca6bf31bc2ca9e
Instruction ID: ff1c7f1fd91ee3788b86c3406ee82f9fb956b53f4feccd60775f125246eb8f5f
Opcode Fuzzy Hash: 623be831c51a939dde05dfacb3095624c7fab5bc7c3a49a2feca6bf31bc2ca9e
Instruction Fuzzy Hash: E9514BB1540608BFDB218F64C988AFB7BFDFF48754F004519F945E6210DB74E9849B61

Function 0083856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00838592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008385A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008385AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008385BA
GlobalLock.KERNEL32(00000000), ref: 008385C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008385D7
GlobalUnlock.KERNEL32(00000000), ref: 008385E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008385E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 008385F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0083FC38,?), ref: 00838611
GlobalFree.KERNEL32(00000000), ref: 00838621
GetObjectW.GDI32(?,00000018,?), ref: 00838641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00838671
DeleteObject.GDI32(?), ref: 00838699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 008386AF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 799c52b9dae43e2c38d8673b3c3c3f9e2e2de6e5efcbb3c29ae960e3e3065753
Instruction ID: a6f76b6f1d0a1f95ab34b65adc994c91ffcc4e3ef16cc0ab73633c8a7d6cccff
Opcode Fuzzy Hash: 799c52b9dae43e2c38d8673b3c3c3f9e2e2de6e5efcbb3c29ae960e3e3065753
Instruction Fuzzy Hash: CD411975600208EFDB119FA5CC89EAF7BB8FF99715F108458F90AE7260DB349901DB60

Function 008114BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00811502
VariantCopy.OLEAUT32(?,?), ref: 0081150B
VariantClear.OLEAUT32(?), ref: 00811517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 008115FB
VarR8FromDec.OLEAUT32(?,?), ref: 00811657
VariantInit.OLEAUT32(?), ref: 00811708
SysFreeString.OLEAUT32(?), ref: 0081178C
VariantClear.OLEAUT32(?), ref: 008117D8
VariantClear.OLEAUT32(?), ref: 008117E7
VariantInit.OLEAUT32(00000000), ref: 00811823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00811625
Default, xrefs: 008116AF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 291ebe8cddcab6d337307d83cbb7373bcf118596796016d9a0b05c54f5c073c8
Instruction ID: 53c06c1996f18e91c1f99d9cbeaf937f832c6fb8d3ba54283b7aaab47f04f557
Opcode Fuzzy Hash: 291ebe8cddcab6d337307d83cbb7373bcf118596796016d9a0b05c54f5c073c8
Instruction Fuzzy Hash: B7D1DF31A00119EBDF10AF65D88CBE9B7BAFF45704F148556E646EB280DB34E880DB62

Function 0082B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 0082C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0082B6AE,?,?), ref: 0082C9B5
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082C9F1
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082CA68
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0082B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0082B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0082B80A
RegCloseKey.ADVAPI32(?), ref: 0082B87E
RegCloseKey.ADVAPI32(?), ref: 0082B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0082B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0082B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0082B922
FreeLibrary.KERNEL32(00000000), ref: 0082B983
RegCloseKey.ADVAPI32(00000000), ref: 0082B994

Strings

advapi32.dll, xrefs: 0082B8ED
RegDeleteKeyExW, xrefs: 0082B8FE

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 30df37ba54b82a91451cd3df4a7a349d4939047d7b17acfb0909d3c7fb951994
Instruction ID: 535e4e9f7050c61bf42af6cb26664f7ab85efdf16c2b0d5b0ef0d5b95ed5bd1b
Opcode Fuzzy Hash: 30df37ba54b82a91451cd3df4a7a349d4939047d7b17acfb0909d3c7fb951994
Instruction Fuzzy Hash: 1AC1AC31205211EFD714DF14D498F2ABBE5FF85308F18855CE59A8B2A2CB35EC85CB91

Function 0082255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 008225D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 008225E8
CreateCompatibleDC.GDI32(?), ref: 008225F4
SelectObject.GDI32(00000000,?), ref: 00822601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0082266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 008226AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 008226D0
SelectObject.GDI32(?,?), ref: 008226D8
DeleteObject.GDI32(?), ref: 008226E1
DeleteDC.GDI32(?), ref: 008226E8
ReleaseDC.USER32(00000000,?), ref: 008226F3

Strings

(, xrefs: 0082268D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: c37c634e97c3a7f7c0c8f6f78d6553a53272839278ab52505e23b416b8d92ac1
Instruction ID: 805bc59b4fe5a7a31c0f8be844015f3108b32db964dcde1bf9efdb23da31e929
Opcode Fuzzy Hash: c37c634e97c3a7f7c0c8f6f78d6553a53272839278ab52505e23b416b8d92ac1
Instruction Fuzzy Hash: 7A61D276D00219EFCF14CFA8D884AAEBBB5FF48310F208529E955A7250E774A951DF60

Function 007DDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 007DDAA1

Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD659
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD66B
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD67D
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD68F
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD6A1
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD6B3
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD6C5
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD6D7
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD6E9
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD6FB
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD70D
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD71F
Part of subcall function 007DD63C: _free.LIBCMT ref: 007DD731

_free.LIBCMT ref: 007DDA96

Part of subcall function 007D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000), ref: 007D29DE
Part of subcall function 007D29C8: GetLastError.KERNEL32(00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000,00000000), ref: 007D29F0

_free.LIBCMT ref: 007DDAB8
_free.LIBCMT ref: 007DDACD
_free.LIBCMT ref: 007DDAD8
_free.LIBCMT ref: 007DDAFA
_free.LIBCMT ref: 007DDB0D
_free.LIBCMT ref: 007DDB1B
_free.LIBCMT ref: 007DDB26
_free.LIBCMT ref: 007DDB5E
_free.LIBCMT ref: 007DDB65
_free.LIBCMT ref: 007DDB82
_free.LIBCMT ref: 007DDB9A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4deb39d17acada408cb469c9556e4e3d5982fa643f495f4134d1129d1600c704
Instruction ID: f5774c707e36d6212aa8a5b7a519509ed922b2f0813dc6e52c682e0cf3aaa327
Opcode Fuzzy Hash: 4deb39d17acada408cb469c9556e4e3d5982fa643f495f4134d1129d1600c704
Instruction Fuzzy Hash: 7F315C71604604DFEB31AA78E849B6677F8FF50314F15841BE449E73A2EE38BC419B20

Function 0080365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0080369C
_wcslen.LIBCMT ref: 008036A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00803797
GetClassNameW.USER32(?,?,00000400), ref: 0080380C
GetDlgCtrlID.USER32(?), ref: 0080385D
GetWindowRect.USER32(?,?), ref: 00803882
GetParent.USER32(?), ref: 008038A0
ScreenToClient.USER32(00000000), ref: 008038A7
GetClassNameW.USER32(?,?,00000100), ref: 00803921
GetWindowTextW.USER32(?,?,00000400), ref: 0080395D

Strings

%s%u, xrefs: 00803734

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: b293907bfc879c9c3fc027a0998861db7cffec63eaeebd7ddfccef9ced5c8ece
Instruction ID: 1398fe7b9c8e522386c8766b2b3de934deac66976576c23d5c62a276e0d4a547
Opcode Fuzzy Hash: b293907bfc879c9c3fc027a0998861db7cffec63eaeebd7ddfccef9ced5c8ece
Instruction Fuzzy Hash: 97919D71204606AFD759DF24CC85FAABBACFF45350F008A2DF999D2190EB30EA45CB91

Function 00804954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00804994
GetWindowTextW.USER32(?,?,00000400), ref: 008049DA
_wcslen.LIBCMT ref: 008049EB
CharUpperBuffW.USER32(?,00000000), ref: 008049F7
_wcsstr.LIBVCRUNTIME ref: 00804A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00804A64
GetWindowTextW.USER32(?,?,00000400), ref: 00804A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00804AE6
GetClassNameW.USER32(?,?,00000400), ref: 00804B20
GetWindowRect.USER32(?,?), ref: 00804B8B

Strings

ThumbnailClass, xrefs: 00804A6F, 00804AF1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: fb29da29e0a05b9a8d5cfabc2ea7ac32f2e5f21e8ae54e87bb91af8d97422af3
Instruction ID: c1ae2f07c9147de67d8b9a56eead46ec6c57e72bf72c753c84231c1e0df6a9d3
Opcode Fuzzy Hash: fb29da29e0a05b9a8d5cfabc2ea7ac32f2e5f21e8ae54e87bb91af8d97422af3
Instruction Fuzzy Hash: 7391B9B21442099BDB04CF54C985BAAB7E8FF84324F04946DFE85DA0D6EB34ED45CBA1

Function 00838D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007B9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00838D5A
GetFocus.USER32 ref: 00838D6A
GetDlgCtrlID.USER32(00000000), ref: 00838D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00838E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00838ECF
GetMenuItemCount.USER32(?), ref: 00838EEC
GetMenuItemID.USER32(?,00000000), ref: 00838EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00838F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00838F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00838FA1

Strings

0, xrefs: 00838E9F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 1e2862992c9b31acaf015422dfba27eb44b4f71a6a7ba15ce329efa682ad4c8b
Instruction ID: 7e8ab2ff6ca01f19abc938f5281f9ef9b31fbaad182b268e8889706730e34154
Opcode Fuzzy Hash: 1e2862992c9b31acaf015422dfba27eb44b4f71a6a7ba15ce329efa682ad4c8b
Instruction Fuzzy Hash: 88817971508305EBDB20DF24D888AABBBE9FBC8754F140919F995E7291DB70D901CBA2

Function 0080DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0080DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0080DC46
_wcslen.LIBCMT ref: 0080DC50
_wcsstr.LIBVCRUNTIME ref: 0080DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0080DCBC

Strings

\VarFileInfo\Translation, xrefs: 0080DCB4
DefaultLangCodepage, xrefs: 0080DD1F
04090000, xrefs: 0080DCF2
%u.%u.%u.%u, xrefs: 0080DD9A
StringFileInfo\, xrefs: 0080DC8F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 2db47d0ad370bab61dca523eb8e68264fa700fc26bdf91d1797e2b40ff0edb43
Instruction ID: 7e22ada7e619e0494e41d60c435de2fac83b0048e2623529473f35f8bacf7cc2
Opcode Fuzzy Hash: 2db47d0ad370bab61dca523eb8e68264fa700fc26bdf91d1797e2b40ff0edb43
Instruction Fuzzy Hash: C741D072940305BAEB14A7B49C4BFBF77ACFF85710F10006DF900E6282EA69DA1197A4

Function 0082CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0082CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0082CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0082CD48

Part of subcall function 0082CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0082CCAA
Part of subcall function 0082CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0082CCBD
Part of subcall function 0082CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0082CCCF
Part of subcall function 0082CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0082CD05
Part of subcall function 0082CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0082CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0082CCF3

Strings

advapi32.dll, xrefs: 0082CCB8
RegDeleteKeyExW, xrefs: 0082CCC9

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: dc1ce4a8cf7e55660080297a3e9ae4e46c4726dff26b1af0487d59aadafefdc8
Instruction ID: 83df9d122aa95a8b0021b981bda57ee8bbbeb7c8b3ccb83c872f5ab554a90be2
Opcode Fuzzy Hash: dc1ce4a8cf7e55660080297a3e9ae4e46c4726dff26b1af0487d59aadafefdc8
Instruction Fuzzy Hash: D3318C76901128BBDB208B65EC88EFFBB7CFF45740F000565A906E3240DA749E85ABA0

Function 00813D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00813D40
_wcslen.LIBCMT ref: 00813D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00813D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00813DBE
RemoveDirectoryW.KERNEL32(?), ref: 00813DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00813E55
CloseHandle.KERNEL32(00000000), ref: 00813E60
CloseHandle.KERNEL32(00000000), ref: 00813E6B

Strings

\, xrefs: 00813D77
:, xrefs: 00813D82
\??\%s, xrefs: 00813D5B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 09605b888e65675a2cce22f1827d2a579005fc274cb5e9af7403329a54cf66bc
Instruction ID: b106371e5b1a30ef09b8b721c2c4b638177b0d2d84cdb33a6dc017a3bdff8c0e
Opcode Fuzzy Hash: 09605b888e65675a2cce22f1827d2a579005fc274cb5e9af7403329a54cf66bc
Instruction Fuzzy Hash: E03192B2900259ABDB219BA0DC49FEF77BCFF88700F1041B9F515E61A0EB7497848B64

Function 0080E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0080E6B4

Part of subcall function 007BE551: timeGetTime.WINMM(?,?,0080E6D4), ref: 007BE555

Sleep.KERNEL32(0000000A), ref: 0080E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0080E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0080E727
SetActiveWindow.USER32 ref: 0080E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0080E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0080E773
Sleep.KERNEL32(000000FA), ref: 0080E77E
IsWindow.USER32 ref: 0080E78A
EndDialog.USER32(00000000), ref: 0080E79B

Strings

BUTTON, xrefs: 0080E719

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 4aa88379d8d9304eb5c6a1bea97aca8c99a8ef263e30f6a733d2d14d817c0347
Instruction ID: 27203e1df272b43aada7873e6291ccf0d785933bebba69560b751c9d52f73a23
Opcode Fuzzy Hash: 4aa88379d8d9304eb5c6a1bea97aca8c99a8ef263e30f6a733d2d14d817c0347
Instruction Fuzzy Hash: 5F216F70200204AFEB50AF64EC8EA263B69FBB4349F140C25F51AD12F1DB75EC409B25

Function 0080E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0080EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0080EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0080EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0080EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0080EAA7

Strings

open , xrefs: 0080EA0C
status PlayMe mode, xrefs: 0080EA58
alias PlayMe, xrefs: 0080EA36
play PlayMe wait, xrefs: 0080EA91
play PlayMe, xrefs: 0080EAA2
close PlayMe, xrefs: 0080EA6E, 0080EA9B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 4502f1bdf8170bf9332c55f50e32e8f83575809c43c07c1c1d8efb62b316f097
Instruction ID: f266bf71d6bc420e77c1971eaed2e25a7d604888be66a27c546151ea7ac81967
Opcode Fuzzy Hash: 4502f1bdf8170bf9332c55f50e32e8f83575809c43c07c1c1d8efb62b316f097
Instruction Fuzzy Hash: 86115131A50269B9E720A7A1DC4ADFF6A7CFBD6B40F0509297811E21D1EEB41915C9B0

Function 00805CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00805CE2
GetWindowRect.USER32(00000000,?), ref: 00805CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00805D59
GetDlgItem.USER32(?,00000002), ref: 00805D69
GetWindowRect.USER32(00000000,?), ref: 00805D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00805DCF
GetDlgItem.USER32(?,000003E9), ref: 00805DDD
GetWindowRect.USER32(00000000,?), ref: 00805DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00805E31
GetDlgItem.USER32(?,000003EA), ref: 00805E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00805E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00805E67

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 3a370a7e99dfd1b2b50c17eab9869daa1fe4324075b91342a86a635623660b89
Instruction ID: 66087c7ee6a32c94ef20a56eb5718103e79dbf83da96ad4c2f49ab3fbcc73d81
Opcode Fuzzy Hash: 3a370a7e99dfd1b2b50c17eab9869daa1fe4324075b91342a86a635623660b89
Instruction Fuzzy Hash: E851FFB1A00615AFDF18CF68DD89AAE7BB5FB98300F148529F915E6290D7709E04CF60

Function 007B8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 007B8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007B8BE8,?,00000000,?,?,?,?,007B8BBA,00000000,?), ref: 007B8FC5

DestroyWindow.USER32(?), ref: 007B8C81
KillTimer.USER32(00000000,?,?,?,?,007B8BBA,00000000,?), ref: 007B8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 007F6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,007B8BBA,00000000,?), ref: 007F69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,007B8BBA,00000000,?), ref: 007F69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,007B8BBA,00000000), ref: 007F69D4
DeleteObject.GDI32(00000000), ref: 007F69E6

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 34560c2854c47e1adc2bb3c6cdea0f46d9fe3492a2d6dfb66194ae712e238855
Instruction ID: 5e2323935c3fa1a207381db795fc68b2de067f0cdc4333574848cb5f382319fd
Opcode Fuzzy Hash: 34560c2854c47e1adc2bb3c6cdea0f46d9fe3492a2d6dfb66194ae712e238855
Instruction Fuzzy Hash: 9A61DC71102604DFCB658F28C94CBB5BBF5FB40312F14895CE2469AA60CB79E8C1DFA2

Function 007B9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 007B9944: GetWindowLongW.USER32(?,000000EB), ref: 007B9952

GetSysColor.USER32(0000000F), ref: 007B9862

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: a1abbedc67c0a6fdefdc32ffbeb45c062790ebde9f239d1c101eae788b6e9a04
Instruction ID: 51efcdd2a3effd9f633ed837ed09365666d2458638f89227be9f529befb7c789
Opcode Fuzzy Hash: a1abbedc67c0a6fdefdc32ffbeb45c062790ebde9f239d1c101eae788b6e9a04
Instruction Fuzzy Hash: B9417C31104644AFDB215F389C88BF93BB5BB46331F144A19FBB29B2E1D7399842DB10

Function 007D8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.|, xrefs: 007D903A, 007D8FD0, 007D8FF2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: .|
API String ID: 0-4027933657
Opcode ID: 8cbf94ff9e1700a5acdc5ca1846abd1e8dfebfaa2cfcca11c45215890b006102
Instruction ID: 892ab6226552f385a65a41eb1cfbd16ffece8ff68d602fb353f2793115297142
Opcode Fuzzy Hash: 8cbf94ff9e1700a5acdc5ca1846abd1e8dfebfaa2cfcca11c45215890b006102
Instruction Fuzzy Hash: 53C1E575A0434AEFDF11DFA8D845BADBBB1BF09310F14415AE518AB392C7389941CF61

Function 008096E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,007EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00809717
LoadStringW.USER32(00000000,?,007EF7F8,00000001), ref: 00809720

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,007EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00809742
LoadStringW.USER32(00000000,?,007EF7F8,00000001), ref: 00809745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00809866

Strings

Error: , xrefs: 0080981D
Line %d (File "%s"):, xrefs: 0080978F
%s (%d) : ==> %s: %s %s, xrefs: 0080984A
Line %d:, xrefs: 008097A0
^ ERROR, xrefs: 008097FB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 97c6956fbb368bd20eb216966f9ee1a36198674f43bb665e70170bab4a6ee54c
Instruction ID: d7865b3b1e919aacc9b3d745ae02afff1c6357f44560116e32f5019e142877cb
Opcode Fuzzy Hash: 97c6956fbb368bd20eb216966f9ee1a36198674f43bb665e70170bab4a6ee54c
Instruction Fuzzy Hash: 59412D72800219AACF04EBE0CD4ADEEB778FF95340F504565F605B2192EB396F59CB61

Function 008006DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 007A6B57: _wcslen.LIBCMT ref: 007A6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 008007A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 008007BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 008007DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00800804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0080082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00800837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0080083C

Strings

\IPC$, xrefs: 00800784
SOFTWARE\Classes\, xrefs: 0080070E
\CLSID, xrefs: 00800724

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 0d6f98ff3565e0cc22050423a099ebcf8f879bdf55d3f31f1d154e8861a3022b
Instruction ID: f2d75fcecab8d0773798e954232ffa6a87b5352603ef676c2423fb96b679d85e
Opcode Fuzzy Hash: 0d6f98ff3565e0cc22050423a099ebcf8f879bdf55d3f31f1d154e8861a3022b
Instruction Fuzzy Hash: FC41E772C10229EADF15EFA4DC999EDB778FF44350F144629E915A31A1EB385E04CFA0

Function 00823C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00823C5C
CoInitialize.OLE32(00000000), ref: 00823C8A
CoUninitialize.OLE32 ref: 00823C94
_wcslen.LIBCMT ref: 00823D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00823DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00823ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00823F0E
CoGetObject.OLE32(?,00000000,0083FB98,?), ref: 00823F2D
SetErrorMode.KERNEL32(00000000), ref: 00823F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00823FC4
VariantClear.OLEAUT32(?), ref: 00823FD8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 6ddf9959c9b6c2beb82e2453e3acded5fdd981800898266659abb925a5d63f65
Instruction ID: f2c48e595fbf0e582171d1d88da97b2561360f94d2adc00a9687c6d274480b94
Opcode Fuzzy Hash: 6ddf9959c9b6c2beb82e2453e3acded5fdd981800898266659abb925a5d63f65
Instruction Fuzzy Hash: 01C132B1608215AFC700DF68D89492BB7E9FF89748F00491DF98ADB251DB34EE45CB92

Function 00817A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00817AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00817B8F
SHGetDesktopFolder.SHELL32(?), ref: 00817BA3
CoCreateInstance.OLE32(0083FD08,00000000,00000001,00866E6C,?), ref: 00817BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00817C74
CoTaskMemFree.OLE32(?,?), ref: 00817CCC
SHBrowseForFolderW.SHELL32(?), ref: 00817D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00817D7A
CoTaskMemFree.OLE32(00000000), ref: 00817D81
CoTaskMemFree.OLE32(00000000), ref: 00817DD6
CoUninitialize.OLE32 ref: 00817DDC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: d893d92c9f6eb98a91173d4aca519fe74ddcdf43b2ec39301ed1859fc591896d
Instruction ID: 919bde025b3551bcc5d5f3427479ce16acb73b6d72827a9eca00b21a2027fb6b
Opcode Fuzzy Hash: d893d92c9f6eb98a91173d4aca519fe74ddcdf43b2ec39301ed1859fc591896d
Instruction Fuzzy Hash: 51C11B75A04109EFCB14DF64C888DAEBBF9FF48314B1485A9E516DB261D734EE81CB90

Function 0083541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00835504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00835515
CharNextW.USER32(00000158), ref: 00835544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00835585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0083559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 008355AC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 5d504928c1183d5aeff3e32d002a1a6cc7cf1225337d73955a203dfa63cb657f
Instruction ID: 84373b7dae2f5e7e31a4dc3e90a3863d5cd805b900d752f584249b9956e151e7
Opcode Fuzzy Hash: 5d504928c1183d5aeff3e32d002a1a6cc7cf1225337d73955a203dfa63cb657f
Instruction Fuzzy Hash: 6E619CB1900608EFDF10CF94CC85AFE7BB9FB89724F104549F925EA290D7749A80DBA1

Function 007FFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 007FFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 007FFB08
VariantInit.OLEAUT32(?), ref: 007FFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 007FFB3A
VariantCopy.OLEAUT32(?,?), ref: 007FFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 007FFBA1
VariantClear.OLEAUT32(?), ref: 007FFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 007FFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007FFBCC
VariantClear.OLEAUT32(?), ref: 007FFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007FFBE9

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 1d84f42a9c6fc46ff993961af3e7e231face41ae532d36a6cdb0c72d1319c58a
Instruction ID: 6c52ae6d493a3b0b11803278dd570f4d01e026e5a974173b66918bf616912594
Opcode Fuzzy Hash: 1d84f42a9c6fc46ff993961af3e7e231face41ae532d36a6cdb0c72d1319c58a
Instruction Fuzzy Hash: 29414F75A00219EFCB00DF68D8589BEBBB9FF48354F008469E955A7361CB34E945CBA1

Function 00809C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00809CA1
GetAsyncKeyState.USER32(000000A0), ref: 00809D22
GetKeyState.USER32(000000A0), ref: 00809D3D
GetAsyncKeyState.USER32(000000A1), ref: 00809D57
GetKeyState.USER32(000000A1), ref: 00809D6C
GetAsyncKeyState.USER32(00000011), ref: 00809D84
GetKeyState.USER32(00000011), ref: 00809D96
GetAsyncKeyState.USER32(00000012), ref: 00809DAE
GetKeyState.USER32(00000012), ref: 00809DC0
GetAsyncKeyState.USER32(0000005B), ref: 00809DD8
GetKeyState.USER32(0000005B), ref: 00809DEA

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 421ce58021ec4570a47c4eecfc8cf498424438d6ef5c148f0ad9e6275ab9a4db
Instruction ID: ccdfac957260806728e4ec6eae634159bfc25b5ccb2dd83e3eca78f3b17ea5ef
Opcode Fuzzy Hash: 421ce58021ec4570a47c4eecfc8cf498424438d6ef5c148f0ad9e6275ab9a4db
Instruction Fuzzy Hash: B841B5349447CA6DFFB19664CC043B6BEA0FF51344F08805ADAC6965C3EBA59DC8C7A2

Function 0082055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 008205BC
inet_addr.WSOCK32(?), ref: 0082061C
gethostbyname.WSOCK32(?), ref: 00820628
IcmpCreateFile.IPHLPAPI ref: 00820636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 008206C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 008206E5
IcmpCloseHandle.IPHLPAPI(?), ref: 008207B9
WSACleanup.WSOCK32 ref: 008207BF

Strings

Ping, xrefs: 00820676

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 590277c8c448eeb2ab1f17e67d8279dd0bae4e218afbc60c0ccef576442bf9b2
Instruction ID: 30456090e1c2d602b112af063c91a3e34f323854497bed366605e3407a5368d2
Opcode Fuzzy Hash: 590277c8c448eeb2ab1f17e67d8279dd0bae4e218afbc60c0ccef576442bf9b2
Instruction Fuzzy Hash: 63917A75604211AFD320CF15D888B1ABBE0FF88318F1489A9E469DB6A2C735ED81CF91

Function 00828CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00828CF3

Part of subcall function 00808E54: _wcslen.LIBCMT ref: 00808E77

_wcslen.LIBCMT ref: 00828D4E
_wcslen.LIBCMT ref: 00828D9C
_wcslen.LIBCMT ref: 00828DDC
_wcslen.LIBCMT ref: 00828E6E

Strings

cdecl, xrefs: 00828D48, 00828D4D
winapi, xrefs: 00828D96, 00828D9B
stdcall, xrefs: 00828DD6, 00828DDB
none, xrefs: 00828E65, 00828E6A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: ebc2556130e5074ee7c83d25ab269cc1fdcf897403fb3b957ecbceda8d4421ef
Instruction ID: 0f3f382dcf87038f0793eda72033f118887dc5cc78af41bebfa5163d7acdbedc
Opcode Fuzzy Hash: ebc2556130e5074ee7c83d25ab269cc1fdcf897403fb3b957ecbceda8d4421ef
Instruction Fuzzy Hash: BC51C136A01126EBCF14DFACD9509BEB3A5FF65324B214229E926E72C4DB34DD84C790

Function 0082372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00823774
CoUninitialize.OLE32 ref: 0082377F
CoCreateInstance.OLE32(?,00000000,00000017,0083FB78,?), ref: 008237D9
IIDFromString.OLE32(?,?), ref: 0082384C
VariantInit.OLEAUT32(?), ref: 008238E4
VariantClear.OLEAUT32(?), ref: 00823936

Strings

Invalid parameter, xrefs: 00823865
Failed to create object, xrefs: 008237E4, 0082389A
NULL Pointer assignment, xrefs: 0082381E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: c3072cda4c1b23869926bd3f8df83746746e89e1dadda50d517e8102ddec1b8f
Instruction ID: c2711f7df050fd2c6fc44756ded11d7d11fa08992aa0bbeb9694fc6ddd43f80c
Opcode Fuzzy Hash: c3072cda4c1b23869926bd3f8df83746746e89e1dadda50d517e8102ddec1b8f
Instruction Fuzzy Hash: 8761C170608311AFD710DF54D858B5ABBE8FF89714F000929F995DB291C778EE88CB92

Function 00818195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00818257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00818267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00818273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00818310
SetCurrentDirectoryW.KERNEL32(?), ref: 00818324
SetCurrentDirectoryW.KERNEL32(?), ref: 00818356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0081838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00818395

Strings

*.*, xrefs: 0081839B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 62e291b925e04a8b87fc8f1a7080343c6749eb8bfdbc0a314d1f36e7fcad18af
Instruction ID: 4ed66d954486fa75b0ddec48c8d56575ac7e8e6704a1391d39be584abc21fc9a
Opcode Fuzzy Hash: 62e291b925e04a8b87fc8f1a7080343c6749eb8bfdbc0a314d1f36e7fcad18af
Instruction Fuzzy Hash: 876156B2504205EFCB10EF64C8459AEB3E8FF89314F08891EF999D7251EB35E945CB92

Function 00813388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 008133CF

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 008133F0

Strings

Error: , xrefs: 008134D1
Line %d (File "%s"):, xrefs: 00813443, 0081345C
Incorrect parameters to object property !, xrefs: 008134AB
"%s" (%d) : ==> %s:%s%s, xrefs: 00813504
^ ERROR , xrefs: 0081349E
"%s" (%d) : ==> %s:, xrefs: 00813522

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 4ab360ba76b8d8adde6c88e3d7accebb043319e63ae5161a02bc11462da98907
Instruction ID: dc715814787376f07c19ab4786b391ed94d9f152e01258a1f2ae533fbcdec4c3
Opcode Fuzzy Hash: 4ab360ba76b8d8adde6c88e3d7accebb043319e63ae5161a02bc11462da98907
Instruction Fuzzy Hash: 9E51BD71800219EADF14EBA0CD4AEEEB778FF45740F104165F109B2192EB396FA8CB61

Function 0080B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0080B5FC
_wcslen.LIBCMT ref: 0080B608
_wcslen.LIBCMT ref: 0080B64D
_wcslen.LIBCMT ref: 0080B68C
_wcslen.LIBCMT ref: 0080B6C7

Strings

KEYS, xrefs: 0080B647, 0080B64C
EXISTS, xrefs: 0080B686, 0080B68B
REMOVE, xrefs: 0080B602, 0080B607
APPEND, xrefs: 0080B6C1, 0080B6C6

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 656913af5d3467896efd4c6820d9f6ff1fe01f05498b88d8bf73a679b48396b9
Instruction ID: 22396c6fbf798c09831186729c665c156b475ac9ab05215332f102f9bc143281
Opcode Fuzzy Hash: 656913af5d3467896efd4c6820d9f6ff1fe01f05498b88d8bf73a679b48396b9
Instruction Fuzzy Hash: FB418232A001279BCB605E7D8C915BE77A5FBB1B58B254229E531D72C4F736CD81C790

Function 00815393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008153A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00815416
GetLastError.KERNEL32 ref: 00815420
SetErrorMode.KERNEL32(00000000,READY), ref: 008154A7

Strings

READY, xrefs: 00815460, 00815468
NOTREADY, xrefs: 0081544B
READONLY, xrefs: 00815452
INVALID, xrefs: 00815459
UNKNOWN, xrefs: 00815444

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f530ca5de5aef071c8e392fc48a17369d4766f3210eea248fefcd70503801153
Instruction ID: b083cf12065ce4d1ac40d8e88b7d405e930d8800631a783b818a20f0a6228d61
Opcode Fuzzy Hash: f530ca5de5aef071c8e392fc48a17369d4766f3210eea248fefcd70503801153
Instruction Fuzzy Hash: 633192B5A00604DFC710DF68D488AEABBB8FF85305F148065E505DB292EB75DDC6CB91

Function 00833C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00833C79
SetMenu.USER32(?,00000000), ref: 00833C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00833D10
IsMenu.USER32(?), ref: 00833D24
CreatePopupMenu.USER32 ref: 00833D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00833D5B
DrawMenuBar.USER32 ref: 00833D63

Strings

F, xrefs: 00833D4E
0, xrefs: 00833C54

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 2f20e76c170e59680b697647c15b439b369b50d70101016732b833c00f435b8d
Instruction ID: e8055e0aeff228fa0362e893dc21777066a6e7d714280d29c1dec21defd709ec
Opcode Fuzzy Hash: 2f20e76c170e59680b697647c15b439b369b50d70101016732b833c00f435b8d
Instruction Fuzzy Hash: A9414875A01209EFDB14DF64D848BAABBB5FF89350F140429F946E7360D730AA10CB94

Function 00801EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 00803CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00803CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00801F64
GetDlgCtrlID.USER32 ref: 00801F6F
GetParent.USER32 ref: 00801F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00801F8E
GetDlgCtrlID.USER32(?), ref: 00801F97
GetParent.USER32(?), ref: 00801FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00801FAE

Strings

ListBox, xrefs: 00801F21
ComboBox, xrefs: 00801EEC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 55f2bce1bdceb0fb9a7d320f37b3853773b6025ad0710feb11a97db2dafcf9b2
Instruction ID: 59239274930a03961b8245163e90020be8e1e7323bf59cf66e040a6e96b3346a
Opcode Fuzzy Hash: 55f2bce1bdceb0fb9a7d320f37b3853773b6025ad0710feb11a97db2dafcf9b2
Instruction Fuzzy Hash: 0521B070A00214BBDF44AFA0CC899EEBBB8FF56360F004519F961A72D1DB3859149B60

Function 00833A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00833A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00833AA0
GetWindowLongW.USER32(?,000000F0), ref: 00833AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00833AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00833B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00833BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00833BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00833BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00833BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00833C13

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: a28a0eca6bd5425d5196fc914295fbedf98838ec1a9aa1342a2fcb0dbd128a94
Instruction ID: 8ad0a0631208b17c65ecd12256155c42cdcbd7f493d2067eb7d0f5f96b866a4c
Opcode Fuzzy Hash: a28a0eca6bd5425d5196fc914295fbedf98838ec1a9aa1342a2fcb0dbd128a94
Instruction Fuzzy Hash: 86618C71900208AFDB11DF68CC85EEEB7B8FB49710F100099FA15E72A1C774AE82DB90

Function 007D2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007D2C94

Part of subcall function 007D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000), ref: 007D29DE
Part of subcall function 007D29C8: GetLastError.KERNEL32(00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000,00000000), ref: 007D29F0

_free.LIBCMT ref: 007D2CA0
_free.LIBCMT ref: 007D2CAB
_free.LIBCMT ref: 007D2CB6
_free.LIBCMT ref: 007D2CC1
_free.LIBCMT ref: 007D2CCC
_free.LIBCMT ref: 007D2CD7
_free.LIBCMT ref: 007D2CE2
_free.LIBCMT ref: 007D2CED
_free.LIBCMT ref: 007D2CFB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e6260eaa2780bb3caab3aa82530d2d59402bc91dfc11dede5616bcbeae30a4ef
Instruction ID: c7665c268b651c0e132269748309260581493157aa8d2a5eb22d22717c54afd8
Opcode Fuzzy Hash: e6260eaa2780bb3caab3aa82530d2d59402bc91dfc11dede5616bcbeae30a4ef
Instruction Fuzzy Hash: C8118076100108EFCB02EF94D896C9D3BB5BF15350F5144A6FA48AB332DA35EA52AF90

Function 00817DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00817FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00817FC1
GetFileAttributesW.KERNEL32(?), ref: 00817FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00818005
SetCurrentDirectoryW.KERNEL32(?), ref: 00818017
SetCurrentDirectoryW.KERNEL32(?), ref: 00818060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 008180B0

Strings

*.*, xrefs: 00818066

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: e9ee654bf9f1e886546cd386fa45ad6c13d4e8315b6198fadad5fe6973f43209
Instruction ID: cd5282dc917470edf7a803dc5a9dd3a1abdd466ff0e06ab25b9175edcd8dc8e9
Opcode Fuzzy Hash: e9ee654bf9f1e886546cd386fa45ad6c13d4e8315b6198fadad5fe6973f43209
Instruction Fuzzy Hash: 84818D72508245DBCB20EF14C855AAAB3ECFF89714F144C6EF885D7250EB35ED898B92

Function 007A5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 007A5C7A

Part of subcall function 007A5D0A: GetClientRect.USER32(?,?), ref: 007A5D30
Part of subcall function 007A5D0A: GetWindowRect.USER32(?,?), ref: 007A5D71
Part of subcall function 007A5D0A: ScreenToClient.USER32(?,?), ref: 007A5D99

GetDC.USER32 ref: 007E46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 007E4708
SelectObject.GDI32(00000000,00000000), ref: 007E4716
SelectObject.GDI32(00000000,00000000), ref: 007E472B
ReleaseDC.USER32(?,00000000), ref: 007E4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 007E47C4

Strings

U, xrefs: 007E4693

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: ba7b7681f276fb1ce95528b72fa426027426d0391ed6bf51693a989858faef2b
Instruction ID: 004d61ae8b20730da8b9c14943e7fe7179c86c568b140408bcb1f1da61c7975c
Opcode Fuzzy Hash: ba7b7681f276fb1ce95528b72fa426027426d0391ed6bf51693a989858faef2b
Instruction Fuzzy Hash: EF710331401245EFCF218F69C988ABA7BB5FF8E324F144269ED555A16AC339CC81DFA0

Function 0081359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 008135E4

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

LoadStringW.USER32(00872390,?,00000FFF,?), ref: 0081360A

Strings

Error: , xrefs: 008136EF
Line %d (File "%s"):, xrefs: 0081366B
^ ERROR, xrefs: 008136C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00813724
"%s" (%d) : ==> %s:, xrefs: 00813742

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: f773ffdeb3a27c30e2fc64f02b4eb4cb182c447fb0eb8cf0897e10a17859ba66
Instruction ID: b4111cb61bbef980d7734d5e3ce02c329dce2db182b6a9676209be932d63cf60
Opcode Fuzzy Hash: f773ffdeb3a27c30e2fc64f02b4eb4cb182c447fb0eb8cf0897e10a17859ba66
Instruction Fuzzy Hash: 13517071800219FADF15EBA0DC4AEEEBB38FF55340F144225F115B2191EB385B99DBA1

Function 00838B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007B9BB2

Part of subcall function 007B912D: GetCursorPos.USER32(?), ref: 007B9141
Part of subcall function 007B912D: ScreenToClient.USER32(00000000,?), ref: 007B915E
Part of subcall function 007B912D: GetAsyncKeyState.USER32(00000001), ref: 007B9183
Part of subcall function 007B912D: GetAsyncKeyState.USER32(00000002), ref: 007B919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00838B6B
ImageList_EndDrag.COMCTL32 ref: 00838B71
ReleaseCapture.USER32 ref: 00838B77
SetWindowTextW.USER32(?,00000000), ref: 00838C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00838C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00838CFF

Strings

@GUI_DRAGFILE, xrefs: 00838C9A
@GUI_DROPID, xrefs: 00838C51

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: b2955ef96a05faefe34ac490ed0448ea928de74421ffcd68ef0536455e230afc
Instruction ID: 58cf54c5f9a433b3de7cf7f54aa3cdbb3dcedc5cf3ed5a7d2427cf36afa3e427
Opcode Fuzzy Hash: b2955ef96a05faefe34ac490ed0448ea928de74421ffcd68ef0536455e230afc
Instruction Fuzzy Hash: BC518D71104304EFD704DF24CC5AFAA77E4FB85714F400A2DFA56A72A1DB74A945CBA2

Function 0081C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0081C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0081C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0081C2CA
GetLastError.KERNEL32 ref: 0081C322
SetEvent.KERNEL32(?), ref: 0081C336
InternetCloseHandle.WININET(00000000), ref: 0081C341

Strings

, xrefs: 0081C2BB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 7ac87a02e5f6a0aeb06351bbae2b36e1f67fe7a2efaccf4316b17425c9e283a5
Instruction ID: 9da626a8c41f8e805c4ce424f9e265e9e51808ea4637b6222a515caa7ad93560
Opcode Fuzzy Hash: 7ac87a02e5f6a0aeb06351bbae2b36e1f67fe7a2efaccf4316b17425c9e283a5
Instruction Fuzzy Hash: C5317AB1640608AFD7219FA98C88AAB7BFCFF49744F10891EF456E2200DB74DD849B61

Function 0080989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,007E3AAF,?,?,Bad directive syntax error,0083CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 008098BC
LoadStringW.USER32(00000000,?,007E3AAF,?), ref: 008098C3

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00809987

Strings

., xrefs: 0080996D
Line %d (File "%s"):, xrefs: 0080992D
Line %d:, xrefs: 00809912
Error: , xrefs: 00809955
%s (%d) : ==> %s.: %s %s, xrefs: 008098F1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 53c9361b239d3ff2d25d74585ab7b521ca9a2cf70e3da4050d6b08173e348e9b
Instruction ID: ec0425d410c63c5b2a1105d2413bc4b7d2528e146f3275b5c33c75a018b6021c
Opcode Fuzzy Hash: 53c9361b239d3ff2d25d74585ab7b521ca9a2cf70e3da4050d6b08173e348e9b
Instruction Fuzzy Hash: 0521913280025EEBCF11AF90CC0AEEE7B39FF59700F044459F519A21A2EB799628DB50

Function 0080209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 008020AB
GetClassNameW.USER32(00000000,?,00000100), ref: 008020C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0080214D

Strings

smallicons, xrefs: 00802115
details, xrefs: 008020FB
list, xrefs: 0080212F
SHELLDLL_DefView, xrefs: 008020CC
largeicons, xrefs: 008020E1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: cc130f31c7b63b63cf5d6b4c9a1f4bd32750bcf9b4f98e8010e054c52b7228de
Instruction ID: 5f7a1e4fb010567241750a2d0903cefe5bbeea4198ccf702c17c4c1d0bd084db
Opcode Fuzzy Hash: cc130f31c7b63b63cf5d6b4c9a1f4bd32750bcf9b4f98e8010e054c52b7228de
Instruction Fuzzy Hash: 58112376288706F9FB152220DC0FDAA739CFB14328F20001EFB04F40D1FBA978025614

Function 007DCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 007DCEB7
_free.LIBCMT ref: 007DCF22
_free.LIBCMT ref: 007DCF48
_free.LIBCMT ref: 007DCF71
_free.LIBCMT ref: 007DCFA9
_free.LIBCMT ref: 007DCFDA
_free.LIBCMT ref: 007DD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 007DD09C
_free.LIBCMT ref: 007DD0B5

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: dbb6728d7551913fd729572f43255b635b91d5f5b9acfd37d111f436a7173b5c
Instruction ID: e921b4404138b9224f5761efbe5087ff3922e905764cd76ed27e39a01addb5c5
Opcode Fuzzy Hash: dbb6728d7551913fd729572f43255b635b91d5f5b9acfd37d111f436a7173b5c
Instruction Fuzzy Hash: 23610872904302EFDB32AFB4D889AA97BB5AF05310F04416FF944A7382D63D9D42DB60

Function 008350D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00835186
ShowWindow.USER32(?,00000000), ref: 008351C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 008351CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 008351D1

Part of subcall function 00836FBA: DeleteObject.GDI32(00000000), ref: 00836FE6

GetWindowLongW.USER32(?,000000F0), ref: 0083520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0083521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0083524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00835287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00835296

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: f8b4ae4367a7c80885265bd61fc5b8d01631f287a79acea4011ab12d1a3291cf
Instruction ID: d513e244a8b7a8c7a350e55bd1fe982bd8d68ac526aee58f9cefe9263c7a9c52
Opcode Fuzzy Hash: f8b4ae4367a7c80885265bd61fc5b8d01631f287a79acea4011ab12d1a3291cf
Instruction Fuzzy Hash: A6519130A40A08FFEF209F28CC4ABDD3BA5FB85325F144511FA25D62E0C775A990DB81

Function 007B8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 007F6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 007F68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 007F68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 007F68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 007F68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,007B8874,00000000,00000000,00000000,000000FF,00000000), ref: 007F6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 007F691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,007B8874,00000000,00000000,00000000,000000FF,00000000), ref: 007F692D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 685dfe929060fbc7a3c58bce5ab6808a1c6c9b48ceaab3f9d0a92219a12941f1
Instruction ID: b704512965cd7815dccdcd372d2c794aee9997c5e31e6a1e22c0619fe4258dd8
Opcode Fuzzy Hash: 685dfe929060fbc7a3c58bce5ab6808a1c6c9b48ceaab3f9d0a92219a12941f1
Instruction Fuzzy Hash: A2516CB0600209EFDB20CF28CC59FAA7BB9FB94750F14451CFA56A72A0DB74E991DB50

Function 0081C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0081C182
GetLastError.KERNEL32 ref: 0081C195
SetEvent.KERNEL32(?), ref: 0081C1A9

Part of subcall function 0081C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0081C272
Part of subcall function 0081C253: GetLastError.KERNEL32 ref: 0081C322
Part of subcall function 0081C253: SetEvent.KERNEL32(?), ref: 0081C336
Part of subcall function 0081C253: InternetCloseHandle.WININET(00000000), ref: 0081C341

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 0b3b2b3ece2d8573f1b8095d04462829062a2730519735e785a650b699f78d29
Instruction ID: 8eebd13b12ee9772044d47e13c9dabc4d7411bded87293fc50154ae6f7f7fbf0
Opcode Fuzzy Hash: 0b3b2b3ece2d8573f1b8095d04462829062a2730519735e785a650b699f78d29
Instruction Fuzzy Hash: 32316C71680605BFDB219FA9DC48AABBBFDFF58300B14481DF95AD2610D731E8949BA0

Function 008025A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00803A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00803A57
Part of subcall function 00803A3D: GetCurrentThreadId.KERNEL32 ref: 00803A5E
Part of subcall function 00803A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,008025B3), ref: 00803A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 008025BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 008025DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 008025DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 008025E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00802601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00802605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0080260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00802623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00802627

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 3dba96da4c5df6e79dfa71a727f0f2a41362751454d6fc26f86dcfc3f20994fb
Instruction ID: 097e0b2e4b4459e9e140e863b8802e8630eb151ac49201d98e15691a8ddfaa82
Opcode Fuzzy Hash: 3dba96da4c5df6e79dfa71a727f0f2a41362751454d6fc26f86dcfc3f20994fb
Instruction Fuzzy Hash: 5901B131390624BBFB6067689C8AF593E59EB9AB12F100405F318AE0D1C9E224449A6A

Function 00801803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00801449,?,?,00000000), ref: 0080180C
HeapAlloc.KERNEL32(00000000,?,00801449,?,?,00000000), ref: 00801813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00801449,?,?,00000000), ref: 00801828
GetCurrentProcess.KERNEL32(?,00000000,?,00801449,?,?,00000000), ref: 00801830
DuplicateHandle.KERNEL32(00000000,?,00801449,?,?,00000000), ref: 00801833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00801449,?,?,00000000), ref: 00801843
GetCurrentProcess.KERNEL32(00801449,00000000,?,00801449,?,?,00000000), ref: 0080184B
DuplicateHandle.KERNEL32(00000000,?,00801449,?,?,00000000), ref: 0080184E
CreateThread.KERNEL32(00000000,00000000,00801874,00000000,00000000,00000000), ref: 00801868

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 4ba5483d09a1ecfde1f6f195b37e9c6bbff3827919247a81e2872cddf43ca70c
Instruction ID: df74ea8206f44f364fc74bf9bd8f923f530d33158186959f489cafb937f38f61
Opcode Fuzzy Hash: 4ba5483d09a1ecfde1f6f195b37e9c6bbff3827919247a81e2872cddf43ca70c
Instruction Fuzzy Hash: 6801BF75240304BFE710AB65DC4DF5B7B6CFB89B11F004411FA05DB291C674D810DB20

Function 0082A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0080D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0080D501
Part of subcall function 0080D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0080D50F
Part of subcall function 0080D4DC: CloseHandle.KERNEL32(00000000), ref: 0080D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0082A16D
GetLastError.KERNEL32 ref: 0082A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0082A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0082A268
GetLastError.KERNEL32(00000000), ref: 0082A273
CloseHandle.KERNEL32(00000000), ref: 0082A2C4

Strings

SeDebugPrivilege, xrefs: 0082A18F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: ed0f0ebf7244d32363c5a26fa8614f1cecae61fdbc314d4cca23387a9505606e
Instruction ID: 4429357ca7b8310e32aede22ec8363144fc75cf6cf2ae8e8aca7aa0e6d7bd5de
Opcode Fuzzy Hash: ed0f0ebf7244d32363c5a26fa8614f1cecae61fdbc314d4cca23387a9505606e
Instruction Fuzzy Hash: E5617B31204252EFD714DF18D898F15BBA5FF84318F18849CE4668B7A2C776EC85CB92

Function 00833886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00833925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0083393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00833954
_wcslen.LIBCMT ref: 00833999
SendMessageW.USER32(?,00001057,00000000,?), ref: 008339C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 008339F4

Strings

SysListView32, xrefs: 008338F7

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 1aa3523713e115db74b1577e374fe50027380da730913ed87fda90e6812f3a9b
Instruction ID: 9a2b5580d257d99d66ac139f3aa016827f6cc96e21c45d967a7e13a9d17ca542
Opcode Fuzzy Hash: 1aa3523713e115db74b1577e374fe50027380da730913ed87fda90e6812f3a9b
Instruction Fuzzy Hash: 6B418371A00219ABEF219F64CC49FEA7BA9FF48354F10052AF958E7281D775D980CB90

Function 0080BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0080BCFD
IsMenu.USER32(00000000), ref: 0080BD1D
CreatePopupMenu.USER32 ref: 0080BD53
GetMenuItemCount.USER32(01665D18), ref: 0080BDA4
InsertMenuItemW.USER32(01665D18,?,00000001,00000030), ref: 0080BDCC

Strings

0, xrefs: 0080BCA8
2, xrefs: 0080BD37

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 462a997e9776c0bc32f6c3d17bbd3f4940d9f97664b932477e3c8a837bc7e6e1
Instruction ID: 2e6827a50f634df8d5905ee21e0f60a69a6681bfc20655754468b0dcd8b7458b
Opcode Fuzzy Hash: 462a997e9776c0bc32f6c3d17bbd3f4940d9f97664b932477e3c8a837bc7e6e1
Instruction Fuzzy Hash: 25517970A0020A9BDB60DFA8DC88BAEFBF4FF45354F148659E811E72D1D770A941CB62

Function 007C2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 007C2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 007C2D53
_ValidateLocalCookies.LIBCMT ref: 007C2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 007C2E0C
_ValidateLocalCookies.LIBCMT ref: 007C2E61

Strings

csm, xrefs: 007C2DF6
&H|, xrefs: 007C2DFE, 007C2E07, 007C2E18

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H|$csm
API String ID: 1170836740-2313355584
Opcode ID: fae7d14e561552eebeca59609c767806604bf737465d38230f4f7a5d3b37775b
Instruction ID: 122196a869e6a23e86d45d019b660ac50ab2357e84f48a8df22f4170a27d4bfc
Opcode Fuzzy Hash: fae7d14e561552eebeca59609c767806604bf737465d38230f4f7a5d3b37775b
Instruction Fuzzy Hash: 39417334A00209EBCF10DF68C849F9EBBA5BF55324F14815DE915AB353DB399A06CBE1

Function 0080C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0080C913

Strings

question, xrefs: 0080C8CC
info, xrefs: 0080C8B4
blank, xrefs: 0080C895
stop, xrefs: 0080C8E4
warning, xrefs: 0080C8FC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 03a692badcd3c0a64717d8ae613302d59c75d5f029daf5618e10bd4c52f28761
Instruction ID: ee993706395a3dab08ab31574b4e47af02c5b1d4302a659a55297c07d667a1b8
Opcode Fuzzy Hash: 03a692badcd3c0a64717d8ae613302d59c75d5f029daf5618e10bd4c52f28761
Instruction Fuzzy Hash: 3011EB3168930ABEE7155F549C83DAE7B9CFF15358B10423EF904F62C2E7745D005268

Function 0080ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0080ED2A
_wcslen.LIBCMT ref: 0080ED3B
_wcslen.LIBCMT ref: 0080ED79
_wcslen.LIBCMT ref: 0080EDAF
_wcslen.LIBCMT ref: 0080EDDF
_wcslen.LIBCMT ref: 0080EDEF
_wcslen.LIBCMT ref: 0080EE2B
_wcslen.LIBCMT ref: 0080EE5A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 0f083426916325831b9a02c3460a7bdd1ac32e1c3a2918a2d114112b4337b2ff
Instruction ID: 8417a2efa20e80f913c07520e31ad463ba1d860aad7843d29ac546051100257a
Opcode Fuzzy Hash: 0f083426916325831b9a02c3460a7bdd1ac32e1c3a2918a2d114112b4337b2ff
Instruction Fuzzy Hash: 36418E66C10218B5CB51EBF4CC8AECFB7A8FF45310F50886AE518E3161EB38E645C3A5

Function 007BF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,007F682C,00000004,00000000,00000000), ref: 007BF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,007F682C,00000004,00000000,00000000), ref: 007FF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,007F682C,00000004,00000000,00000000), ref: 007FF454

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d2e653bd14ed7e852e5d77286edfc6c68c646bc4cd3636a95961d666eddf298d
Instruction ID: af0bcdc32ed747a9006153f6143345d4b60f80638f1aa9f9bb9764fafcb94dfb
Opcode Fuzzy Hash: d2e653bd14ed7e852e5d77286edfc6c68c646bc4cd3636a95961d666eddf298d
Instruction Fuzzy Hash: C141E931608684FAC7399B2D8C8C7BA7B91BF96B14F14453CE647D6660DA3DB880DB11

Function 00832D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00832D1B
GetDC.USER32(00000000), ref: 00832D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00832D2E
ReleaseDC.USER32(00000000,00000000), ref: 00832D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00832D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00832D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00835A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00832DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00832DE1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: f37915d0e6abce0557d3d5df284a0578e56bfd91738149a114531a92776fbadb
Instruction ID: cf46ad118e0568ecc59ffa40fcf8d0d16332a9d42f896e66f2d37b24a222205b
Opcode Fuzzy Hash: f37915d0e6abce0557d3d5df284a0578e56bfd91738149a114531a92776fbadb
Instruction Fuzzy Hash: 19319C72201614BFEB218F54CC8AFEB3BA9FF89711F044055FE08EA291D6759C40CBA0

Function 00805622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00805637
_memcmp.LIBVCRUNTIME ref: 00805659
_memcmp.LIBVCRUNTIME ref: 00805671
_memcmp.LIBVCRUNTIME ref: 00805684
_memcmp.LIBVCRUNTIME ref: 0080569E
_memcmp.LIBVCRUNTIME ref: 008056B1
_memcmp.LIBVCRUNTIME ref: 008056C9
_memcmp.LIBVCRUNTIME ref: 008056E4

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: d0ccc4e6be341cc520f459d052a6625ad6ed4d2bee9927a902b71c81f5aa55f3
Instruction ID: 7fa87a191b5d1c6ab9d90ad4da3ffe13c90f91bed67cb218b74b1b1f801814d8
Opcode Fuzzy Hash: d0ccc4e6be341cc520f459d052a6625ad6ed4d2bee9927a902b71c81f5aa55f3
Instruction Fuzzy Hash: 7421B661A41A19BBD25455108E82FBB235CFF71398F840038FE15DA6C2F72AED118DF5

Function 00824FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0082502E, 00825383
Not an Object type, xrefs: 00825007

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 9ef385005db4e7ecf6346b1bac5c3794a61792abbae54b5804617ed972549bca
Instruction ID: 9e5e3a053d3f4d80ff908d68908f8cf15029bdfefe17b42df60615197728b250
Opcode Fuzzy Hash: 9ef385005db4e7ecf6346b1bac5c3794a61792abbae54b5804617ed972549bca
Instruction Fuzzy Hash: F1D1C271A4061AAFDF10CFA8D884BAEB7B5FF48354F148069E915EB281D770DD81CB90

Function 007E1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,007E17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 007E15CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,007E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007E1651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,007E17FB,?,007E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007E16E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,007E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007E16FB

Part of subcall function 007D3820: RtlAllocateHeap.NTDLL(00000000,?,00871444,?,007BFDF5,?,?,007AA976,00000010,00871440,007A13FC,?,007A13C6,?,007A1129), ref: 007D3852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,007E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 007E1777
__freea.LIBCMT ref: 007E17A2
__freea.LIBCMT ref: 007E17AE

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 77bcfe1f96544bffec337f980145cc05a59f8f07608511d02bdf5a28e4bb9ee6
Instruction ID: 2104e041c2984e953dc3063ee4f2cab5227ecd231a9b728110927f7b103bd4f4
Opcode Fuzzy Hash: 77bcfe1f96544bffec337f980145cc05a59f8f07608511d02bdf5a28e4bb9ee6
Instruction Fuzzy Hash: DC91C571E022969ADB208F76CC46EEE7BB5AF4D710F984659E802E7141DB3DDD40C760

Function 00824523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00824648
VariantInit.OLEAUT32(?), ref: 00824749
VariantClear.OLEAUT32(?), ref: 00824753
VariantClear.OLEAUT32(?), ref: 008247B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0082472C
Null Object assignment in FOR..IN loop, xrefs: 008245D8, 00824706, 008247BE

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: aac6a6031e128fa8c34ea064b09e070972a71bf5bacaea924c57f977ebe7ff00
Instruction ID: 739171343b2e689fe76c8bdef0bc19cfb926f61348f06cc6e81453ace7af2400
Opcode Fuzzy Hash: aac6a6031e128fa8c34ea064b09e070972a71bf5bacaea924c57f977ebe7ff00
Instruction Fuzzy Hash: C9917D71A00229AFDF20CFA4D848FAEBBB8FF46714F108559E515EB281D7749985CFA0

Function 00811187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0081125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00811284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 008112A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 008112D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0081135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 008113C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00811430

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 359d654564a942f32a38deed2b5d010ff8baa3f7c7c195813cfafc4dab55468f
Instruction ID: 84138e577e44cc395e71c6e7dae8bc8d11a3461130c0b943724fb37ef75c863d
Opcode Fuzzy Hash: 359d654564a942f32a38deed2b5d010ff8baa3f7c7c195813cfafc4dab55468f
Instruction Fuzzy Hash: 66910471A00219AFDF00DFA8D888BFEB7B9FF45714F104029E611E7291D778A981CB95

Function 007B948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: fcdea16d05b2616a92d055b7863041e78a214b731ebfae90d7caf2efc405784f
Instruction ID: e23db2b74c7a4db301654e839c118c8a9b0ccf79dfb76e1c6bd3e2c3f330b20a
Opcode Fuzzy Hash: fcdea16d05b2616a92d055b7863041e78a214b731ebfae90d7caf2efc405784f
Instruction Fuzzy Hash: A9914A71D40219EFCB14CFA9CC88AEEBBB8FF49320F148455E615B7291D378AA51CB60

Function 00823947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0082396B
CharUpperBuffW.USER32(?,?), ref: 00823A7A
_wcslen.LIBCMT ref: 00823A8A
VariantClear.OLEAUT32(?), ref: 00823C1F

Part of subcall function 00810CDF: VariantInit.OLEAUT32(00000000), ref: 00810D1F
Part of subcall function 00810CDF: VariantCopy.OLEAUT32(?,?), ref: 00810D28
Part of subcall function 00810CDF: VariantClear.OLEAUT32(?), ref: 00810D34

Strings

AUTOIT.ERROR, xrefs: 00823A80, 00823A85
Incorrect Parameter format, xrefs: 008239A6, 00823BA1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 61af4c63011a15d3ca0674fc5f32ba7c3f52f7fcc17e63a1aba8397fd0a32128
Instruction ID: b9e4416bdf05da23de84a36766e0de0e617fa225e8f87a05e64e2faf8d2b7934
Opcode Fuzzy Hash: 61af4c63011a15d3ca0674fc5f32ba7c3f52f7fcc17e63a1aba8397fd0a32128
Instruction Fuzzy Hash: 0C9155746083159FC704EF28D49496AB7E4FF89314F04892DF88A9B351DB39EE85CB92

Function 00824BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0080000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,007FFF41,80070057,?,?,?,0080035E), ref: 0080002B
Part of subcall function 0080000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007FFF41,80070057,?,?), ref: 00800046
Part of subcall function 0080000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007FFF41,80070057,?,?), ref: 00800054
Part of subcall function 0080000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007FFF41,80070057,?), ref: 00800064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00824C51
_wcslen.LIBCMT ref: 00824D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00824DCF
CoTaskMemFree.OLE32(?), ref: 00824DDA

Strings

NULL Pointer assignment, xrefs: 00824E23, 00824E52

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 6b83e8f2308cb69981196bf03caca950d3ed9043192e522c7ba7771c2b53b2ed
Instruction ID: 870375b96d64472a357c359e205d278628b43cb919ee225543d6770221d8cd27
Opcode Fuzzy Hash: 6b83e8f2308cb69981196bf03caca950d3ed9043192e522c7ba7771c2b53b2ed
Instruction Fuzzy Hash: F7911471D0022DEBDF10DFA4D890AEEB7B8FF48314F10866AE915A7241DB349A44CFA1

Function 008320FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00832183
GetMenuItemCount.USER32(00000000), ref: 008321B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 008321DD
_wcslen.LIBCMT ref: 00832213
GetMenuItemID.USER32(?,?), ref: 0083224D
GetSubMenu.USER32(?,?), ref: 0083225B

Part of subcall function 00803A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00803A57
Part of subcall function 00803A3D: GetCurrentThreadId.KERNEL32 ref: 00803A5E
Part of subcall function 00803A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,008025B3), ref: 00803A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 008322E3

Part of subcall function 0080E97B: Sleep.KERNEL32 ref: 0080E9F3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 8f4b9ee855d69aa5557923bf403f84ab7f46c20114c3669264c02f51a1cabe64
Instruction ID: acfec8db329e46f426134ec894382d0724afb68587cec2d23578cb7f4516496f
Opcode Fuzzy Hash: 8f4b9ee855d69aa5557923bf403f84ab7f46c20114c3669264c02f51a1cabe64
Instruction Fuzzy Hash: DD715B75A00215EFCB14EF68C885AAEB7F5FF89310F148459E916EB351DB34AE418B90

Function 00837E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01665A98), ref: 00837F37
IsWindowEnabled.USER32(01665A98), ref: 00837F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0083801E
SendMessageW.USER32(01665A98,000000B0,?,?), ref: 00838051
IsDlgButtonChecked.USER32(?,?), ref: 00838089
GetWindowLongW.USER32(01665A98,000000EC), ref: 008380AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 008380C3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 804dc2ba87fa712f320fc0d93f08359df0c03ad516471be11c1a30ad8539c34f
Instruction ID: 27abed56b3ae24d42f86f5fb8c729747c02bf8d3443d99172475ecdae1f83c88
Opcode Fuzzy Hash: 804dc2ba87fa712f320fc0d93f08359df0c03ad516471be11c1a30ad8539c34f
Instruction Fuzzy Hash: C8718AB4608608EFEB359F64C894FAABBB5FF89300F144459F945D72A1CB31E845DBA0

Function 0080AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0080AEF9
GetKeyboardState.USER32(?), ref: 0080AF0E
SetKeyboardState.USER32(?), ref: 0080AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0080AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0080AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0080AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0080B020

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2e2f739725e16a3930eda9d17dd8ef028fc75f6f1c655b55fdcabc9656cceede
Instruction ID: 2b115fe5d17615db853722a748269c90c2a52844084a69b9ec75a9393297faf5
Opcode Fuzzy Hash: 2e2f739725e16a3930eda9d17dd8ef028fc75f6f1c655b55fdcabc9656cceede
Instruction Fuzzy Hash: 6251D3A06047D63DFB7A8334CC45BBA7EE9BB06304F088489E1E9D54C2D799ACC4D762

Function 0080ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0080AD19
GetKeyboardState.USER32(?), ref: 0080AD2E
SetKeyboardState.USER32(?), ref: 0080AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0080ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0080ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0080AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0080AE38

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 08d14b72b843b5d81bb710b343623f4e081c36534408da981cfdfb7db27ea6f3
Instruction ID: a4004f715d9df54cff08ae427876ce28172e7510c88325542f26e5bfd046d4e8
Opcode Fuzzy Hash: 08d14b72b843b5d81bb710b343623f4e081c36534408da981cfdfb7db27ea6f3
Instruction Fuzzy Hash: E751D5A15047D53DFB7B8374CC95B7A7EA9FB46300F088489E1D5D68C2D294EC88D752

Function 007D542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(007E3CD6,?,?,?,?,?,?,?,?,007D5BA3,?,?,007E3CD6,?,?), ref: 007D5470
__fassign.LIBCMT ref: 007D54EB
__fassign.LIBCMT ref: 007D5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,007E3CD6,00000005,00000000,00000000), ref: 007D552C
WriteFile.KERNEL32(?,007E3CD6,00000000,007D5BA3,00000000,?,?,?,?,?,?,?,?,?,007D5BA3,?), ref: 007D554B
WriteFile.KERNEL32(?,?,00000001,007D5BA3,00000000,?,?,?,?,?,?,?,?,?,007D5BA3,?), ref: 007D5584

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 9ef8a68ab36628d1e7f0dc21c3fbcca445d5ddae7b6e62e4be6ffe9a75a44500
Instruction ID: a4094b6cf0f50e6a470f28ba7bd10bd30ddc81a8383bcf7f353eda2dd4887ec9
Opcode Fuzzy Hash: 9ef8a68ab36628d1e7f0dc21c3fbcca445d5ddae7b6e62e4be6ffe9a75a44500
Instruction Fuzzy Hash: DE51B3709006499FDB11CFA8D845AEEBBFAFF08300F14451BE556E7391E634DA51CB61

Function 008210B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0082304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0082307A
Part of subcall function 0082304E: _wcslen.LIBCMT ref: 0082309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00821112
WSAGetLastError.WSOCK32 ref: 00821121
WSAGetLastError.WSOCK32 ref: 008211C9
closesocket.WSOCK32(00000000), ref: 008211F9

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 19209a5f50c1170b226172cedf0be34d7093551af1880e1ae048bac12acd0911
Instruction ID: 7547b87c66ee56dfc0e31d036d5c74c27bb23ad16393e929f61d9465e74c68c1
Opcode Fuzzy Hash: 19209a5f50c1170b226172cedf0be34d7093551af1880e1ae048bac12acd0911
Instruction Fuzzy Hash: 7041E731600214AFDB109F24D889BA9B7E9FF85324F248159FD15EB291C774EE91CBE1

Function 0080CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0080CF22,?), ref: 0080DDFD

Part of subcall function 0080DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0080CF22,?), ref: 0080DE16

lstrcmpiW.KERNEL32(?,?), ref: 0080CF45
MoveFileW.KERNEL32(?,?), ref: 0080CF7F
_wcslen.LIBCMT ref: 0080D005
_wcslen.LIBCMT ref: 0080D01B
SHFileOperationW.SHELL32(?), ref: 0080D061

Strings

\*.*, xrefs: 0080CFF3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: ee85ac24d15b07e05cd6e0268a3a30c233a2b14c0b11302f79368975dfa7d7e6
Instruction ID: a9734901a579ce628c9392159c04c44473d0a94616f55b589aaeb069608bd93e
Opcode Fuzzy Hash: ee85ac24d15b07e05cd6e0268a3a30c233a2b14c0b11302f79368975dfa7d7e6
Instruction Fuzzy Hash: 714143B19052199EDF52EFA4DD85ADEB7B8FF48380F0004EAA505EB181EE74A684CB51

Function 00832DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00832E1C
GetWindowLongW.USER32(?,000000F0), ref: 00832E4F
GetWindowLongW.USER32(?,000000F0), ref: 00832E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00832EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00832EE0
GetWindowLongW.USER32(?,000000F0), ref: 00832EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00832F0B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: ee7844aa0164f0e444af11a24956e57c0ead778871659083ecc765ef76e77fed
Instruction ID: 987cbd947d8b764dcd8b02a6b62da6e8d25ab08c336f468b0ef2090075866450
Opcode Fuzzy Hash: ee7844aa0164f0e444af11a24956e57c0ead778871659083ecc765ef76e77fed
Instruction Fuzzy Hash: E6311331604250AFDB20CF58DC8AF653BE0FB9AB10F1401A4FA05DB2B2CB75E880DB81

Function 00807726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00807769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0080778F
SysAllocString.OLEAUT32(00000000), ref: 00807792
SysAllocString.OLEAUT32(?), ref: 008077B0
SysFreeString.OLEAUT32(?), ref: 008077B9
StringFromGUID2.OLE32(?,?,00000028), ref: 008077DE
SysAllocString.OLEAUT32(?), ref: 008077EC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c00d5aeee99d72cff60f439758748ac1ff2422f857e52295c3868c008a41361f
Instruction ID: be3eb57e5ff123ad66b8c585fbf3dd6d177a1d6ed0303d133d9852804afed4ee
Opcode Fuzzy Hash: c00d5aeee99d72cff60f439758748ac1ff2422f857e52295c3868c008a41361f
Instruction Fuzzy Hash: 4E21D376A0421DAFDF50DFA8CC88DBB73ACFB497A47008425FA14DB190D674EC418764

Function 008077FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00807842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00807868
SysAllocString.OLEAUT32(00000000), ref: 0080786B
SysAllocString.OLEAUT32 ref: 0080788C
SysFreeString.OLEAUT32 ref: 00807895
StringFromGUID2.OLE32(?,?,00000028), ref: 008078AF
SysAllocString.OLEAUT32(?), ref: 008078BD

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c8d991b015a53ecf56d5bd40774a79e10ee3559f9c57232bc76f702d8411e8be
Instruction ID: e355e72464fa20b5a89b998b10bc1eeddb13f0c8590fe5d87135ac0fb948590b
Opcode Fuzzy Hash: c8d991b015a53ecf56d5bd40774a79e10ee3559f9c57232bc76f702d8411e8be
Instruction Fuzzy Hash: 81216032A08208AFDB509FA8DC8CDAA77ACFB497607108535F915DB2A1D674EC41CB68

Function 008104D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 008104F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0081052E

Strings

nul, xrefs: 00810567

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: b79a2bde181b55be7c786a36fd9733f66ad9b6fb2bc2d4ec1ce517c3b6eaa376
Instruction ID: d6c3dd7102021112bc0f7f4fa2d6e18b8e67e0839aa644c9e6c155d54281204a
Opcode Fuzzy Hash: b79a2bde181b55be7c786a36fd9733f66ad9b6fb2bc2d4ec1ce517c3b6eaa376
Instruction Fuzzy Hash: 162130B5500305ABDB209F69DC44ADA77A9FF84764F204A19F8A1F62E0D7B099D0CF20

Function 008105A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 008105C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00810601

Strings

nul, xrefs: 00810639

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 4cc79ef03e3f2785863e14313be28aed738bbcd520793e484b36425084050fa9
Instruction ID: e756cca94d314e203b5a5bd9fc17565e4bd04a9b654b858492924fb8ad1c4e09
Opcode Fuzzy Hash: 4cc79ef03e3f2785863e14313be28aed738bbcd520793e484b36425084050fa9
Instruction Fuzzy Hash: DB214C755003059BDB209F699C44ADAB7A8FFA5725F204A19F8A1E72E0D7F099E0CF60

Function 008340AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 007A604C
Part of subcall function 007A600E: GetStockObject.GDI32(00000011), ref: 007A6060
Part of subcall function 007A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 007A606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00834112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0083411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0083412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00834139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00834145

Strings

Msctls_Progress32, xrefs: 008340E3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: d1b205d11027e60c0a9587cd330f5526eb7e7c5790da2d30eea84b629000109f
Instruction ID: 325b188b18249026e56716742494df1d5f21395dbe750a99328115d10408886b
Opcode Fuzzy Hash: d1b205d11027e60c0a9587cd330f5526eb7e7c5790da2d30eea84b629000109f
Instruction Fuzzy Hash: BB1190B214021DBEEF119E64CC86EEB7F5DFF48798F014111FA18E2150CA769C619BA4

Function 007DD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007DD7A3: _free.LIBCMT ref: 007DD7CC

_free.LIBCMT ref: 007DD82D

Part of subcall function 007D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000), ref: 007D29DE
Part of subcall function 007D29C8: GetLastError.KERNEL32(00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000,00000000), ref: 007D29F0

_free.LIBCMT ref: 007DD838
_free.LIBCMT ref: 007DD843
_free.LIBCMT ref: 007DD897
_free.LIBCMT ref: 007DD8A2
_free.LIBCMT ref: 007DD8AD
_free.LIBCMT ref: 007DD8B8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 45dd03a3070bf1d25da9a48f94ab2df56e680a3ceae9815c1f62b3f06e54b0bb
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: A1114F71540B04EAD531BFB0CD4BFCB7BFC6F10710F400826B29DA62A3DA69B9065A50

Function 0080DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0080DA74
LoadStringW.USER32(00000000), ref: 0080DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0080DA91
LoadStringW.USER32(00000000), ref: 0080DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0080DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0080DAB9

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 6f7c33d9cf6270760a57609e7e93d1f0a8af1d188febd3f0565a86370ad7dafa
Instruction ID: 2251dade7f1ef3002a253d6c9e3a27466a18ced9095f5a00226a6b5d79595b9e
Opcode Fuzzy Hash: 6f7c33d9cf6270760a57609e7e93d1f0a8af1d188febd3f0565a86370ad7dafa
Instruction Fuzzy Hash: 68016DF29002187FE750ABE49D89EEB376CFB08301F400896B746F2081EA749E848F74

Function 0081096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0165FB18,0165FB18), ref: 0081097B
EnterCriticalSection.KERNEL32(0165FAF8,00000000), ref: 0081098D
TerminateThread.KERNEL32(?,000001F6), ref: 0081099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 008109A9
CloseHandle.KERNEL32(?), ref: 008109B8
InterlockedExchange.KERNEL32(0165FB18,000001F6), ref: 008109C8
LeaveCriticalSection.KERNEL32(0165FAF8), ref: 008109CF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 6a46b8a9a61d750eb7fedc2c9efedf16621641f8cb8674d393004aec42d2801b
Instruction ID: 8e4b7ab81b4e8888cac90e4ffd7a1e6e56522231de2a1e4f8b66339f911ac669
Opcode Fuzzy Hash: 6a46b8a9a61d750eb7fedc2c9efedf16621641f8cb8674d393004aec42d2801b
Instruction Fuzzy Hash: 3FF0EC32442A12BBD7515FA4EE8DBDABB39FF45702F402425F202A08A1C7B594B5CF90

Function 00821C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00821DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00821DE1
WSAGetLastError.WSOCK32 ref: 00821DF2
htons.WSOCK32(?,?,?,?,?), ref: 00821EDB
inet_ntoa.WSOCK32(?), ref: 00821E8C

Part of subcall function 008039E8: _strlen.LIBCMT ref: 008039F2

Part of subcall function 00823224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0081EC0C), ref: 00823240

_strlen.LIBCMT ref: 00821F35

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 8ac6860c3a437bc96b3b87fdf0aa9b180d56a3e92628acc5887f2aa6b7f02d67
Instruction ID: f89d79dfefbdd960b48ce520950231dc3ee48712ab28f2135722908d30186b58
Opcode Fuzzy Hash: 8ac6860c3a437bc96b3b87fdf0aa9b180d56a3e92628acc5887f2aa6b7f02d67
Instruction Fuzzy Hash: DFB1E130204350AFC724DF24D899E2A77A5FF95318F64895CF4569B2E2CB35ED81CB91

Function 007A5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 007A5D30
GetWindowRect.USER32(?,?), ref: 007A5D71
ScreenToClient.USER32(?,?), ref: 007A5D99
GetClientRect.USER32(?,?), ref: 007A5ED7
GetWindowRect.USER32(?,?), ref: 007A5EF8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: df16d84e95a06471707221717d1e95054e8171b9ac97a4829cf86d3e56308480
Instruction ID: 10d8ccae31675e5f8e202928fbc2b249d7f6020e59211747b4011886a631bcc8
Opcode Fuzzy Hash: df16d84e95a06471707221717d1e95054e8171b9ac97a4829cf86d3e56308480
Instruction Fuzzy Hash: 8DB17C35A00B8ADBDB10CFA9C4807EEB7F1FF98310F14851AE8A9D7250D738AA51DB54

Function 007D01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 007D00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007D00D6
__allrem.LIBCMT ref: 007D00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007D010B
__allrem.LIBCMT ref: 007D0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007D0140

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 4abee1df2578fd968a1b34b508917c88a957bac463f66e830455b140ed3263bf
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 1B81E276A01706EBE720AA29CC46B6E73B9EF45324F24413FF551D7781E779D9008B90

Function 007D61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,007C82D9,007C82D9,?,?,?,007D644F,00000001,00000001,8BE85006), ref: 007D6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,007D644F,00000001,00000001,8BE85006,?,?,?), ref: 007D62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 007D63D8
__freea.LIBCMT ref: 007D63E5

Part of subcall function 007D3820: RtlAllocateHeap.NTDLL(00000000,?,00871444,?,007BFDF5,?,?,007AA976,00000010,00871440,007A13FC,?,007A13C6,?,007A1129), ref: 007D3852

__freea.LIBCMT ref: 007D63EE
__freea.LIBCMT ref: 007D6413

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 52111cf8ec213f2993e412135e49e3c1d8508a4710f1dcd4147210ece307961d
Instruction ID: 9de30fa57db12d1e7ea8234419b2b8a9b97e79f14e1405a1929ebba20e64a609
Opcode Fuzzy Hash: 52111cf8ec213f2993e412135e49e3c1d8508a4710f1dcd4147210ece307961d
Instruction Fuzzy Hash: 5651E172A00216ABEB258F64DC85EBF77BAEF44710F15462AFC05D6241EB3CDC54D6A0

Function 0082BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 0082C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0082B6AE,?,?), ref: 0082C9B5
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082C9F1
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082CA68
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0082BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0082BD25
RegCloseKey.ADVAPI32(00000000), ref: 0082BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0082BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0082BDF3
RegCloseKey.ADVAPI32(?), ref: 0082BDFF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 385f9257d1a8e5bdbc629252c50f7d29d393d685a28658d09538dcac90dda3dd
Instruction ID: de8954c7e2c4409fc3b9fc10225e253051d3dc34c2538332004acecbb2576750
Opcode Fuzzy Hash: 385f9257d1a8e5bdbc629252c50f7d29d393d685a28658d09538dcac90dda3dd
Instruction Fuzzy Hash: E181DF30208241EFC714DF24C895E6ABBE5FF85308F14896CF5598B2A2DB35ED85CB92

Function 007FF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 007FF7B9
SysAllocString.OLEAUT32(00000001), ref: 007FF860
VariantCopy.OLEAUT32(007FFA64,00000000), ref: 007FF889
VariantClear.OLEAUT32(007FFA64), ref: 007FF8AD
VariantCopy.OLEAUT32(007FFA64,00000000), ref: 007FF8B1
VariantClear.OLEAUT32(?), ref: 007FF8BB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 812d0e10e25eeac2eafe30c9ef3d2ec6697b69e9cb21b282cddaa97307ebab7f
Instruction ID: c89509c3081b02e831b34e781956c147ba6665ae102c0f605c1d313bba51dd46
Opcode Fuzzy Hash: 812d0e10e25eeac2eafe30c9ef3d2ec6697b69e9cb21b282cddaa97307ebab7f
Instruction Fuzzy Hash: 1551E731601318FACF20AB65D899B39B3A8EF45710F249467EA05DF392DFB89C40D766

Function 0081910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 007A7620: _wcslen.LIBCMT ref: 007A7625

Part of subcall function 007A6B57: _wcslen.LIBCMT ref: 007A6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 008194E5
_wcslen.LIBCMT ref: 00819506
_wcslen.LIBCMT ref: 0081952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00819585

Strings

X, xrefs: 00819412

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: ca3c543647da4c99532b36c8ec9dfdbdffaee0d632dd9a37efe08e996552092b
Instruction ID: 81c66dbf0c58738822d5891f9257ab8442bc1558ed88784863fafc36e9288541
Opcode Fuzzy Hash: ca3c543647da4c99532b36c8ec9dfdbdffaee0d632dd9a37efe08e996552092b
Instruction Fuzzy Hash: A8E1AF31908300DFC724DF24C895AAAB7E5FF85314F048A6DF9999B2A2DB34DD45CB92

Function 007B920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 007B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007B9BB2

BeginPaint.USER32(?,?,?), ref: 007B9241
GetWindowRect.USER32(?,?), ref: 007B92A5
ScreenToClient.USER32(?,?), ref: 007B92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 007B92D3
EndPaint.USER32(?,?,?,?,?), ref: 007B9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 007F71EA

Part of subcall function 007B9339: BeginPath.GDI32(00000000), ref: 007B9357

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 3d6f6385d2c151042d4028804e6c3782c3dde4ce14253148ad688a10d7573fa5
Instruction ID: 382656250f59cf965a1f90ac33e9df0089aba252cb52cb7f6e821714d4771f94
Opcode Fuzzy Hash: 3d6f6385d2c151042d4028804e6c3782c3dde4ce14253148ad688a10d7573fa5
Instruction Fuzzy Hash: 03418E71104204EFDB11DF28CC89FBA7BA8FB96324F140629FB64972A1C7359845DB61

Function 008107EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0081080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00810847
EnterCriticalSection.KERNEL32(?), ref: 00810863
LeaveCriticalSection.KERNEL32(?), ref: 008108DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 008108F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00810921

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 5cf1ff5b71a3f48eb671b16c85132af7bc2dd8f437609c3bfa84bdc4724f22e7
Instruction ID: 1bb35df4c4ac10efb3c275f0f99fa06fc4b7978845dab8a6373fbdc91f3c49a5
Opcode Fuzzy Hash: 5cf1ff5b71a3f48eb671b16c85132af7bc2dd8f437609c3bfa84bdc4724f22e7
Instruction Fuzzy Hash: D0418971900205EBDF14AF64DC85AAA77B9FF44700F1040A9ED04EA297DB74DEA0DBA0

Function 008381DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,007FF3AB,00000000,?,?,00000000,?,007F682C,00000004,00000000,00000000), ref: 0083824C
EnableWindow.USER32(?,00000000), ref: 00838272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 008382D1
ShowWindow.USER32(?,00000004), ref: 008382E5
EnableWindow.USER32(?,00000001), ref: 0083830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0083832F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 87203d29b64d7d42c8c550f89da1bf92acff0633e75193dd043023683a1f5b6b
Instruction ID: acb6df54d5cdfcd7ca800ee178068024a946ff67c0e485b8e2960c4f6c528c7e
Opcode Fuzzy Hash: 87203d29b64d7d42c8c550f89da1bf92acff0633e75193dd043023683a1f5b6b
Instruction Fuzzy Hash: 11416434601744EFDF15DF29DC99BE57BE1FB8A714F184169FA089B262CB31A881CB90

Function 00804C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00804C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00804CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00804CEA
_wcslen.LIBCMT ref: 00804D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00804D10
_wcsstr.LIBVCRUNTIME ref: 00804D1A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: ab84fd8be472b014218a06a0ffd32160893d5d01e84f3ee5371012fce6886503
Instruction ID: 8e6ae13ad832bc1d676246beada8a7997340f1e3d25e43242865c1b63020f067
Opcode Fuzzy Hash: ab84fd8be472b014218a06a0ffd32160893d5d01e84f3ee5371012fce6886503
Instruction Fuzzy Hash: 232104B2244204BBFB955B39AC0AE7B7B9CEF85750F10906DFD05DA192EA75DD0087A0

Function 0081581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 007A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007A3A97,?,?,007A2E7F,?,?,?,00000000), ref: 007A3AC2

_wcslen.LIBCMT ref: 0081587B
CoInitialize.OLE32(00000000), ref: 00815995
CoCreateInstance.OLE32(0083FCF8,00000000,00000001,0083FB68,?), ref: 008159AE
CoUninitialize.OLE32 ref: 008159CC

Strings

.lnk, xrefs: 00815876, 008158C1, 00815985

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 05e7103f3281d9a013843a331c1c74db7b7dcd261ababf0f1bb58e80240b0ae4
Instruction ID: 9487cae8cd6fcd525480c749a93e1451c096559609d55b20c081309e9e9fb0e1
Opcode Fuzzy Hash: 05e7103f3281d9a013843a331c1c74db7b7dcd261ababf0f1bb58e80240b0ae4
Instruction Fuzzy Hash: F1D15271608601DFC714DF24C484A6ABBE9FFC9720F148959F889DB261D735EC85CB92

Function 0080175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00800FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00800FCA
Part of subcall function 00800FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00800FD6
Part of subcall function 00800FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00800FE5
Part of subcall function 00800FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00800FEC
Part of subcall function 00800FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00801002

GetLengthSid.ADVAPI32(?,00000000,00801335), ref: 008017AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 008017BA
HeapAlloc.KERNEL32(00000000), ref: 008017C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 008017DA
GetProcessHeap.KERNEL32(00000000,00000000,00801335), ref: 008017EE
HeapFree.KERNEL32(00000000), ref: 008017F5

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: af72d61e8cdbb11f4d0049b1e2f204ca042127ee605bc89f244fbfe0537c3a94
Instruction ID: bdf6775a210d06788dcefe95b688043213cbc438e311c03c2c88118783ecbb7d
Opcode Fuzzy Hash: af72d61e8cdbb11f4d0049b1e2f204ca042127ee605bc89f244fbfe0537c3a94
Instruction Fuzzy Hash: 7A11BB32600205FFDF649FA4CC49BAE7BE9FB86369F104418F481E7294C736A940DB60

Function 008014CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 008014FF
OpenProcessToken.ADVAPI32(00000000), ref: 00801506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00801515
CloseHandle.KERNEL32(00000004), ref: 00801520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0080154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00801563

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 4c716cde0995a99957c519f90219bd410a966112b8b2086f83f7a1f2d2d7e672
Instruction ID: 0d61c255e2d4dfc2ab9ebe18e1352594a75128241aee30190ef3040ef162cdfd
Opcode Fuzzy Hash: 4c716cde0995a99957c519f90219bd410a966112b8b2086f83f7a1f2d2d7e672
Instruction Fuzzy Hash: 0611267250024DABDF118FA8DD49BDE7BAAFF89758F044425FA05A21A0C3758E64DB60

Function 007C3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,007C3379,007C2FE5), ref: 007C3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 007C339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 007C33B7
SetLastError.KERNEL32(00000000,?,007C3379,007C2FE5), ref: 007C3409

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 28d41056f94feffc4395ac2f045354e233dae1d02985049f2cf7c9466935a0b7
Instruction ID: 9cfbb05d97247b2b505fae92b8a5cfe20f6eebb92a37e078c8b113982ddd7579
Opcode Fuzzy Hash: 28d41056f94feffc4395ac2f045354e233dae1d02985049f2cf7c9466935a0b7
Instruction Fuzzy Hash: E601243220C751FEAA2427747C9AF762B94FB05379320832EF410952F0EF5D4E025284

Function 007D2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,007D5686,007E3CD6,?,00000000,?,007D5B6A,?,?,?,?,?,007CE6D1,?,00868A48), ref: 007D2D78
_free.LIBCMT ref: 007D2DAB
_free.LIBCMT ref: 007D2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,007CE6D1,?,00868A48,00000010,007A4F4A,?,?,00000000,007E3CD6), ref: 007D2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,007CE6D1,?,00868A48,00000010,007A4F4A,?,?,00000000,007E3CD6), ref: 007D2DEC
_abort.LIBCMT ref: 007D2DF2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6e54438777f017d50009677a082c680ecab1a9a29ed88d63a3408b97a7a5223a
Instruction ID: 6e6dcd9a23410cf999472ebc43e134d35a052d1b6d563b5484eee420605df832
Opcode Fuzzy Hash: 6e54438777f017d50009677a082c680ecab1a9a29ed88d63a3408b97a7a5223a
Instruction Fuzzy Hash: AEF0A931604600B7C6123734AC0EA1A3576BBE27A5F25451BF464A23A3EE6C98035271

Function 00838A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 007B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007B9693
Part of subcall function 007B9639: SelectObject.GDI32(?,00000000), ref: 007B96A2
Part of subcall function 007B9639: BeginPath.GDI32(?), ref: 007B96B9
Part of subcall function 007B9639: SelectObject.GDI32(?,00000000), ref: 007B96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00838A4E
LineTo.GDI32(?,00000003,00000000), ref: 00838A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00838A70
LineTo.GDI32(?,00000000,00000003), ref: 00838A80
EndPath.GDI32(?), ref: 00838A90
StrokePath.GDI32(?), ref: 00838AA0

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 48b161383a4e7eab1bbb883c799f1861bc709bbc8b85a829476cc87a494afea5
Instruction ID: 5f98d0207da1ead85dcbf158abcc1eaa56139e401827b1ca7aac0c74fabdadf0
Opcode Fuzzy Hash: 48b161383a4e7eab1bbb883c799f1861bc709bbc8b85a829476cc87a494afea5
Instruction Fuzzy Hash: EA11F776000158FFDF129F94DC88EAA7F6CFB08354F008412FA19AA1A1C7719D55DBA0

Function 008051FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00805218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00805229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00805230
ReleaseDC.USER32(00000000,00000000), ref: 00805238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0080524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00805261

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 3feaab659c5d5ffd8aeae51216c2a1368908c396262ad9595ab002c9be389dcf
Instruction ID: 86eb355d5ab0ab89fdffc019a363123d4250bb2ec19687251fb25828a5b15af4
Opcode Fuzzy Hash: 3feaab659c5d5ffd8aeae51216c2a1368908c396262ad9595ab002c9be389dcf
Instruction Fuzzy Hash: 64014F75A00718BBEF109BA69C49A5EBFB8FF88751F044465FA04E7291D6709800CFA0

Function 007A1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 007A1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 007A1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 007A1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 007A1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 007A1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 007A1C22

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 345635db4341ddf5c63e5bbd7990e3d297cc1101403088ae07f6c8fa26f2d71e
Instruction ID: ffdb68945ce01a152462c43aee106d79db28b55f78d9822d2f0f3ad426037925
Opcode Fuzzy Hash: 345635db4341ddf5c63e5bbd7990e3d297cc1101403088ae07f6c8fa26f2d71e
Instruction Fuzzy Hash: 9B0167B0902B5ABDE3008F6A8C85B52FFA8FF59354F00411BA15C4BA42C7F5A864CBE5

Function 0080EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0080EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0080EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0080EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0080EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0080EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0080EB75

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: d6d3886e3a5cbecd2b3674aecff19385de1302118eb18363bda499dd1bba198f
Instruction ID: 1ae00eb1e29835c95688627816f4ab6f6b487d296829faaa76b7e0c1b1810533
Opcode Fuzzy Hash: d6d3886e3a5cbecd2b3674aecff19385de1302118eb18363bda499dd1bba198f
Instruction Fuzzy Hash: ABF03A72240158BBE7215B629C0EEEF7A7CFFCAB11F004559F602E1191E7A45A01D7B5

Function 007F7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 007F7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 007F7469
GetWindowDC.USER32(?), ref: 007F7475
GetPixel.GDI32(00000000,?,?), ref: 007F7484
ReleaseDC.USER32(?,00000000), ref: 007F7496
GetSysColor.USER32(00000005), ref: 007F74B0

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 66d954733ebeefc0fc2ad8ed17754d2d034a951b6cf54d90077496382ff0e28d
Instruction ID: e22a5638b45674cb4eb55c7aa300f210c5a7577d6d56fd60239b8ca533543ab3
Opcode Fuzzy Hash: 66d954733ebeefc0fc2ad8ed17754d2d034a951b6cf54d90077496382ff0e28d
Instruction Fuzzy Hash: 5901AD31400209EFEB505FA8DC09BFE7BB5FF44311F100864FA15A21A0CB351E51EB10

Function 00801874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0080187F
UnloadUserProfile.USERENV(?,?), ref: 0080188B
CloseHandle.KERNEL32(?), ref: 00801894
CloseHandle.KERNEL32(?), ref: 0080189C
GetProcessHeap.KERNEL32(00000000,?), ref: 008018A5
HeapFree.KERNEL32(00000000), ref: 008018AC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: f6001ad1629c1b63fdc0e48cff98467dd3f3a1090d4e0bd0d265df9a4e346764
Instruction ID: d62cd01d4cb269d74515ddd1752ae8e9eef94144965ec90db2d66cd48abe7a17
Opcode Fuzzy Hash: f6001ad1629c1b63fdc0e48cff98467dd3f3a1090d4e0bd0d265df9a4e346764
Instruction Fuzzy Hash: 46E0E536004101BBDB016FA5ED0C90AFF39FF89B22B108A20F225A1170CB369430EF50

Function 0080C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A7620: _wcslen.LIBCMT ref: 007A7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0080C6EE
_wcslen.LIBCMT ref: 0080C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0080C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0080C7CA

Strings

0, xrefs: 0080C6AF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 9b276e122d41ac266d53588aa6076cdf2dfe7d8eb94edf3f16c1fb4679740b11
Instruction ID: 766c359cb74142add73c1dba78a1a447d8a8b52bf7c9dc006fe79186229cab23
Opcode Fuzzy Hash: 9b276e122d41ac266d53588aa6076cdf2dfe7d8eb94edf3f16c1fb4679740b11
Instruction Fuzzy Hash: 4251BD716143019BD7A59F2CCC89BAAB7E8FF99314F040B2DF9A5E21E0DB74D9048B52

Function 0082AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0082AEA3

Part of subcall function 007A7620: _wcslen.LIBCMT ref: 007A7625

GetProcessId.KERNEL32(00000000), ref: 0082AF38
CloseHandle.KERNEL32(00000000), ref: 0082AF67

Strings

<, xrefs: 0082AE6B
@, xrefs: 0082AE72

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 96f25cb401792eb5477985b74d3dbbf12895b95fd47133c66496d3a0f04f6667
Instruction ID: d966f605f477b1a24fe5b9c7b52c99e058051d69c0cf7ae35b7b5a063e01d26c
Opcode Fuzzy Hash: 96f25cb401792eb5477985b74d3dbbf12895b95fd47133c66496d3a0f04f6667
Instruction Fuzzy Hash: D771B175A00629DFCB18DF54D484A9EBBF0FF49300F048499E816AB352CB78ED85CB91

Function 0080719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00807206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0080723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0080724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 008072CF

Strings

DllGetClassObject, xrefs: 00807242

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 97c90204f230a8c1f7f85366674b4b4abbbc3bbd869501f53a233bb0b0cfda9b
Instruction ID: 05cb0782172766e811a42a05daf21ba2da1c973cfb256db1aaca219d5e1bbc89
Opcode Fuzzy Hash: 97c90204f230a8c1f7f85366674b4b4abbbc3bbd869501f53a233bb0b0cfda9b
Instruction Fuzzy Hash: 04417EB1A04204EFDB55CF54CC84A9A7BA9FF84314F1584A9BD06DF28AD7B0ED44DBA0

Function 00833D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00833E35
IsMenu.USER32(?), ref: 00833E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00833E92
DrawMenuBar.USER32 ref: 00833EA5

Strings

0, xrefs: 00833D89

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: d94ebdd53ee6d89e68c1763dbbcb713e704a8dad57446063c40c4a0138327f65
Instruction ID: 1dcb63ff0311f5dc6d767dd508c737674c07e85293de83ba64204c229e32ae2c
Opcode Fuzzy Hash: d94ebdd53ee6d89e68c1763dbbcb713e704a8dad57446063c40c4a0138327f65
Instruction Fuzzy Hash: 33414575A01209EFDB10DF64D884EAABBB9FF89354F044229E905EB650D734EE45CFA0

Function 00801DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 00803CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00803CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00801E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00801E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00801EA9

Part of subcall function 007A6B57: _wcslen.LIBCMT ref: 007A6B6A

Strings

ListBox, xrefs: 00801E25
ComboBox, xrefs: 00801DF0

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 2ca2a09dfe98078fea192b2842b9f00528e030b1784d1cabe17e1bf6b2a857cd
Instruction ID: e156a70cb70d66ca1c872c30918d7887e77754303ad3429030910ac92fc02abc
Opcode Fuzzy Hash: 2ca2a09dfe98078fea192b2842b9f00528e030b1784d1cabe17e1bf6b2a857cd
Instruction Fuzzy Hash: ED21E571A00104BBDB54AB64DC4ECFFB7B9FF96364B144519F825E72E1DB38490A8620

Function 00832F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00832F8D
LoadLibraryW.KERNEL32(?), ref: 00832F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00832FA9
DestroyWindow.USER32(?), ref: 00832FB1

Strings

SysAnimate32, xrefs: 00832F68

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 2d7de60eea84899c3878fafef4f8c2fe4288aa4db30a78496f0a2839cdd74fd5
Instruction ID: 9ef1c976f38ca529751fe8bb83ccdb42ffc7c86cc373545b4c86953294800093
Opcode Fuzzy Hash: 2d7de60eea84899c3878fafef4f8c2fe4288aa4db30a78496f0a2839cdd74fd5
Instruction Fuzzy Hash: 05219D72204209ABEF205F64DC85EBB77BDFF99368F104628FA50E6190DB71DC9197A0

Function 007C4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,007C4D1E,007D28E9,?,007C4CBE,007D28E9,008688B8,0000000C,007C4E15,007D28E9,00000002), ref: 007C4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007C4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,007C4D1E,007D28E9,?,007C4CBE,007D28E9,008688B8,0000000C,007C4E15,007D28E9,00000002,00000000), ref: 007C4DC3

Strings

CorExitProcess, xrefs: 007C4D98
mscoree.dll, xrefs: 007C4D86

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5efdea2e16f430a738c38034ad516072212c4d86a547282bb72bc9e0974e5c57
Instruction ID: c7f9903547871f4d7bc02ca013d3f8301015eb93470a9aa851b924fb36853417
Opcode Fuzzy Hash: 5efdea2e16f430a738c38034ad516072212c4d86a547282bb72bc9e0974e5c57
Instruction Fuzzy Hash: 1FF03C35A40208BBDB119B90DC49BAEBBA5FF44751F0001A8EA06A2260CB795A40DBD1

Function 007A4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,007A4EDD,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 007A4EAE
FreeLibrary.KERNEL32(00000000,?,?,007A4EDD,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 007A4EA8
kernel32.dll, xrefs: 007A4E94

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 0d5b9176ba1648aebb1d865f023d4fd916e03eabcaaacc159a5b24139dc208ae
Instruction ID: d7072bf49dfc91c105e57c59bcbab785c62cfe78ff411c510e4d280d2f3ca0e1
Opcode Fuzzy Hash: 0d5b9176ba1648aebb1d865f023d4fd916e03eabcaaacc159a5b24139dc208ae
Instruction Fuzzy Hash: 46E08C36A066226B92321B25AC18A6FB658BFC2B62B050615FC01F2200DBA8CD0292E0

Function 007A4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,007E3CDE,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 007A4E74
FreeLibrary.KERNEL32(00000000,?,?,007E3CDE,?,00871418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 007A4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 007A4E6E
kernel32.dll, xrefs: 007A4E5B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 06848e507dc481ca2601bbc5bc70cb373b0ae8a66a750668265fa1018c21267b
Instruction ID: 1b8be9ccf0a25c5eb2192fba415c7075c0e1e41069761a56e880d67813a86501
Opcode Fuzzy Hash: 06848e507dc481ca2601bbc5bc70cb373b0ae8a66a750668265fa1018c21267b
Instruction Fuzzy Hash: 0FD012365066615756221B257C1CD8F7A58FFC6B623050A15B905F2254CFA9CD0196D0

Function 00812947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00812C05
DeleteFileW.KERNEL32(?), ref: 00812C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00812C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00812CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00812CC0

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: b4e051d5db889cede6c2fc4fde5b9886dc3eefab4c10a3811f8d643335bcaaae
Instruction ID: 6886eb6059ef5dcfd3689c2b4990ad2d5c9eea90ee1ca68dbebb671737e12391
Opcode Fuzzy Hash: b4e051d5db889cede6c2fc4fde5b9886dc3eefab4c10a3811f8d643335bcaaae
Instruction Fuzzy Hash: 95B14E7290011DEBDF21DBA4CC89EDEB77DFF49350F1040AAF609E6141EA349A948FA1

Function 0082A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0082A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0082A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0082A468
CloseHandle.KERNEL32(?), ref: 0082A63D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 915b4f413ea137906ebe9a0477e233d72e99428cacd574da6d4024ea0c63178f
Instruction ID: d235fdfa4a2fa6fb77b97e5a4a082652216314fcc30a801c3d95f7cc1deac065
Opcode Fuzzy Hash: 915b4f413ea137906ebe9a0477e233d72e99428cacd574da6d4024ea0c63178f
Instruction Fuzzy Hash: 7BA19D71604300AFD724DF24D886F2AB7E5EF84714F18891DF99ADB292D7B4EC418B82

Function 007DBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00843700), ref: 007DBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0087121C,000000FF,00000000,0000003F,00000000,?,?), ref: 007DBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00871270,000000FF,?,0000003F,00000000,?), ref: 007DBC36
_free.LIBCMT ref: 007DBB7F

Part of subcall function 007D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000), ref: 007D29DE
Part of subcall function 007D29C8: GetLastError.KERNEL32(00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000,00000000), ref: 007D29F0

_free.LIBCMT ref: 007DBD4B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: a85e7d9a9a60f23c22c8c63e136c6f54bdd94109ceece8b6a5fbad75fce9f5fb
Instruction ID: b2b4a1d45204533ea2e63c6b2ebc8c97af88f71c45f8fc908a3066e32a0c0611
Opcode Fuzzy Hash: a85e7d9a9a60f23c22c8c63e136c6f54bdd94109ceece8b6a5fbad75fce9f5fb
Instruction Fuzzy Hash: 91510971900209EFCB10DF69CC899AEB7B8FF40310B12426BE558E73A5EB749D419B60

Function 0080E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0080DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0080CF22,?), ref: 0080DDFD

Part of subcall function 0080DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0080CF22,?), ref: 0080DE16

Part of subcall function 0080E199: GetFileAttributesW.KERNEL32(?,0080CF95), ref: 0080E19A

lstrcmpiW.KERNEL32(?,?), ref: 0080E473
MoveFileW.KERNEL32(?,?), ref: 0080E4AC
_wcslen.LIBCMT ref: 0080E5EB
_wcslen.LIBCMT ref: 0080E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0080E650

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: ca181c046052bf2179f281a47d76080801ea8f198a64b3aeea4ecb42da80f323
Instruction ID: 10cd310869df927d55ae2a24b72d556b08014af5e2d0f0ebde3b77a44c4174ed
Opcode Fuzzy Hash: ca181c046052bf2179f281a47d76080801ea8f198a64b3aeea4ecb42da80f323
Instruction Fuzzy Hash: 225180B20087459BC764EBA4DC859DBB3DCFF85340F004D1EF689D3191EE79A688876A

Function 0082B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 0082C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0082B6AE,?,?), ref: 0082C9B5
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082C9F1
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082CA68
Part of subcall function 0082C998: _wcslen.LIBCMT ref: 0082CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0082BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0082BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0082BB63
RegCloseKey.ADVAPI32(?,?), ref: 0082BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0082BBB3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6f27a03071e9492d1dae7a39a9bc0355c49261a32041fed952cf6a2cf84f76a1
Instruction ID: dd458c419d21bbe0774ccca7f8addffa4c9f99963b690648042c001128eef1a3
Opcode Fuzzy Hash: 6f27a03071e9492d1dae7a39a9bc0355c49261a32041fed952cf6a2cf84f76a1
Instruction Fuzzy Hash: 5B61E331209251EFC314DF24D494E2ABBE5FF85318F54895CF49A8B2A2CB35ED85CB92

Function 00808BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00808BCD
VariantClear.OLEAUT32 ref: 00808C3E
VariantClear.OLEAUT32 ref: 00808C9D
VariantClear.OLEAUT32(?), ref: 00808D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00808D3B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 4de77874f80ca91c67cc6dc315f2c87b24280d7fd739bfdda185a281c338a8a9
Instruction ID: 09b75a2f79e891d00e34ac555b710471111e9a262086695f1685227ba719f29d
Opcode Fuzzy Hash: 4de77874f80ca91c67cc6dc315f2c87b24280d7fd739bfdda185a281c338a8a9
Instruction Fuzzy Hash: D8517BB5A00219EFCB10CF68C884AAAB7F8FF89314B158559F945EB350E730E951CF90

Function 00818AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00818BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00818BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00818C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00818C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00818C5F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 093d215b995036724fc3b317aa4d85a432188a071301affa94c617d2e8f78c8a
Instruction ID: da0ee2e5eb2ebc645462c5c6b55b2ad29381ab9a30ff85d4fb2a4fa49815be6b
Opcode Fuzzy Hash: 093d215b995036724fc3b317aa4d85a432188a071301affa94c617d2e8f78c8a
Instruction Fuzzy Hash: CA512A35A00215EFCB15DF64C885AAEBBF5FF89314F088458E849AB362DB35ED51CB90

Function 00828EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00828F40
GetProcAddress.KERNEL32(00000000,?), ref: 00828FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00828FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00829032
FreeLibrary.KERNEL32(00000000), ref: 00829052

Part of subcall function 007BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00811043,?,7644E610), ref: 007BF6E6
Part of subcall function 007BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,007FFA64,00000000,00000000,?,?,00811043,?,7644E610,?,007FFA64), ref: 007BF70D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 5207d7c196dd5cac859501db04ff096c4c2c2a1997cc89c096d79f12fe1bb3ff
Instruction ID: c1043b81fde93b23bb5b835b282c2d9008e38d71e9d2962a1208ce99a348328e
Opcode Fuzzy Hash: 5207d7c196dd5cac859501db04ff096c4c2c2a1997cc89c096d79f12fe1bb3ff
Instruction Fuzzy Hash: 39515B34A01219DFCB00DF58C4948ADBBF1FF89314F088198E80AAB362DB35ED85CB90

Function 00836B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00836C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00836C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00836C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0081AB79,00000000,00000000), ref: 00836C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00836CC7

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 780f68995a420fc87f530a726ea2560e8ced213c43a11e967cd56b0d614489f0
Instruction ID: cc13eff5ecd8b3f539425c4ad777febf6e8636c359830cd13b16de5dc4a87282
Opcode Fuzzy Hash: 780f68995a420fc87f530a726ea2560e8ced213c43a11e967cd56b0d614489f0
Instruction Fuzzy Hash: 2B41C535600104BFDB24CF2CCC59FA5BBA4FB89360F145618E895E72A0E371ED62CA90

Function 007D2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007D20C3
_free.LIBCMT ref: 007D20E3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d29564cfa0b345cc6e7ef46fb7eb10f6a12889b8d686fab0f8552e329032df54
Instruction ID: 7e87fe826e61719935079a9733e308fae1b8d0e7ddfb570f830215a2d2f9c5b6
Opcode Fuzzy Hash: d29564cfa0b345cc6e7ef46fb7eb10f6a12889b8d686fab0f8552e329032df54
Instruction Fuzzy Hash: C141E232A00204EFCB20DF78C884A6DB7B5EF98714F1585AAE515EB352DA35ED03CB81

Function 007B912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 007B9141
ScreenToClient.USER32(00000000,?), ref: 007B915E
GetAsyncKeyState.USER32(00000001), ref: 007B9183
GetAsyncKeyState.USER32(00000002), ref: 007B919D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 107cf44bc637c85969ab9959ce7d84590b8b4b9524a071c1a93f1e2440d723d9
Instruction ID: 8ab2bbab81d7a87957545997201a32ebc7b8788aaaedfa654f846f6d7e8069e0
Opcode Fuzzy Hash: 107cf44bc637c85969ab9959ce7d84590b8b4b9524a071c1a93f1e2440d723d9
Instruction Fuzzy Hash: A9415E71A0860EFBDF199F68C848BFEB775FF45320F208219E625A6290C7386954DB91

Function 00813874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 008138CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00813922
TranslateMessage.USER32(?), ref: 0081394B
DispatchMessageW.USER32(?), ref: 00813955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00813966

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 6d2969c7b81b73bc97ba1915c2c81f86dd276669531bb291dc9bea5332f0dd2c
Instruction ID: 0748676f98165d3e9760b477a4ed8bc6a5b591032ccc3e693b0870101ce8699d
Opcode Fuzzy Hash: 6d2969c7b81b73bc97ba1915c2c81f86dd276669531bb291dc9bea5332f0dd2c
Instruction Fuzzy Hash: 34319E709043469EEF258B39984DBE67FACFF06304F040569E46AD25A4E3B4AAC5CB51

Function 0081CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0081C21E,00000000), ref: 0081CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0081CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0081C21E,00000000), ref: 0081CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0081C21E,00000000), ref: 0081CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0081C21E,00000000), ref: 0081CFF2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: ce8dd2011ad6586e150e9656fff630094b48dca2b4a7415f33eb01709052186a
Instruction ID: 0ac951df261accf00a8382eda1982ee7fb123378735747de08cb1a18ef855498
Opcode Fuzzy Hash: ce8dd2011ad6586e150e9656fff630094b48dca2b4a7415f33eb01709052186a
Instruction Fuzzy Hash: E0313A71640205EFDB20DFA5C888AABBBFDFF54354B10442EF516E2140DBB0EE829B60

Function 00801901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00801915
PostMessageW.USER32(00000001,00000201,00000001), ref: 008019C1
Sleep.KERNEL32(00000000,?,?,?), ref: 008019C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 008019DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 008019E2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 1b13650b26294e177ffec63f02344efdf49446d82574e0592d2ddd1a485a999d
Instruction ID: df67ca649bbecd8c4e88ff667186bc44af95243f390d8c49608b91268d7024ae
Opcode Fuzzy Hash: 1b13650b26294e177ffec63f02344efdf49446d82574e0592d2ddd1a485a999d
Instruction Fuzzy Hash: A3318972A00219EFCB00CFA8CD9DAAE3BB5FB45325F504629F921EB2D1C7709944DB90

Function 00835706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00835745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0083579D
_wcslen.LIBCMT ref: 008357AF
_wcslen.LIBCMT ref: 008357BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00835816

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: c33b11b085488f37389363cb0f996faea0f2513eb8cff48e101d09b454cbb287
Instruction ID: ad71151be817b84cde072bf76da5024c99686c364dbb4244a58f4240d5bcb62c
Opcode Fuzzy Hash: c33b11b085488f37389363cb0f996faea0f2513eb8cff48e101d09b454cbb287
Instruction Fuzzy Hash: 7921B671904618DADB208F64DC89AEE7BB8FF84324F10861AF929EB180D7709985CF90

Function 00820930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00820951
GetForegroundWindow.USER32 ref: 00820968
GetDC.USER32(00000000), ref: 008209A4
GetPixel.GDI32(00000000,?,00000003), ref: 008209B0
ReleaseDC.USER32(00000000,00000003), ref: 008209E8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: cdafb8d219af843f09c335f0e644c0cf1682291873134b172f6aeec081c7e906
Instruction ID: 9fffbb461ee0639bfe691c0e4c0df37b15f76a7483ea0129c4e6292402326c83
Opcode Fuzzy Hash: cdafb8d219af843f09c335f0e644c0cf1682291873134b172f6aeec081c7e906
Instruction Fuzzy Hash: 9E216235A00214AFD704EF69D849A9EBBE9FF89700F04846CE846E7762DB34AC44CB50

Function 007DCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 007DCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007DCDE9

Part of subcall function 007D3820: RtlAllocateHeap.NTDLL(00000000,?,00871444,?,007BFDF5,?,?,007AA976,00000010,00871440,007A13FC,?,007A13C6,?,007A1129), ref: 007D3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 007DCE0F
_free.LIBCMT ref: 007DCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 007DCE31

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 24d206b03793523ea3926f093266ddc2ebd7014cb77bd53748c605423c36d944
Instruction ID: b407161bc1fcc19d75df00592b397080aaaf7dfadb0f2f7bbad1b69aac6a87d2
Opcode Fuzzy Hash: 24d206b03793523ea3926f093266ddc2ebd7014cb77bd53748c605423c36d944
Instruction Fuzzy Hash: DE0188B26012167F272216BA6C4CD7FBA7DEEC6BA1315012FF905D7301DA698D01D2B0

Function 007B9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007B9693
SelectObject.GDI32(?,00000000), ref: 007B96A2
BeginPath.GDI32(?), ref: 007B96B9
SelectObject.GDI32(?,00000000), ref: 007B96E2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 18c435c6b9580450fe3cd119618d3929eec9f06456ee1ca77c7377ac03f98b68
Instruction ID: 76f440b40f73e539fee6059901dc46fcb1951d24679c3b621c2fc6862b92bd1f
Opcode Fuzzy Hash: 18c435c6b9580450fe3cd119618d3929eec9f06456ee1ca77c7377ac03f98b68
Instruction Fuzzy Hash: 0D216A31802205EBDF119F28EC1DBE97FB8BB51319F544216F728A65A4D3789892CB90

Function 00805711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00805726
_memcmp.LIBVCRUNTIME ref: 00805744
_memcmp.LIBVCRUNTIME ref: 00805757
_memcmp.LIBVCRUNTIME ref: 0080576F
_memcmp.LIBVCRUNTIME ref: 00805787

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 02b205093e4ba1a90feebc027e645b40bf8306da759170393b84354089d06f8d
Instruction ID: 77b62a4b9cb13b98c96565c868c0a4587883e287c92b48c79f1b59bcbab1462b
Opcode Fuzzy Hash: 02b205093e4ba1a90feebc027e645b40bf8306da759170393b84354089d06f8d
Instruction Fuzzy Hash: 1B01D2A1681609FAD70851109E82FBB634CFF623A8F404038FE04DA282F628ED109AF1

Function 007D2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,007CF2DE,007D3863,00871444,?,007BFDF5,?,?,007AA976,00000010,00871440,007A13FC,?,007A13C6), ref: 007D2DFD
_free.LIBCMT ref: 007D2E32
_free.LIBCMT ref: 007D2E59
SetLastError.KERNEL32(00000000,007A1129), ref: 007D2E66
SetLastError.KERNEL32(00000000,007A1129), ref: 007D2E6F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: f5de29c34363c9f26d1813f066dd031848ea7151946514f83b340276cf31d3ed
Instruction ID: f07819c9bd8e96d26c34f4c4600f74889727dc1cafd320578cea7432d87de56f
Opcode Fuzzy Hash: f5de29c34363c9f26d1813f066dd031848ea7151946514f83b340276cf31d3ed
Instruction Fuzzy Hash: 0701D132605600AB861227346C4DD2B3779BBE17A6B25482BF465A2393EAACC8034120

Function 0080000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,007FFF41,80070057,?,?,?,0080035E), ref: 0080002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007FFF41,80070057,?,?), ref: 00800046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007FFF41,80070057,?,?), ref: 00800054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007FFF41,80070057,?), ref: 00800064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,007FFF41,80070057,?,?), ref: 00800070

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: bd838f54fa8cf736cb152cc6338e020dc93f410a994ffe7d042b1108762e967c
Instruction ID: 3aa5c1ec3562c957a1457c5175f7644465c15e7855b33533205e33213b0123ad
Opcode Fuzzy Hash: bd838f54fa8cf736cb152cc6338e020dc93f410a994ffe7d042b1108762e967c
Instruction Fuzzy Hash: 3B01A276A00604BFDB504F68DC08BAA7AEDFF84751F144524F905E2250DB71DE408BA0

Function 0080E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0080E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0080E9A5
Sleep.KERNEL32(00000000), ref: 0080E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0080E9B7
Sleep.KERNEL32 ref: 0080E9F3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: ee77ad08381c3e5299722a09b94bbbb69ea977f5cf94860916c46a8e47bc53dc
Instruction ID: 629eaee782201667f42939ea5d53014bc7603672a18355fc751f9c9727e8e2ed
Opcode Fuzzy Hash: ee77ad08381c3e5299722a09b94bbbb69ea977f5cf94860916c46a8e47bc53dc
Instruction Fuzzy Hash: 7A015331C0162DDBCF90ABE5DC49AEEBF78FF48301F000946E902F2291CB3496508BA1

Function 008010F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00801114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00800B9B,?,?,?), ref: 00801120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00800B9B,?,?,?), ref: 0080112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00800B9B,?,?,?), ref: 00801136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0080114D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 70fd698e81a678c7b7eef4ddd2dfd58f0b838bc850812943e7bebde77c76c4dd
Instruction ID: f64996dd5afd51dc6153852c956f8bf3f1b64be7cdd45eb77a09742a035a78c5
Opcode Fuzzy Hash: 70fd698e81a678c7b7eef4ddd2dfd58f0b838bc850812943e7bebde77c76c4dd
Instruction Fuzzy Hash: EF011975200215BFDB155FA9DC4DA6A3B6EFFC93A0B204819FA45E73A0DA31DC009B60

Function 00800FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00800FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00800FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00800FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00800FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00801002

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a8cbb2074a500e40e17fba46bbd9570e830b03bdd769366637ef326d2456d9a7
Instruction ID: fd1e81850e93ebf14f92293905c2319368af38e1ba4af2f22f196a50a126a699
Opcode Fuzzy Hash: a8cbb2074a500e40e17fba46bbd9570e830b03bdd769366637ef326d2456d9a7
Instruction Fuzzy Hash: D6F04935200701ABDB225FA49C4DF5A3BADFFC9B62F104814FA85E7291CA70DC508B60

Function 00801014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0080102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00801036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00801045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0080104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00801062

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 5fe5ed012c444bcf314a369522a2a9736617417c52cb238fa8260b1fde8adb85
Instruction ID: 6a81b7bb5374110de904b5b90d7f81d92ab238b7e979b6878c2afb28a1454a75
Opcode Fuzzy Hash: 5fe5ed012c444bcf314a369522a2a9736617417c52cb238fa8260b1fde8adb85
Instruction Fuzzy Hash: DBF06D35200701EBDB219FA4EC5DF5A3BADFFC9761F100814FA85E72A0CA70D8508B60

Function 0081030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0081017D,?,008132FC,?,00000001,007E2592,?), ref: 00810324
CloseHandle.KERNEL32(?,?,?,?,0081017D,?,008132FC,?,00000001,007E2592,?), ref: 00810331
CloseHandle.KERNEL32(?,?,?,?,0081017D,?,008132FC,?,00000001,007E2592,?), ref: 0081033E
CloseHandle.KERNEL32(?,?,?,?,0081017D,?,008132FC,?,00000001,007E2592,?), ref: 0081034B
CloseHandle.KERNEL32(?,?,?,?,0081017D,?,008132FC,?,00000001,007E2592,?), ref: 00810358
CloseHandle.KERNEL32(?,?,?,?,0081017D,?,008132FC,?,00000001,007E2592,?), ref: 00810365

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c37e0de68720365227777f9b5fae3d2ea6feb07113cabce5e512154df01d8bab
Instruction ID: 392d8db20ab942da6aa116c65e53bc02850035ed11bb4b7183da77f3bdbfd40a
Opcode Fuzzy Hash: c37e0de68720365227777f9b5fae3d2ea6feb07113cabce5e512154df01d8bab
Instruction Fuzzy Hash: 27019072800B159FC730AF66DC80452F7F9FE502153158A3ED1A692A31C3B1A995DF80

Function 007DD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007DD752

Part of subcall function 007D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000), ref: 007D29DE
Part of subcall function 007D29C8: GetLastError.KERNEL32(00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000,00000000), ref: 007D29F0

_free.LIBCMT ref: 007DD764
_free.LIBCMT ref: 007DD776
_free.LIBCMT ref: 007DD788
_free.LIBCMT ref: 007DD79A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2fba32b8e8ab49892f7272fa5bf929421643b3f948cc5374f55b5fb98b09f8fc
Instruction ID: 08fda04505eabaf7c10b5cb2c8d1423d2563096cb9230c6acb992a719ec342a9
Opcode Fuzzy Hash: 2fba32b8e8ab49892f7272fa5bf929421643b3f948cc5374f55b5fb98b09f8fc
Instruction Fuzzy Hash: 1CF01232544204AB8635EB64F9C6C267BFDBB54760B951847F098E7712C778FC818A64

Function 00805C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00805C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00805C6F
MessageBeep.USER32(00000000), ref: 00805C87
KillTimer.USER32(?,0000040A), ref: 00805CA3
EndDialog.USER32(?,00000001), ref: 00805CBD

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 5ef9e438a6102be5b6487b5ac15fc5a56deb9f1933ec9bc8de45bb68b39f0c16
Instruction ID: cb19dd7e0f436beec5815620d4eae1d7d3edf20808860e649616bc5ee252db69
Opcode Fuzzy Hash: 5ef9e438a6102be5b6487b5ac15fc5a56deb9f1933ec9bc8de45bb68b39f0c16
Instruction Fuzzy Hash: E3014B71500B04ABFB215B50DE4EFA67BA8FB50B05F041A5DA582A10E1EBB4A9848FA0

Function 007D22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007D22BE

Part of subcall function 007D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000), ref: 007D29DE
Part of subcall function 007D29C8: GetLastError.KERNEL32(00000000,?,007DD7D1,00000000,00000000,00000000,00000000,?,007DD7F8,00000000,00000007,00000000,?,007DDBF5,00000000,00000000), ref: 007D29F0

_free.LIBCMT ref: 007D22D0
_free.LIBCMT ref: 007D22E3
_free.LIBCMT ref: 007D22F4
_free.LIBCMT ref: 007D2305

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 37fb1b28c896834bc84c4939fab231e92258d90d91de10e2c58a86842b5b83b1
Instruction ID: 8483706842c18a67732add5bf24e3af25d56a61660d1af109c6144da9e029b0b
Opcode Fuzzy Hash: 37fb1b28c896834bc84c4939fab231e92258d90d91de10e2c58a86842b5b83b1
Instruction Fuzzy Hash: 3CF03070420110CB8A22AF68BC1D8183B74F728750702051BF418E33BBCB78A493BFA4

Function 007B95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 007B95D4
StrokeAndFillPath.GDI32(?,?,007F71F7,00000000,?,?,?), ref: 007B95F0
SelectObject.GDI32(?,00000000), ref: 007B9603
DeleteObject.GDI32 ref: 007B9616
StrokePath.GDI32(?), ref: 007B9631

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 4a60466fb259ceb3a150cd86b6d469fc4f1a1bda26cd77b16b6be3d15b29b141
Instruction ID: df8da573f605797fe80f438fb3895128454535cfd17b2f04cba0b3915ccb7e64
Opcode Fuzzy Hash: 4a60466fb259ceb3a150cd86b6d469fc4f1a1bda26cd77b16b6be3d15b29b141
Instruction Fuzzy Hash: E2F03731006648EBDB265F69ED1CBA83F61BB42326F448214F729694F4D73489A2DF20

Function 007D0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 007D10F9
__freea.LIBCMT ref: 007D1117

Part of subcall function 007D1537: _free.LIBCMT ref: 007D154F

Strings

am/pm, xrefs: 007D117A
a/p, xrefs: 007D11DE

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 9692ec022c2e15b8b94de5dd5aba5047b98afe7c373edf2c2be60a5e42cfee5b
Instruction ID: 0c6ef45c1912b0979cdd7cc0ad187844baabcd932519e66b19a017862901f604
Opcode Fuzzy Hash: 9692ec022c2e15b8b94de5dd5aba5047b98afe7c373edf2c2be60a5e42cfee5b
Instruction Fuzzy Hash: 22D1F731A00206EADB289F68C855BFEB7B1FF06300FA8415BE545AB751D37D9D80CB91

Function 00827B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 007C0242: EnterCriticalSection.KERNEL32(0087070C,00871884,?,?,007B198B,00872518,?,?,?,007A12F9,00000000), ref: 007C024D
Part of subcall function 007C0242: LeaveCriticalSection.KERNEL32(0087070C,?,007B198B,00872518,?,?,?,007A12F9,00000000), ref: 007C028A

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 007C00A3: __onexit.LIBCMT ref: 007C00A9

__Init_thread_footer.LIBCMT ref: 00827BFB

Part of subcall function 007C01F8: EnterCriticalSection.KERNEL32(0087070C,?,?,007B8747,00872514), ref: 007C0202
Part of subcall function 007C01F8: LeaveCriticalSection.KERNEL32(0087070C,?,007B8747,00872514), ref: 007C0235

Strings

5, xrefs: 00827C78
G, xrefs: 00827C7F
Variable must be of type 'Object'., xrefs: 00827C3A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 256ccc21cf05f18476abc7161e0f727adb0614e5f074e06a31c8832e30719426
Instruction ID: 8729d0e89c78fc6c00221f51ff2b814ed362dd5f4a544f497b714c4817e665b9
Opcode Fuzzy Hash: 256ccc21cf05f18476abc7161e0f727adb0614e5f074e06a31c8832e30719426
Instruction Fuzzy Hash: 17919D70A04219EFCB14EF99E894DADB7B1FF45304F108059F806EB292DB35AE81CB52

Function 007D5AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JOz, xrefs: 007D5BA8, 007D5C6C

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: JOz
API String ID: 0-1165826796
Opcode ID: c7408128bd67e2f70dc4a7b8c23c8f4871e64f4dd69be1f6c50fab6d311d47cf
Instruction ID: 1b5c21999c6e2dff41cd5564d0602622e9b2b0158b43ba138286eec1193256a5
Opcode Fuzzy Hash: c7408128bd67e2f70dc4a7b8c23c8f4871e64f4dd69be1f6c50fab6d311d47cf
Instruction Fuzzy Hash: DC51EFB1D1060AEFDB219FA4C949FAEBFB8AF45310F14001BF409A7391D7799901DB61

Function 007D8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 007D8B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 007D8B7A
__dosmaperr.LIBCMT ref: 007D8B81

Strings

.|, xrefs: 007D8A63

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .|
API String ID: 2434981716-4027933657
Opcode ID: baff34f6fefed34c62195136145e07aeb0b27dfa9f3852a2b652a29cb8356a9d
Instruction ID: bd1f7c8019f1c80b94aef5b3458377be1c3d61107d95e9b8f92977a62179b8a9
Opcode Fuzzy Hash: baff34f6fefed34c62195136145e07aeb0b27dfa9f3852a2b652a29cb8356a9d
Instruction Fuzzy Hash: 71417CF0604185AFCB659F28C885A7D7FB5EB85304B28819FF89487352DE39CC029751

Function 00802716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0080B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,008021D0,?,?,00000034,00000800,?,00000034), ref: 0080B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00802760

Part of subcall function 0080B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,008021FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0080B3F8

Part of subcall function 0080B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0080B355
Part of subcall function 0080B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00802194,00000034,?,?,00001004,00000000,00000000), ref: 0080B365
Part of subcall function 0080B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00802194,00000034,?,?,00001004,00000000,00000000), ref: 0080B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 008027CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0080281A

Strings

@, xrefs: 00802832

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 899b553855a579c66fc0792cd15b44405e259118b325ea5bf192a754470a1700
Instruction ID: dd44ce169c49eba0eb0d89d066f58ad512912456126dce211f1ceb8c55694f56
Opcode Fuzzy Hash: 899b553855a579c66fc0792cd15b44405e259118b325ea5bf192a754470a1700
Instruction Fuzzy Hash: 40412F76900218AFDB50DFA8CD46ADEBBB8FF49700F104059FA55B7181DB706E45CB61

Function 007D172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\rpDOUhuBC5.exe,00000104), ref: 007D1769
_free.LIBCMT ref: 007D1834
_free.LIBCMT ref: 007D183E

Strings

C:\Users\user\Desktop\rpDOUhuBC5.exe, xrefs: 007D1760, 007D1767, 007D1796, 007D17CE

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\rpDOUhuBC5.exe
API String ID: 2506810119-3615877580
Opcode ID: 38e24908982e14b6f47f550595bed69e19bdbb456b18c74554c1aca6ffd4d828
Instruction ID: 64e0bacaf1dac5c4d5a2291f037d4aab207d114f1c006ef7425b8d7a7093e7b3
Opcode Fuzzy Hash: 38e24908982e14b6f47f550595bed69e19bdbb456b18c74554c1aca6ffd4d828
Instruction Fuzzy Hash: 2A318071A00218FFDB21DB99D889D9EBBFCEB95320B54416BF404D7322D6748E41DB90

Function 0080C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0080C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0080C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00871990,01665D18), ref: 0080C395

Strings

0, xrefs: 0080C2DF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 2b22b5edf260241bd5aa35e578f8ed30eafbf7ea6beecf4327e1a4f17497c48d
Instruction ID: efd395b9cfad11ebd4ea317ea7155126ac912f117cd32f783ac8cc5289db4f07
Opcode Fuzzy Hash: 2b22b5edf260241bd5aa35e578f8ed30eafbf7ea6beecf4327e1a4f17497c48d
Instruction Fuzzy Hash: F04158312043019BDB609F29DC85B5ABBA8FB85324F158B1EE9A5D73D2D730A904CB62

Function 00834416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0083CC08,00000000,?,?,?,?), ref: 008344AA
GetWindowLongW.USER32 ref: 008344C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 008344D7

Strings

SysTreeView32, xrefs: 0083447C

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 4207300048b8e4e6b8b19053882da21956f41b8587b53680c1360b79e8137336
Instruction ID: e6df3e0e2cf2736b32d64e0532672b3bf3dec66dbd44d2c8e7132d9b2cfbf0bc
Opcode Fuzzy Hash: 4207300048b8e4e6b8b19053882da21956f41b8587b53680c1360b79e8137336
Instruction Fuzzy Hash: 3E317C32211205ABDF209E38DC45BEA7BA9FB89324F205725F975E21D1D774EC509790

Function 0082304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0082335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00823077,?,?), ref: 00823378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0082307A
_wcslen.LIBCMT ref: 0082309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00823106

Strings

255.255.255.255, xrefs: 00823095, 0082309A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 6f32885dcb5730a39f49fb7622dc33bf7098f9f8b6df9526f2ffe85ec9fb8690
Instruction ID: 46939fa49888124f35e918ebded33cc4838c405915ea57a077aebd06c10d348c
Opcode Fuzzy Hash: 6f32885dcb5730a39f49fb7622dc33bf7098f9f8b6df9526f2ffe85ec9fb8690
Instruction Fuzzy Hash: DE31CF352002259FCB10CF68D496EAA77A0FF54318F248459E915CB392DB3AEE81C760

Function 00833EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00833F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00833F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00833F78

Strings

SysMonthCal32, xrefs: 00833F0B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 5945d86bd28e838b95d0b5bcbc954881d44e2cbd3801bd7d9b36471e2206eac8
Instruction ID: 9f6d7c5d0f481b1f7222b9889011a346741eade145bbba97c4021d8876ff3fa6
Opcode Fuzzy Hash: 5945d86bd28e838b95d0b5bcbc954881d44e2cbd3801bd7d9b36471e2206eac8
Instruction Fuzzy Hash: 85219F32600219BFDF219F54DC46FEA3B75FB88714F110214FA15BB1D0DAB5A9908B90

Function 00834653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00834705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00834713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0083471A

Strings

msctls_updown32, xrefs: 00834684

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 37198e0f94305f309dfb94ce31169c441aedf590a097a65331fb598fd253dc37
Instruction ID: 32b6ec40eaa041382d4a873b58a7ef7f32bfe800b5ce71671aee14f97b8a3389
Opcode Fuzzy Hash: 37198e0f94305f309dfb94ce31169c441aedf590a097a65331fb598fd253dc37
Instruction Fuzzy Hash: 4F217CB5600208AFEB10DF68DC85DA737ADFB9A394B040449FA05DB251DB34FC51CAA0

Function 008095AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0080961D

Strings

#requireadmin, xrefs: 008095D9
#notrayicon, xrefs: 008095B7
#OnAutoItStartRegister, xrefs: 008095F3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 4f009fc02594c6c45204dce255d6051a7d5a541235e1cc0b9916aebc626dd15e
Instruction ID: 0c70a4428e59a73753d0608cf948d9afbe7c7fb5659f63ce12bfb71a634378f9
Opcode Fuzzy Hash: 4f009fc02594c6c45204dce255d6051a7d5a541235e1cc0b9916aebc626dd15e
Instruction Fuzzy Hash: F2213872104511A6C371AB259C06FB77398FFA1314F10402AF9EAD71C3EB5AAD41C2D5

Function 008337B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00833840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00833850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00833876

Strings

Listbox, xrefs: 0083380F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: f8d69c36223ba6ec1bf3e82b34209eb848924d53dbaac2c2dbe411fae47704ca
Instruction ID: 3e2e0c0198b54d4288147f0c820ca9e1419a969bc5b79471a2ca9de1ec59443d
Opcode Fuzzy Hash: f8d69c36223ba6ec1bf3e82b34209eb848924d53dbaac2c2dbe411fae47704ca
Instruction Fuzzy Hash: B9218E72610218BBEF219F54DC85EAB376AFFC9764F118124F914AB190C675DC5287E0

Function 008149F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00814A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00814A5C
SetErrorMode.KERNEL32(00000000,?,?,0083CC08), ref: 00814AD0

Strings

%lu, xrefs: 00814A6F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: e8ba15cba2cd92f7a737d6254b18a062e10ca57d0260783a01f07fa00acec483
Instruction ID: 0a95ee86b78947254fed94cee6474013be105be4b0ac4ba971288358f4d0017b
Opcode Fuzzy Hash: e8ba15cba2cd92f7a737d6254b18a062e10ca57d0260783a01f07fa00acec483
Instruction Fuzzy Hash: 5B318E75A00118AFDB10DF64C885EAABBF8FF49308F1480A4F909EB252D775EE45CB61

Function 008341EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0083424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00834264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00834271

Strings

msctls_trackbar32, xrefs: 00834226

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 00f4de0a28cca5f55bdd0ede8e3b42935b70da930d2593f266e46659dc1a485e
Instruction ID: f75e5e2a8d6b8bd757a0059821e96309b9242473bb82db37004a8de1ec07a810
Opcode Fuzzy Hash: 00f4de0a28cca5f55bdd0ede8e3b42935b70da930d2593f266e46659dc1a485e
Instruction Fuzzy Hash: 0711A331240248BEEF205E69CC06FAB3BACFFD5B54F110524FA55E61A0D671E8519B50

Function 00802F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A6B57: _wcslen.LIBCMT ref: 007A6B6A

Part of subcall function 00802DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00802DC5
Part of subcall function 00802DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00802DD6
Part of subcall function 00802DA7: GetCurrentThreadId.KERNEL32 ref: 00802DDD
Part of subcall function 00802DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00802DE4

GetFocus.USER32 ref: 00802F78

Part of subcall function 00802DEE: GetParent.USER32(00000000), ref: 00802DF9

GetClassNameW.USER32(?,?,00000100), ref: 00802FC3
EnumChildWindows.USER32(?,0080303B), ref: 00802FEB

Strings

%s%d, xrefs: 00802FFF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 390bf79c2247bf9f36fe90dd95c55bbce868ed6e892dfefdd96c7d1b71169810
Instruction ID: 0db5e1497ac0ff74fde918d9b5b9a82a709431a7e5d38440d5849b4f2792d1c8
Opcode Fuzzy Hash: 390bf79c2247bf9f36fe90dd95c55bbce868ed6e892dfefdd96c7d1b71169810
Instruction Fuzzy Hash: F011C0B1200209ABDF417F648C8AEEE776AFF95304F044079BD09EB292EE749D058B70

Function 00835882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 008358C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 008358EE
DrawMenuBar.USER32(?), ref: 008358FD

Strings

0, xrefs: 0083588F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 5fe52aaf6a338b52b3ba85eb9e9f1105e48ecfa74d74c0d02e19b950ef55a7b0
Instruction ID: d4f86494f690da02e57cf64c79b98db37795741e3228b94e7e144a5730710ec0
Opcode Fuzzy Hash: 5fe52aaf6a338b52b3ba85eb9e9f1105e48ecfa74d74c0d02e19b950ef55a7b0
Instruction Fuzzy Hash: 10016D71500218EFDB219F11EC49BEEBBB4FB85760F108099E849E6151DB348A94DF61

Function 0080007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c817d178eca02abc80acad05a9075ce180ae0d053828e05e558619ee9f43699
Instruction ID: 8cf3e29ef6e1611b47c588f12d4a6cbcc758ee4b3687665e562cd4036fd4cb51
Opcode Fuzzy Hash: 7c817d178eca02abc80acad05a9075ce180ae0d053828e05e558619ee9f43699
Instruction Fuzzy Hash: 42C12875A0020AEFDB55CFA4C894BAEB7B5FF48704F218598E505EB291D731EE41CB90

Function 0082342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00823459
CoUninitialize.OLE32 ref: 00823463
VariantInit.OLEAUT32(?), ref: 0082346E
VariantClear.OLEAUT32(?), ref: 0082371B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: c33007a7e6a59bd2ff00800b9e3a5c67d8cfc52a84a5c9a268f851d660c8f4f6
Instruction ID: 6abf0f902ae076a554c53a5f93ed9631ed34f5abfdb775f58b0cb2a6904cd0d1
Opcode Fuzzy Hash: c33007a7e6a59bd2ff00800b9e3a5c67d8cfc52a84a5c9a268f851d660c8f4f6
Instruction Fuzzy Hash: 29A17B75604210DFC700EF28C895A2AB7E5FF89714F048959F98ADB362DB34EE41CB92

Function 00800436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0083FC08,?), ref: 008005F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0083FC08,?), ref: 00800608
CLSIDFromProgID.OLE32(?,?,00000000,0083CC40,000000FF,?,00000000,00000800,00000000,?,0083FC08,?), ref: 0080062D
_memcmp.LIBVCRUNTIME ref: 0080064E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 32131ceaa523a403bf2e8803d61106e8a667e61b89208e506a7bec1d7d537722
Instruction ID: f56954ea7483c7bc8806806e77d38d63cfe349bc4cccf2db9ab359732d5e70e9
Opcode Fuzzy Hash: 32131ceaa523a403bf2e8803d61106e8a667e61b89208e506a7bec1d7d537722
Instruction Fuzzy Hash: 0881C875A00209EFCB44DF94C984EAEB7B9FF89315F204558E516EB290DB71AE06CF60

Function 0082A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0082A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0082A6BA

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0082A79C
CloseHandle.KERNEL32(00000000), ref: 0082A7AB

Part of subcall function 007BCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,007E3303,?), ref: 007BCE8A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 108c69eb5bcc84c639bf2ae61a84d946e9f3a8b943f85ed51f9064fa635f5bdc
Instruction ID: a8ec6c56f0ad71964e54023a02ab14ea21ce20ecdedd624ccee5736474e70f1e
Opcode Fuzzy Hash: 108c69eb5bcc84c639bf2ae61a84d946e9f3a8b943f85ed51f9064fa635f5bdc
Instruction Fuzzy Hash: 30511A71508310AFD714EF24D88AA6BBBE8FFC9754F048A2DF58597251EB34D904CB92

Function 007E1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007E14C0

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 790d192cdb6849f30892b05d9b212120d581718fbad49b88dc415ebda6748ccd
Instruction ID: d266112d4457a779b37b3eaa8fb8dafc65c0dac5e3acc34a6dc72a6cb49d8d0d
Opcode Fuzzy Hash: 790d192cdb6849f30892b05d9b212120d581718fbad49b88dc415ebda6748ccd
Instruction Fuzzy Hash: 80410A316015D0EBDB216BBA8C4BAAE3BB5FF4B370F54422AF419D63D2E63C48419661

Function 00836278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 008362E2
ScreenToClient.USER32(?,?), ref: 00836315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00836382

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 39caae0c38500147f70033dc0bc34c18f635c57ab14fb64c38dede0101a73a2b
Instruction ID: a6ac4d7132928dc8280c19aa0530268f276d223a40412ca0356913640870b6a9
Opcode Fuzzy Hash: 39caae0c38500147f70033dc0bc34c18f635c57ab14fb64c38dede0101a73a2b
Instruction Fuzzy Hash: DE513A75A00209EFCF10DF68D884AAE7BB5FB85360F108259F915DB2A0E730ED91CB90

Function 00821AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00821AFD
WSAGetLastError.WSOCK32 ref: 00821B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00821B8A
WSAGetLastError.WSOCK32 ref: 00821B94

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 2721f872bc0fb01f03280d53f76092be74007478fac8a4a217819d842a6c1e76
Instruction ID: eceb16c66c486d899d6a6eb60eff52676e671a8543a0e85220501c6a5cd7ef84
Opcode Fuzzy Hash: 2721f872bc0fb01f03280d53f76092be74007478fac8a4a217819d842a6c1e76
Instruction Fuzzy Hash: 8841D234600210AFEB20AF24D88AF2A77E5EB85718F548558F91A9F3D3D776DD81CB90

Function 007DB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1fe1e24490893cc73a0281c97e36bb200f342e081625e88cd5d468fedaca0db
Instruction ID: cd7660c5582b220e567692f8e11c14d920d1f09289b0d9464ba1518f9f604f4a
Opcode Fuzzy Hash: a1fe1e24490893cc73a0281c97e36bb200f342e081625e88cd5d468fedaca0db
Instruction Fuzzy Hash: BB41D372A00244EFD724DF78C845B6ABBB9EB88710F11452FF141DB382D77999018790

Function 008156D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00815783
GetLastError.KERNEL32(?,00000000), ref: 008157A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 008157CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 008157FA

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 9f66cf7417a5972beafed83318ad400ac8e1715cffaaa4ca6493a0e562d8ae0e
Instruction ID: 333e66dbac2febe6a7ff1b366de371bbad06ccd7676551760b73bf4bb9bdb522
Opcode Fuzzy Hash: 9f66cf7417a5972beafed83318ad400ac8e1715cffaaa4ca6493a0e562d8ae0e
Instruction Fuzzy Hash: C7411D35600610DFCB15EF15C545A5EBBE6FFC9320B198898E84AAB362CB34FD40CB91

Function 007DD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,007C6D71,00000000,00000000,007C82D9,?,007C82D9,?,00000001,007C6D71,?,00000001,007C82D9,007C82D9), ref: 007DD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 007DD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 007DD9AB
__freea.LIBCMT ref: 007DD9B4

Part of subcall function 007D3820: RtlAllocateHeap.NTDLL(00000000,?,00871444,?,007BFDF5,?,?,007AA976,00000010,00871440,007A13FC,?,007A13C6,?,007A1129), ref: 007D3852

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 0c27b859d0758eb7d60abd424972b1130e6a743d095b6749925b23b4a1b17ba6
Instruction ID: 947f1e59e217b8046ef12ca46a1746de8ef9ee95dc9d306c79eaea5d6cf68218
Opcode Fuzzy Hash: 0c27b859d0758eb7d60abd424972b1130e6a743d095b6749925b23b4a1b17ba6
Instruction Fuzzy Hash: 9A31CF72A0020AABDF25DF65DC95EAE7BB5EB40310F05416AFC04D7251EB3AED50DBA0

Function 008352C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00835352
GetWindowLongW.USER32(?,000000F0), ref: 00835375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00835382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 008353A8

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 6e4595da82e4683619a464e71a0fa4be42d244ec5cf63da7d650ab940a9ba043
Instruction ID: e1db92d17c1d0932293bde27133248ecd9017b289b1b379568990ba8376d2c2a
Opcode Fuzzy Hash: 6e4595da82e4683619a464e71a0fa4be42d244ec5cf63da7d650ab940a9ba043
Instruction Fuzzy Hash: 4C31C234A95A0CEFEF309A18CC1ABE97765FB86390F584501FA11D63E1C7B49980DBC2

Function 0080AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 0080ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0080AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0080AC74
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 0080ACC6

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: bdc0f3ea3f3e50aeccfaf1d4480adbce98a16302f9a4e3d84ad9de9f7a84189e
Instruction ID: ef566f4af4979a26988e12f4a4327d48b35b9748b1ea4b63c6e0eed12052a847
Opcode Fuzzy Hash: bdc0f3ea3f3e50aeccfaf1d4480adbce98a16302f9a4e3d84ad9de9f7a84189e
Instruction Fuzzy Hash: 7D311230A04718AFFB698B68CC097FE7AA5FB89314F05471AE485E61D1D37489818792

Function 00837674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0083769A
GetWindowRect.USER32(?,?), ref: 00837710
PtInRect.USER32(?,?,00838B89), ref: 00837720
MessageBeep.USER32(00000000), ref: 0083778C

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 14fdb261d5e6921380e17f2fab4a3895e7686901c0e92f74cc1361ec85a85246
Instruction ID: f0558ce2d47cc17b6a868067d59fdcf6fad6059c97d508bb80422e737002d028
Opcode Fuzzy Hash: 14fdb261d5e6921380e17f2fab4a3895e7686901c0e92f74cc1361ec85a85246
Instruction Fuzzy Hash: 7E419CB4605258AFDB21CF58C899FA9BBF4FB89314F1440A8E518DB261D330E982CBD0

Function 008316DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 008316EB

Part of subcall function 00803A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00803A57
Part of subcall function 00803A3D: GetCurrentThreadId.KERNEL32 ref: 00803A5E
Part of subcall function 00803A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,008025B3), ref: 00803A65

GetCaretPos.USER32(?), ref: 008316FF
ClientToScreen.USER32(00000000,?), ref: 0083174C
GetForegroundWindow.USER32 ref: 00831752

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 69a44709ae0228a2ca89a7ac93709870ed10ee248a6a1fbe5f71ec3a89134643
Instruction ID: 19faf2abdec6355cf5ad8f27ae472ad6588cd86f524c4c91453bfedb6bbdcde3
Opcode Fuzzy Hash: 69a44709ae0228a2ca89a7ac93709870ed10ee248a6a1fbe5f71ec3a89134643
Instruction Fuzzy Hash: 1E317071E00109AFCB04EFA9C885CAEBBFDFF89304B5480A9E415E7211DB359E45CBA0

Function 00838FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007B9BB2

GetCursorPos.USER32(?), ref: 00839001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,007F7711,?,?,?,?,?), ref: 00839016
GetCursorPos.USER32(?), ref: 0083905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,007F7711,?,?,?), ref: 00839094

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 405617d43dbb8c53a42f1a6322f5e64e22645b75292730c4621510f449786884
Instruction ID: 4f8cec892b5143f618c61a2a4674bbaa818d0b5e4158663f39365270b9fb0bd2
Opcode Fuzzy Hash: 405617d43dbb8c53a42f1a6322f5e64e22645b75292730c4621510f449786884
Instruction Fuzzy Hash: 0721BF35600518EFCB298F98C868EEA7BF9FB89350F004065FA4597261C3719990DBA0

Function 0080D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0083CB68), ref: 0080D2FB
GetLastError.KERNEL32 ref: 0080D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0080D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0083CB68), ref: 0080D376

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: fcc280414b71debfcf6f54f1a18d9ba0bfd12b050f702a46f8d2bf26acde6585
Instruction ID: fa3b328452e5bef2dec91a6f02a8728724db979e0b82f301e92ad92e124a5e67
Opcode Fuzzy Hash: fcc280414b71debfcf6f54f1a18d9ba0bfd12b050f702a46f8d2bf26acde6585
Instruction Fuzzy Hash: C8217A705093019FC740DF68C88586AB7E8FE9A364F104A1DF4A9D33E1EB359946CB93

Function 00801571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00801014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0080102A
Part of subcall function 00801014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00801036
Part of subcall function 00801014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00801045
Part of subcall function 00801014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0080104C
Part of subcall function 00801014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00801062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 008015BE
_memcmp.LIBVCRUNTIME ref: 008015E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00801617
HeapFree.KERNEL32(00000000), ref: 0080161E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 626333cf1c526b3dd638ae422762d202c240420ffccc18df09af76470880d2ee
Instruction ID: ed2d08fd1b869d5ae9e72595722612b6575822c3197b529a9f1665787898d277
Opcode Fuzzy Hash: 626333cf1c526b3dd638ae422762d202c240420ffccc18df09af76470880d2ee
Instruction Fuzzy Hash: 5C215731E00108AFDF54DFA4CD49BEEB7B8FF94364F084859E451AB281E731AA45DBA0

Function 00832782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0083280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00832824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00832832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00832840

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 67c28db26dc13a3fd27d133fd475c691ce054a16ed576f2c7130f1503b026338
Instruction ID: de1f507d4a85762ee89000420345af158bc08b2d951142a3e1dc016b0fe8cb15
Opcode Fuzzy Hash: 67c28db26dc13a3fd27d133fd475c691ce054a16ed576f2c7130f1503b026338
Instruction Fuzzy Hash: F621BD31204125AFD7149B24C855FAA7B95FFC6324F188258F426CB6E2CB75EC82CBD1

Function 008078F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00808D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0080790A,?,000000FF,?,00808754,00000000,?,0000001C,?,?), ref: 00808D8C
Part of subcall function 00808D7D: lstrcpyW.KERNEL32(00000000,?,?,0080790A,?,000000FF,?,00808754,00000000,?,0000001C,?,?,00000000), ref: 00808DB2
Part of subcall function 00808D7D: lstrcmpiW.KERNEL32(00000000,?,0080790A,?,000000FF,?,00808754,00000000,?,0000001C,?,?), ref: 00808DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00808754,00000000,?,0000001C,?,?,00000000), ref: 00807923
lstrcpyW.KERNEL32(00000000,?,?,00808754,00000000,?,0000001C,?,?,00000000), ref: 00807949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00808754,00000000,?,0000001C,?,?,00000000), ref: 00807984

Strings

cdecl, xrefs: 0080797B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 1f3e287e12f36a94a379956071f36b077a08765b038ce75d0d63338261ca79fd
Instruction ID: 0da49657621382ca068cdcf26c8b24e1fa56a0725a558db43c6b6a990ac08665
Opcode Fuzzy Hash: 1f3e287e12f36a94a379956071f36b077a08765b038ce75d0d63338261ca79fd
Instruction Fuzzy Hash: 9211263A200342ABDB159F38CC45E7A7BA9FF85350B00402AF842C73A4EB35E811D7A1

Function 00837CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00837D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00837D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00837D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0081B7AD,00000000), ref: 00837D6B

Part of subcall function 007B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007B9BB2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 72fc03d30decfab5f45cf97dc94b5bbb3c1b37c1ec72a89b80493833ae4f20b6
Instruction ID: 3a1816d85476a4b96816567c7234b39b2f497922c589d21f669acf099e046be5
Opcode Fuzzy Hash: 72fc03d30decfab5f45cf97dc94b5bbb3c1b37c1ec72a89b80493833ae4f20b6
Instruction Fuzzy Hash: DC11DF72204658AFCB209F28CC08AA63BA4FF85360F118728F939D72F4E730C951DB80

Function 00835660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 008356BB
_wcslen.LIBCMT ref: 008356CD
_wcslen.LIBCMT ref: 008356D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00835816

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: aa5461be3eae64aa6be4c17da878211680152e6b4536a7520dc76dfa5f082102
Instruction ID: 465e319b2cc9ef50833b33a63d7f15853f65ba93b8e6398cb61cdebe0801a2c0
Opcode Fuzzy Hash: aa5461be3eae64aa6be4c17da878211680152e6b4536a7520dc76dfa5f082102
Instruction Fuzzy Hash: 581106B1600618A6DF20DF65DC85AEE37ACFF91764F10442AF915E6081E774CA80CBE4

Function 007D1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ce25568bd6b1e17935ac17a34e7cb0063463ce15e90f080c6b2b484793fbf1
Instruction ID: 949c5ed3ada3b060075a753f09364f4b5a3e882a3df888f555ab3544971a593f
Opcode Fuzzy Hash: 30ce25568bd6b1e17935ac17a34e7cb0063463ce15e90f080c6b2b484793fbf1
Instruction Fuzzy Hash: 23018FB23096167EF62116786CC4F27763EEF813B8B750327F521613D2DB689C419670

Function 00801A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00801A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00801A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00801A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00801A8A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b4e6d79c5dafbeddc3f5b87fc89b189c11f496a7bd9a32592a293693b94a19ef
Instruction ID: f5d0817f75f3910c1ffd5dbbe8763060d4424eab4d4d406a5b02d67ff3b28852
Opcode Fuzzy Hash: b4e6d79c5dafbeddc3f5b87fc89b189c11f496a7bd9a32592a293693b94a19ef
Instruction Fuzzy Hash: CC11FA3AA01229FFEF119BA5CD85FADBB78FB04764F200095E604B7290D7716E50DB94

Function 0080E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0080E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0080E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0080E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0080E24D

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 0316aad02003f716881c3b07560ffb53cefc1f5e463ec18f7cc81c3d49442598
Instruction ID: 38a8e8ee76d47d1472d6d9c80c4e30f2b717e99a1815b1f9dc6ec0a461e8d508
Opcode Fuzzy Hash: 0316aad02003f716881c3b07560ffb53cefc1f5e463ec18f7cc81c3d49442598
Instruction Fuzzy Hash: AF11A576904258BBCB019FAC9C0DA9F7BACFB85314F044659F924E3391D774C94487A0

Function 007CD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,007CCFF9,00000000,00000004,00000000), ref: 007CD218
GetLastError.KERNEL32 ref: 007CD224
__dosmaperr.LIBCMT ref: 007CD22B
ResumeThread.KERNEL32(00000000), ref: 007CD249

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 2601e7cff8995cd763e6463f225f1a8202f39abf4f6a26df8447c09ce043a6b9
Instruction ID: a2e59c9d49624183db6b80b85fd923fb2132668eae0a626d04169d6c56f3799f
Opcode Fuzzy Hash: 2601e7cff8995cd763e6463f225f1a8202f39abf4f6a26df8447c09ce043a6b9
Instruction Fuzzy Hash: E601AD76805208BBCB215BA5DC09FAE7B69EB81330F20022DF925921D0DA78CD0197A0

Function 00839EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 007B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 007B9BB2

GetClientRect.USER32(?,?), ref: 00839F31
GetCursorPos.USER32(?), ref: 00839F3B
ScreenToClient.USER32(?,?), ref: 00839F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00839F7A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 8f7464399de9e233764386ac9eaa5df283aceb825ac5d2c69dc90f505cacc1a6
Instruction ID: 1a1b6c826933a0f33dc3bb18bf80a2145746e0730a4c67193c7b3825a7cbda68
Opcode Fuzzy Hash: 8f7464399de9e233764386ac9eaa5df283aceb825ac5d2c69dc90f505cacc1a6
Instruction Fuzzy Hash: 9111573290021AABDF10EFA8D889DEE77B8FB85311F004855F951E3140DB74BA81CBE2

Function 007A600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 007A604C
GetStockObject.GDI32(00000011), ref: 007A6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 007A606A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: bdeed8932e6285b8f197a2fb6237d383710cb6fe7c67e35439a9daf61277d384
Instruction ID: f1ec3ddc2ee3799bbe9d4b58d73ba0d8171baa5d0a28213f17ef0d1b41eb0962
Opcode Fuzzy Hash: bdeed8932e6285b8f197a2fb6237d383710cb6fe7c67e35439a9daf61277d384
Instruction Fuzzy Hash: 87115B72501549BFEF124FA49C44EEBBBA9FF997A4F090215FA1462110D736DCA0AFA0

Function 007C3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 007C3B56

Part of subcall function 007C3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 007C3AD2
Part of subcall function 007C3AA3: ___AdjustPointer.LIBCMT ref: 007C3AED

_UnwindNestedFrames.LIBCMT ref: 007C3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 007C3B7C
CallCatchBlock.LIBVCRUNTIME ref: 007C3BA4

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: fec07b3e060ad86dde41a358fa80f9fdf7bc1bf7fa750d988aac3ea6537f971a
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 96012972100148BBDF125E95CC46EEB3B7EEF58754F04801CFE4856121C73AE961DBA0

Function 007D3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,007A13C6,00000000,00000000,?,007D301A,007A13C6,00000000,00000000,00000000,?,007D328B,00000006,FlsSetValue), ref: 007D30A5
GetLastError.KERNEL32(?,007D301A,007A13C6,00000000,00000000,00000000,?,007D328B,00000006,FlsSetValue,00842290,FlsSetValue,00000000,00000364,?,007D2E46), ref: 007D30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,007D301A,007A13C6,00000000,00000000,00000000,?,007D328B,00000006,FlsSetValue,00842290,FlsSetValue,00000000), ref: 007D30BF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: b1711291967195ba02acfd6c5588f7445db59899b732be01784feb3b602625f3
Instruction ID: fdd76442abf61141741586cddcd398ea521fa6ebbaa79798db72265e4607aa47
Opcode Fuzzy Hash: b1711291967195ba02acfd6c5588f7445db59899b732be01784feb3b602625f3
Instruction Fuzzy Hash: DD012B32301226ABCB314B78AC449577BAABF45B61B240721F909F3380C725D901C7E1

Function 00807464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0080747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00807497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 008074AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 008074CA

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 5e0d8877a7df3a3e7f039f5965df36411fb8b24f548ca6fa3499a0c98377d7f7
Instruction ID: 1a357a558d0bf673b0426682ec312ba7661eab977bf567c2b3c22cb08f0ecf5b
Opcode Fuzzy Hash: 5e0d8877a7df3a3e7f039f5965df36411fb8b24f548ca6fa3499a0c98377d7f7
Instruction Fuzzy Hash: 2511ADB5A05B19ABE7308F14EC08B927BFCFB40B04F108569E656E6191D7B0F944DBA4

Function 0080B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0080ACD3,?,00008000), ref: 0080B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0080ACD3,?,00008000), ref: 0080B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0080ACD3,?,00008000), ref: 0080B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0080ACD3,?,00008000), ref: 0080B126

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 352eedced5b092985cbe3c7fb6825ec3c77ebebbb310eb155d05825175240c84
Instruction ID: 59d9c120cbf6c12c777193df622d462371525245684a42301d5235a5ee30427b
Opcode Fuzzy Hash: 352eedced5b092985cbe3c7fb6825ec3c77ebebbb310eb155d05825175240c84
Instruction Fuzzy Hash: 85116D31C0192DE7CF00AFE4ED58AEEBF78FF4A711F114485D941B2281DB3056609B91

Function 00837E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00837E33
ScreenToClient.USER32(?,?), ref: 00837E4B
ScreenToClient.USER32(?,?), ref: 00837E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00837E8A

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 640620c4cb14f43c2e58490fb7bedaea3730496f14a334972dd13174096380de
Instruction ID: b915bff4ed9e60b986330f5c3ee540dffa65a2d472ae851f2e38451869d576c1
Opcode Fuzzy Hash: 640620c4cb14f43c2e58490fb7bedaea3730496f14a334972dd13174096380de
Instruction Fuzzy Hash: BD1143B9D0020AAFDB51CF98C8849EEBBF5FB58310F505056E915E2210D735AA54CF90

Function 00802DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00802DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00802DD6
GetCurrentThreadId.KERNEL32 ref: 00802DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00802DE4

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: c9e0ac0d13bbb9a647a12da0531413b714738181ae04c9c83460f33a00ac7646
Instruction ID: 14dcb97babc4cdac04c3d3cac8dd3d53d29eafbe647f80faf1f4f593c89f0ffb
Opcode Fuzzy Hash: c9e0ac0d13bbb9a647a12da0531413b714738181ae04c9c83460f33a00ac7646
Instruction Fuzzy Hash: 8EE0EDB15016287ADB202B629C0EEEB7E6CFB96BA1F400519B506E1090AAA5C941D7B1

Function 00838863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 007B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007B9693
Part of subcall function 007B9639: SelectObject.GDI32(?,00000000), ref: 007B96A2
Part of subcall function 007B9639: BeginPath.GDI32(?), ref: 007B96B9
Part of subcall function 007B9639: SelectObject.GDI32(?,00000000), ref: 007B96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00838887
LineTo.GDI32(?,?,?), ref: 00838894
EndPath.GDI32(?), ref: 008388A4
StrokePath.GDI32(?), ref: 008388B2

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 4deead830350bab17df2dc4065f8d85ff737efa0b09412749a63bbb38a2a3c8e
Instruction ID: 99e5ae80a6c346149dfb8445e805376964cf9a7db8a8d0edfc09a56b2766f7d1
Opcode Fuzzy Hash: 4deead830350bab17df2dc4065f8d85ff737efa0b09412749a63bbb38a2a3c8e
Instruction Fuzzy Hash: D1F01736046658EADB125F98AC0DBCA3E69BF46310F448000FB12650E2876555519BE5

Function 007B98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 007B98CC
SetTextColor.GDI32(?,?), ref: 007B98D6
SetBkMode.GDI32(?,00000001), ref: 007B98E9
GetStockObject.GDI32(00000005), ref: 007B98F1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: ce30b4c5558aa71bfe3a42a5d2c6cbbcc0f9e3a62707cd7c5b866762ae09be97
Instruction ID: 06526b79835fb2d27dc2f6175fe7dccc493ba2f296e3fab85089190a5bc24075
Opcode Fuzzy Hash: ce30b4c5558aa71bfe3a42a5d2c6cbbcc0f9e3a62707cd7c5b866762ae09be97
Instruction Fuzzy Hash: E1E06531244284AADF215B78AC09BEC3F10BB51335F048A19F7F5640E1C3754650DB10

Function 0080162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00801634
OpenThreadToken.ADVAPI32(00000000,?,?,?,008011D9), ref: 0080163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,008011D9), ref: 00801648
OpenProcessToken.ADVAPI32(00000000,?,?,?,008011D9), ref: 0080164F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: adb95474c702ba992d1877f935f9baebe27775ecb99c6f9d1715952854c581fb
Instruction ID: e6ea65b3d8e260ae80c7fccbd40c2b6e3472f1d27a57c38a42a0e412400350af
Opcode Fuzzy Hash: adb95474c702ba992d1877f935f9baebe27775ecb99c6f9d1715952854c581fb
Instruction Fuzzy Hash: 8CE08C32602211EBDB601FA1AE0DB877B7CFF947A2F148C08F245E9080E7388444CB60

Function 007FD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 007FD858
GetDC.USER32(00000000), ref: 007FD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 007FD882
ReleaseDC.USER32(?), ref: 007FD8A3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 7dec0b06250e6b2e7e0019c6baa8a43ff9706b3c38c9bd10d16b87227ae9873d
Instruction ID: da0764fc710c7e378f8189dd642cbb506a02a31efdecdc296900cc1e37ef7e27
Opcode Fuzzy Hash: 7dec0b06250e6b2e7e0019c6baa8a43ff9706b3c38c9bd10d16b87227ae9873d
Instruction Fuzzy Hash: 77E01AB1800604EFCF51AFA0D80D66DBBB2FB98310F148809F846F7260E7388941AF40

Function 007FD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 007FD86C
GetDC.USER32(00000000), ref: 007FD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 007FD882
ReleaseDC.USER32(?), ref: 007FD8A3

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 443a91d016d8e229c616de98908d99f445b75c957c988df402c75d55b5c2ba0f
Instruction ID: 608e16996b715c9944bdfb42d589326b810c6627439fc03494127de4da570741
Opcode Fuzzy Hash: 443a91d016d8e229c616de98908d99f445b75c957c988df402c75d55b5c2ba0f
Instruction Fuzzy Hash: FBE092B5800604EFCF51AFA0D84D66DBBB5BB98311F149849F94AF7260EB789901AF50

Function 00814D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 007A7620: _wcslen.LIBCMT ref: 007A7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00814ED4

Strings

LPT, xrefs: 00814DFB
*, xrefs: 00814E10

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 71b6e4fd733e0ebd74bd293a0686befa0bc97f880ce1f36c5cfdbf9be4b31482
Instruction ID: 77856965bbbfedae4cb5eff70b60fd8b87a387a98dabcd264867eaf2ab55593d
Opcode Fuzzy Hash: 71b6e4fd733e0ebd74bd293a0686befa0bc97f880ce1f36c5cfdbf9be4b31482
Instruction Fuzzy Hash: 4C913C75A00204DFCB14DF58C484EA9BBF5FF49318F199099E40A9B3A2DB35ED86CB91

Function 007BE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 007BE1B1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 2928eb0cae33750e7dacbe7c4d11af847ef4b04343bb91254dc2af1ae49bcc48
Instruction ID: 6341af95d47367854d7c7e3cb3f2392173552b18690b208dcaa1288028807af4
Opcode Fuzzy Hash: 2928eb0cae33750e7dacbe7c4d11af847ef4b04343bb91254dc2af1ae49bcc48
Instruction Fuzzy Hash: B751123550424ADFDB15EF28C485AFA7BA4FF56310F248069F9919B3E0DA3C9D42CBA0

Function 007BF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 007BF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 007BF2BB

Strings

@, xrefs: 007BF2AF

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: d9364e01ea8d100b046d51cbad38afe06b02f7b61c28012621eae7ab5395ba54
Instruction ID: 6f47cdfe47115a9006b0e35da3d8953088134249130850ac28e4c35d9d116a8d
Opcode Fuzzy Hash: d9364e01ea8d100b046d51cbad38afe06b02f7b61c28012621eae7ab5395ba54
Instruction Fuzzy Hash: 45512372418744EBD320AF10DC8ABABBBF8FBC5300F81895DF199411A5EB748529CB66

Function 00825745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 008257E0
_wcslen.LIBCMT ref: 008257EC

Strings

CALLARGARRAY, xrefs: 008257E6, 008257EB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 9ad435ba171d039e4689b4b52ec36ab5d5b73b5f7f586bf21d298e9fe0e1ecb1
Instruction ID: 9dbd33188e51f66b9c33f8fcba16ec771bea9760c5ef7aff7ca6f90b770c93aa
Opcode Fuzzy Hash: 9ad435ba171d039e4689b4b52ec36ab5d5b73b5f7f586bf21d298e9fe0e1ecb1
Instruction Fuzzy Hash: 3541BD31E40219DFCB04DFA8D8869BEBBB5FF99724F104129E505EB291E7749D81CBA0

Function 0081D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0081D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0081D13A

Strings

|, xrefs: 0081D10B

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 3a40219d21063e5e9e050c5c4f18bf86ddf22e63c6bb9a4315cd34edd24a7e35
Instruction ID: 1eda6d458c27a58f8d7fc7879de3a192e6948eddb4814547471d64b7280366df
Opcode Fuzzy Hash: 3a40219d21063e5e9e050c5c4f18bf86ddf22e63c6bb9a4315cd34edd24a7e35
Instruction Fuzzy Hash: 96311A71D00219EBCF15EFA4CC89AEEBFB9FF45300F000119F815A6162E735AA56CB50

Function 0083356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00833621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0083365C

Strings

static, xrefs: 008335BC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ded134e0386d611231aeace1c9cfbffb3a310d29f7a6e8d09ffb10756fda3e9e
Instruction ID: 24ad8719cf437f82d9458237a1c126c2c505e1e780135ab0e54c96625374ac32
Opcode Fuzzy Hash: ded134e0386d611231aeace1c9cfbffb3a310d29f7a6e8d09ffb10756fda3e9e
Instruction Fuzzy Hash: DD319C71110204AEDB209F28DC81EFB73A9FF98724F00961DF8A5D7290DA34ED91D7A0

Function 00834537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0083461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00834634

Strings

', xrefs: 0083458E

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 0915c9cc3a64e79ea3c7fcb3253633fd54636a46c54b111b75fbfb207b64cc64
Instruction ID: e9452be3007f49d0e3ccb8093f16ee4ffbeb84e1b649973b69d198341e334957
Opcode Fuzzy Hash: 0915c9cc3a64e79ea3c7fcb3253633fd54636a46c54b111b75fbfb207b64cc64
Instruction Fuzzy Hash: 1A312774A0120A9FDF14CFA9C981BDABBB5FF99300F10516AE904EB341E770A941CF90

Function 008331EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0083327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00833287

Strings

Combobox, xrefs: 00833249

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: ee071bc2b187ac3da8ae1a1390c9bd8ca625b1367be4f34e14a18360c0633df8
Instruction ID: 7634fa6c99814bf07de7f5a210897437a704a35dae7d671359d5351101282837
Opcode Fuzzy Hash: ee071bc2b187ac3da8ae1a1390c9bd8ca625b1367be4f34e14a18360c0633df8
Instruction Fuzzy Hash: 6D11B271300208BFEF219E54DC85EBB376AFBD4365F104628F918E7290D6759D5187A0

Function 00833710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 007A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 007A604C
Part of subcall function 007A600E: GetStockObject.GDI32(00000011), ref: 007A6060
Part of subcall function 007A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 007A606A

GetWindowRect.USER32(00000000,?), ref: 0083377A
GetSysColor.USER32(00000012), ref: 00833794

Strings

static, xrefs: 00833757

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 22e0f35eee0eaa7a7a203f4cca441b1032619b98eab19ec574d29aaab0dddfc1
Instruction ID: 6cae2212498c86c84bf32f455ae7452431914488cb4ce7f44ddb2d731e58e660
Opcode Fuzzy Hash: 22e0f35eee0eaa7a7a203f4cca441b1032619b98eab19ec574d29aaab0dddfc1
Instruction Fuzzy Hash: 31113AB2610209AFDF00DFA8CC46EFA7BB8FB48314F004924F955E2250E735E8519B90

Function 0081CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0081CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0081CDA6

Strings

<local>, xrefs: 0081CD66

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: cffed0f3e7814a1abe60978fd0c53336762f082ae1d87e153ee25714557e5df4
Instruction ID: 25d2ce9e69ff1635ab08251815a803f3a3ef433b27fea0d74f80e80e84313bd5
Opcode Fuzzy Hash: cffed0f3e7814a1abe60978fd0c53336762f082ae1d87e153ee25714557e5df4
Instruction Fuzzy Hash: D911C671285635BAD7344B669C45EE7BE6CFF527A8F004226B509D3180D7749880D6F0

Function 00833429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 008334AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 008334BA

Strings

edit, xrefs: 0083348F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f5f39d7fc39b2144cb258dca36baa64dabeeb4e1380301300924cb8309089824
Instruction ID: f89d36850effd4dcf4f672662f9360fa99bab063bbcbbe5b6fb883451c557dc6
Opcode Fuzzy Hash: f5f39d7fc39b2144cb258dca36baa64dabeeb4e1380301300924cb8309089824
Instruction Fuzzy Hash: 3411BF71100208ABEF114F64DC44AAB376AFBA5378F504724F960D31E0C775DD919798

Function 00806C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00806CB6
_wcslen.LIBCMT ref: 00806CC2

Strings

STOP, xrefs: 00806CBC, 00806CC1

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: cf4c45db5cb81a9a65604118c365ff9abc5eb9dfbccc0097a4becc7a7a1123a9
Instruction ID: 368ea3fb16f18260ce3ebd378c79f5b45231f1ce6ff9feb411df2f8251e1c5e9
Opcode Fuzzy Hash: cf4c45db5cb81a9a65604118c365ff9abc5eb9dfbccc0097a4becc7a7a1123a9
Instruction Fuzzy Hash: 4F010432A005268BDB609FBDDC859BF73A4FBA17107000528E852D61D0FB36D830C650

Function 00801CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 00803CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00803CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00801D4C

Strings

ListBox, xrefs: 00801D16
ComboBox, xrefs: 00801CEB

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 9261a68a19e90916871cb9aae1c3ec874626e7a7417cba2c15934be93e922ce8
Instruction ID: 49a623e71269cc67617a64286e4275710b68b6852798cda5f4a44869b6f67ce5
Opcode Fuzzy Hash: 9261a68a19e90916871cb9aae1c3ec874626e7a7417cba2c15934be93e922ce8
Instruction Fuzzy Hash: 9301B571601218ABDF44EBA4CC598FE7368FB56360B040619F832E73D1EA3459188660

Function 00801BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 00803CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00803CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00801C46

Strings

ListBox, xrefs: 00801C10
ComboBox, xrefs: 00801BE5

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 0069c0ef6179f6cdf7b1fca126daeef43883be696b01ce61ae7976cb0959dd96
Instruction ID: 98ceb613a291d056bc96f3e4d4fb5fed9235b2432ce5de197e77b6ca95c16174
Opcode Fuzzy Hash: 0069c0ef6179f6cdf7b1fca126daeef43883be696b01ce61ae7976cb0959dd96
Instruction Fuzzy Hash: C101A775681108ABEF48EBA0CD5A9FF77A8FB52350F140019B516F72C1EA28DE5886B1

Function 00801C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 00803CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00803CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00801CC8

Strings

ListBox, xrefs: 00801C94
ComboBox, xrefs: 00801C69

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 44cc4e5c47f1fd0a55ddc0731d2d0f57675faeee442e2bcbcf167b7aa0261a2c
Instruction ID: 07dbe85f9a59a6b6a2c09e66413f4ea19f3d91fd8f683c213c783a41b8033041
Opcode Fuzzy Hash: 44cc4e5c47f1fd0a55ddc0731d2d0f57675faeee442e2bcbcf167b7aa0261a2c
Instruction Fuzzy Hash: 8401DB71641118A7EF54E7A4CE1AAFE73ACFB52350F140015B901F32C1EA24DF18C671

Function 00801D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007A9CB3: _wcslen.LIBCMT ref: 007A9CBD

Part of subcall function 00803CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00803CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00801DD3

Strings

ListBox, xrefs: 00801DA0
ComboBox, xrefs: 00801D75

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: c74b8c00c0c8644bb92bea22f01542cf14862b13183c5048a309a66ffc28f425
Instruction ID: bbe900825ad2ebc98f75ba2d8cb79ea57ba4df758855a29e76294f2b9da40e83
Opcode Fuzzy Hash: c74b8c00c0c8644bb92bea22f01542cf14862b13183c5048a309a66ffc28f425
Instruction Fuzzy Hash: 7DF0F971A40618A6DB44E7A4CC5AAFE736CFB42364F040915B922E32C1DE6459088270

Function 0082747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00827493
_wcslen.LIBCMT ref: 008274B9

Strings

3, 3, 16, 1, xrefs: 00827483

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: b17b1af24b5dce1e319fbad19f6f1203f310e7eede6b72cb1ab86d2c250caef5
Instruction ID: 9749b4110155b7e4fa87a0fa1928613454c4e550bf9d43a13a28ab4dfe2bf28f
Opcode Fuzzy Hash: b17b1af24b5dce1e319fbad19f6f1203f310e7eede6b72cb1ab86d2c250caef5
Instruction Fuzzy Hash: DDE02B42604230609231327BBCC5EBF5789EFC5750710182FF981C2366EAA89DD193A5

Function 00800B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00800B23

Strings

Error allocating memory., xrefs: 00800B1C
AutoIt, xrefs: 00800B17

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 8a1f795ebae6dced69ac541e91315bda70e14eb65a6a827cdac0acba2207f4fe
Instruction ID: 5a31b605dfa926de0cb3a5b5f10569687c3616b10a94396831aa4ac8169d1123
Opcode Fuzzy Hash: 8a1f795ebae6dced69ac541e91315bda70e14eb65a6a827cdac0acba2207f4fe
Instruction Fuzzy Hash: C6E0DF32284718AAD21036947C0BFC97B84EF05F21F10042AFBA8E55C38BEA649007E9

Function 007C0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007BF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,007C0D71,?,?,?,007A100A), ref: 007BF7CE

IsDebuggerPresent.KERNEL32(?,?,?,007A100A), ref: 007C0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,007A100A), ref: 007C0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 007C0D7F

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 1b329d1917ff25f688bbe301bbf8dd250402f524860927f818467ff679585a37
Instruction ID: b460bf9b9df80129aff94e857bda1ee934b46fa12d720803b79f2290534d0a27
Opcode Fuzzy Hash: 1b329d1917ff25f688bbe301bbf8dd250402f524860927f818467ff679585a37
Instruction Fuzzy Hash: AFE06D70300311CBD7209FB8D8087427BE0BB40B40F004E6DE886CA652DBB8E4448BD1

Function 00813017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0081302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00813044

Strings

aut, xrefs: 00813038

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 73ce5b2e10772be3ce1f4bbf8cca03595fe458dcb42a1e38e719dec406334013
Instruction ID: 0856306f7e5cf901fe71083bf54969f10c833da7bf746295063a96be90962c53
Opcode Fuzzy Hash: 73ce5b2e10772be3ce1f4bbf8cca03595fe458dcb42a1e38e719dec406334013
Instruction Fuzzy Hash: 8BD05E7250032867DA20A7A4AC0EFCB3B6CEB44751F0006A1BA55E6091EAB49984CBD0

Function 00832322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0083232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0083233F

Part of subcall function 0080E97B: Sleep.KERNEL32 ref: 0080E9F3

Strings

Shell_TrayWnd, xrefs: 00832325

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: d5d930fda017dee28e0725977ce6889b1985a407665f8bdcefffc33b261a09eb
Instruction ID: 194fbf32370b6fee50c50d35ec84837bf760da01893c9cc395420df2fe511d9d
Opcode Fuzzy Hash: d5d930fda017dee28e0725977ce6889b1985a407665f8bdcefffc33b261a09eb
Instruction Fuzzy Hash: E8D0C936394350B6E6A4A7709C4FFC67A14BB50B10F014E167655FA1D0D9A4A8018B54

Function 00832356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0083236C
PostMessageW.USER32(00000000), ref: 00832373

Part of subcall function 0080E97B: Sleep.KERNEL32 ref: 0080E9F3

Strings

Shell_TrayWnd, xrefs: 00832365

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 09fac1fd4f8c8ccc6d5dbf416e8defffb67d3633ea46c0d84ed2734679515d1d
Instruction ID: 8e003ec1e578b940130110a56b2b42257a5eeb440d04d223ff24ede0744dd9e2
Opcode Fuzzy Hash: 09fac1fd4f8c8ccc6d5dbf416e8defffb67d3633ea46c0d84ed2734679515d1d
Instruction Fuzzy Hash: 0DD0C9323813507AE6A4A7709C4FFC67A14BB55B10F014E167655FA1D0D9A4A8018B54

Function 007DBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 007DBE93
GetLastError.KERNEL32 ref: 007DBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 007DBEFC

Memory Dump Source

Source File: 00000001.00000002.2289209747.00000000007A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007A0000, based on PE: true

Associated: 00000001.00000002.2289164740.00000000007A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.000000000083C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289614859.0000000000862000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289812525.000000000086C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2289842488.0000000000874000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a0000_rpDOUhuBC5.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 839920492256dc90f8d3f8692fa0b4cc0497b5d0edf810a65e672bd056cb8b3f
Instruction ID: 86b63964eb5779c4c7dcd3ffe1b0091be6b8f48ba7def9445ebbd32887f43572
Opcode Fuzzy Hash: 839920492256dc90f8d3f8692fa0b4cc0497b5d0edf810a65e672bd056cb8b3f
Instruction Fuzzy Hash: 6941D435600246EFCF218FA5CC84BBA7BB5AF41320F16416EF959973A1DB348D01DB60

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rpDOUhuBC5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_0aea9c95-3e48-41e6-b217-65ec04139348.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_0aea9c95-3e48-41e6-b217-65ec04139348.json.tmp

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

C:\Users\user\AppData\Local\Temp\tmpaddon

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7DFTD2462SS4IXM6N7VN.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PSXL6YZH95LMJ9T7QUXD.temp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json.tmp

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4 (copy)

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4.tmp

Windows Analysis Report
rpDOUhuBC5.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre